ISO 27001 & 22301 - Expert Advice Community

General criteria used to determine critical services

Trabajo para la ***, y ***, compañera de trabajo, me dio su correo. En el 2019, ella adquirió las plantillas de continuidad de negocios de su empresa.

Le escribo a ver si puede ayudarme con una consulta: Según su experiencia, ¿cuál es el criterio general que utilizan las empresas para determinar los servicios críticos, que son la base de la estrategia de continuidad de negocios? 

Por otro lado, si puede compartirnos el listado de cursos que ofrecen sobre el tema de continuidad de negocios.

Agradezco mucho su asistencia.

Separate Risk Assessment

I'm currently working for a bank and we have around 250 plus branches..
We have a requirement for all our branches to get complied with ISO 27001:2013.
What my question is how to approach this task?
We are currently in the process of certifying our head office..
Do we need to conduct separate risk assessments and asset inventory for each branch. Isn't there an easy way?

ISO 27001 implementation

Hope you are well.
I have bought the documentation toolkit with extended support.
1 - Frankly, I'm not quite sure to whom should I send my queries via email.
I have received detailed email explaining these things at the time of purchase, but I can't find it now.

2 - I'm planning to implement the ISO 22301 for our bank, which is a leading bank with more than 30 branches, and for now we are planning to certify only IT department operations.
my question is, do we need to include the branches in our scope or it's just our HQ office and our DR Site?
In each branch, we have some switches, firewalls that is used to connect to our centralized systems. All the equipment in the branches are managed centrally from the head office.

Scope as IT Department,

If I'm setting the scope as IT Department, should I include the branches as well in the scope.
In each branch I have some routers and switches to connect to the HQ where all systems are central and managed from the HQ.

Document control - do we need that?

Dear support,

I see that Document Control is not on the list of mandatory documents.

Do we still need that division by confidentiality levels, or we can proceed without this procedure?

Or maybe it is highly recommended?

We are already 9001 certified, and not using the Document control procedure there.

Thank you!

Adaptation for small medico-social establishments

What adaptation for small medico-social establishments?

Legal requirements related to 27001 in the UK

Which are legal requirements related to 27001 in the UK?

Implementation of ISO 27001

What will be expected of a marketing position in the implementation of ISO 27001? Are there any documents that need a marketing role's attention?

Scope of areas under ISO 27001

1. Kindly send the scope of areas under ISO 27001. 

2. Does it cover all areas under IS Audit