ISO 27001 & 22301 - Expert Advice Community

Home / ISO 27001 & 22301

Discussions

Top Contributors

Expert

Rhand Leal

4151
Discussions
Expert

Carlos Pereira da Cruz

1915
Discussions
Expert

Dejan Kosutic

365
Discussions

Most Popular Tags

Product: Conformio Product: ISO 27001 Documentation Toolkit Product: ISO 13485 & MDR Integrated Documentation Toolkit ISO 27001 Product: ISO 27001 & ISO 22301 Premium Documentation Toolkit ISO 9001 Risk Assessment Product: ISO 13485 Documentation Toolkit ISMS Internal Audit register of requirements Product: ISO 27001 & ISO 27017 & ISO 27018 Cloud Documentation Toolkit Product: ISO 27001/Risk Assessment Table ISO 9001:2015 ISO27001
Select
CREATE NEW TOPIC +
Guest

Guest

Create New Topic As guest or Sign in

HTML tags are not allowed

Select

Assign topic to the user

  • License management Auditing

    Could you possibly point me in the right direction in ISO 27001 where I can find information about License management Auditing?

  • Integration of 22301 and 27001 - common policies

    We have already implemented ISMS in our organization and work on BCMS implementation. Is it a good idea to add selected BCM contents to existing ISMS policies? I mean to update create one main policy with general contents dedicated to IS and BCM (inc. context ect.) to have Information security and Business Continuity Policy - main document. Then one detailed policy for BCM and IS events, which clearly describes who and how manage such incidents. Our priority is to have one integrated system covering ISM and BCM, not two separated management systems. Thanks for your advice

  • Focus area on a surveillance visits

    Our company got ISO 27001 certified this year - and will go through surveillance visits next year.

    I wonder if there are any focus areas during a surveillance visit and if you could provide any guidance and support on what to focus on during the surveillance visit?

  • Information Security Risk Assessment and Risk Treatment

    1. What happens if all controls (Existing and additional control(based on Annex A) are implemented? Does it mean we entirely remove the risk from the register - yet based on the activities there are chances of the risk taking place?

    2. How often should an organization undertake risk assessment and risk treatment

    3. When should one calculate the residual risk? Should it determine the risk assessment process of the subsequent year?

    4. Is there any template that you can share for risk assessment and treatment, with criteria and like hood, etc.

  • Scope of legal and contractual requirements

    Hi, In this list https://advisera.com/27001academy/knowledgebase/laws-regulations-information-security-business-continuity/
    for France and the European Union, there are mainly regulations regarding personal data protection. In my understanding, ISO27001 requires to list all the regulations that apply to the business of the company seeking the ISO certification, which would be much wider.
    For example, our company provides a billing software. I would have listed all french regulations related to billing and not only data protection. Is my interpretation of the norm too wide ?

  • Annex A.14.2 controls

    I have a question that I cannot get a clear answer to.  I hope that you can help.

    My customer develops a software product for its customers.  They do not however carry out any software development for themselves.  All of the systems that they use in-house are commercial-off-the-shelf packages like Office365, Slack, PeopleHR, and Xero (all of which are SAAS applications).  They do not customise the code at all.

    We are trying to establish whether or not they need to apply the Annex A.14.2 controls as these are aimed at "developments within the organisation".

    Do you have any thoughts on this?

  • ISO 27017 and ISO 27018

    The ITU recommendation, do we need to prepare any separate documentation for these or are controls included in standard
Page 140 of 544 pages