ISO 27001 & 22301 - Expert Advice Community

Complying with ISO 27001 and EU GDPR

Can an IT company with 1 employee and working with freelancers/consultants be compliant with iso27001 and gdpr?(Gdpr requires a data privacy officer)

ISO 27001: DevOps toolchains

How can ISO 27001 be granted if all changes are only visible in DevOps toolchains? Changes are no longer approved and implemented, only playbooks in Jenkins, Ansible, Docker or OpenShift are started. Can these tools be viewed as a certified management system?

BCP/DRP

Just considering with the threat of hackers and cybersecurity being rampant now, how to approach the BCP/DRP in my planning?

FCS security governance critical success factor

I want to write a risk assessment table , do we include the asset category, CWE, vulnerability, likelihood , impact and risk in the table column or not

ISO 27001 Certification

I have just obtained my CISSP, working on CISM what would you recommend that I do to start progress towards becoming an ISO 27001 Standards consultant, what would my next best certification be? I am looking at getting my PMP after completing the CISM.

Submitting records for approval

Just getting started writing policy for ISO 27001. I have completed the Context, Requirements and Scope document. Is it better to move on and create/finish more documents and approve/distribute all at once with management or start document approvals now risking updates/adjustments as more progress is made?

Difference between strategies and solutions in ISO 22301

Questions related to Controls

1. When doing the Access Control policy we found ourselves relatively short of content in the policy document (this has not appeared to be the case in all policies we’ve worked through). Are you able to give us any guidance on where we could find resources with more prescriptive control examples, than are found in the ISO 27002 standard? The challenge we seem to have is the policies are not all encompassing in terms of coverage of the controls, and when we turn to the controls in the standard, the controls appear quite vague in some cases. Is there somewhere a next level down of control examples? Any comments / insights you can offer around this would be appreciated.

2. Is there anything at all stopping us from incorporating the controls found in CSA CCM into our documentation suite? Many map to ISO controls, but in some cases appear to be more specific.

If we were doing this, do you have any suggestions or comments we should keep in mind when approaching this?

System Acquisition Development and Maintenance

Regarding 27001 Toolkit\08_Annex_A_Security_Controls\A.14_System_Acquisition_Development_and_Maintenance:

We do not do any software development. Is it safe to say that we do not need to complete this Policy and Appendix on Specification o Requirements?   If so, do we note this elsewhere in the documentation?