Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
Best approach in evaluating time and effort for certification
What could be the best approach only to evaluate time and effort for certification in case you win business that require it (example site 200-500 employee, 50 employee for the business) rephrase question: what best first step for evaluate effort and time for to be certified (in case customer require certification for new business).
-
Risk Assessment Questions
1. I have one hundred laptops, and thirty servers, do I list them all individually in the Risk Assessment Table? 2. The aforementioned devices are in outsourced data centers, but they still must be listed as risks, correct? 3. I am assuming that much of the risk will be transferred to the outsourcer? -
Toolkit content
Per my discussion with the marketing team before the Toolkit was purchased, I was informed that the Toolkit includes the analysis spread sheets that we can use to collect data and analyse the results. Per the two links issued below, what see is the tutorials. As explained, all we need is a tool to collect data and analyze it and not tutorial on how to collect data. Please let us know as to as to how you will assist us on this matter. I cannot find any data analysis sheet within the RAR zipped folders -
Implementation process
Estoy por iniciar la implementacion al sistema de iso 27001. Quisiera preguntar en terminos generales el procesos para la implementacion, y de igual forma saber si quisiera una consultoria como es el processo I am about to start the implementation to the iso 27001 system. I would like to ask in general terms the process for the implementation, and in the same way to know if I would like a consultancy such as the process -
Annex A.8.3.1 to 8.3.3
When looking at controls in Annex A.8.3.1 to 8.3.3 regarding removable media, I cannot really understand how this is any different to the equipment mentioned in A.11.2.7 for instance. I guess both controls refer to the same objects, right? USB flash drives, CD, DVD, laptops, smartphones etc. So basically - are 8.2.3 and 11.2.7 referring to the same objects? -
Conformio - setting up people and departments
The project sponsor is not supposed to be involved (Project Plan para 3.4.1) – is that critical? We’re a small company where the MD will be very much driving this. If necessary, I could choose our chairman but our MD would be better in practice. -
ISO 27001 Lead Auditor exam - Doubts regarding a question
I took a part in ISO27k Lead Auditor workshop in August 2021. I also approached the exam. Unfortunately, I was not able to pass IS part, as 6 % were missing to achieve 70% for this area. I have a doubt regarding two questions, asked during one or both approaches to the exam in IS area. As we do not receive a report which questions were responded correctly and which not, I am not able to verify it by myself. 1 - There was a question during the exam, which was like: Should risk owner be assigned to each critical risk? I responded Yes, but I was started wondering if the question should be understood just in the context of critical risk or in a wider context, meaning does the question ask really about critical risk in it or maybe the response should be No, because standard requires owners to be assigned to all type of risks found? 2 - Second one is regarding "justification" of adding particular control to SoA. I do not entirely understood how to read "justification" in this question? Could you please explain it to me? I will be grateful. -
Can certified ISO 27001 Lead Auditor train and certify other people?
1. I was told a certified ISO 27001 LA can train and certify other people? 2. If true? is there a special certificate/training to be able to do this? -
Changing risk scale in Conformio
Could you provide more clarification about why a scale from 1-3 was used for the risks instead of 1-5? -
IT Assets Disposal/ Write-Off
Dear Dejan, Hope you are doing fine. We are glad to inform you that we are officially an ISO 27001 certified Company now. Thank you for your support and toolkit. We need your advice in the IT assets disposal/write-off, our query is we recently gave few laptops to our staff since there previous laptops were old enough, please suggest a suitable and universal method accepted by Auditors to dispose them as per controls A.8.3.2 Disposal of Media and A.11.2.7 Secure Disposal or Re-use of Equipment and return the old laptops to staff for their personal use. Basically, we need to know what proofs we need to keep to show the auditors that the disposal/write-off has been done in compliance with ISO 27001. Thank you in advance.