I have a question regarding Acceptable Use Policy vs all of the smaller documents (DYOD, Teleworking, cryptographic controls, password policy).
Control 6.1.2
Gostaria que me ajudasse a entender de forma mais plena o A 6.1.2 . Pelo meu entendimento diz respeito a direitos de acesso a informação conflitantes por exemplo: Departamento de compras, conflito de acesso ao departamento financeiro. Estou criando uma matriz que informa os direitos de acesso e as barreiras de controle indicadas. Estou no caminho certo?
Controls performance measurement
How would you measure security controls performance and effectiveness and provide a sample dashboard that you have built before?
Inventario de activos
Estamos en la compañia levantando el inventario de activos de información y quisiera saber si tienen una matriz que pueda utilizar de ejemplo o un documento que me indique los criterios mínimos que debo tener en cuenta para la construcción de la matriz que me permita desarrollar todo el inventario de activos
Cyber security industry in South Africa
I am writing to inquire about the cyber security industry in South Africa.
Template content
I do see that you have an internal audit checklist for US 49.90 I want to be sure that it will cover the questionnaire for all the clauses and annexure for ISO 22301 and ISO 27001.
Gap assessment report
Now I need to create a gap assessment report from the implementation perspective I want report format, not a checklist. What document can be used for ISO 27001 GAP assessment report?
Documentation of security responsibilities
Is it necessary to add the specific ISO 27001 duties, responsibilities and related ISO controls to the job descriptions of HR, Finance IT Manager, Office Administrator managing some aspects of physical access? I have already written job descriptions for the Information Security Officer and the Data Protection Officer.
Risk assessment approach on ISO 27001
I want to know if risk assessment in ISO 27001 standard is asset based or process based?