ISO 27001 & 22301 - Expert Advice Community

Home / ISO 27001 & 22301

Discussions

Top Contributors

Expert

Rhand Leal

4151
Discussions
Expert

Carlos Pereira da Cruz

1915
Discussions
Expert

Dejan Kosutic

365
Discussions

Most Popular Tags

Product: Conformio Product: ISO 27001 Documentation Toolkit Product: ISO 13485 & MDR Integrated Documentation Toolkit ISO 27001 Product: ISO 27001 & ISO 22301 Premium Documentation Toolkit Risk Assessment ISO 9001 Product: ISO 13485 Documentation Toolkit ISMS register of requirements Internal Audit Product: ISO 27001/Risk Assessment Table Product: ISO 27001 & ISO 27017 & ISO 27018 Cloud Documentation Toolkit ISO Product: ISO 27001 Internal Auditor Course
Select
CREATE NEW TOPIC +
Guest

Guest

Create New Topic As guest or Sign in

HTML tags are not allowed

Select

Assign topic to the user

  • Information Security Risk Assessment and Risk Treatment

    1. What happens if all controls (Existing and additional control(based on Annex A) are implemented? Does it mean we entirely remove the risk from the register - yet based on the activities there are chances of the risk taking place?

    2. How often should an organization undertake risk assessment and risk treatment

    3. When should one calculate the residual risk? Should it determine the risk assessment process of the subsequent year?

    4. Is there any template that you can share for risk assessment and treatment, with criteria and like hood, etc.

  • Scope of legal and contractual requirements

    Hi, In this list https://advisera.com/27001academy/knowledgebase/laws-regulations-information-security-business-continuity/
    for France and the European Union, there are mainly regulations regarding personal data protection. In my understanding, ISO27001 requires to list all the regulations that apply to the business of the company seeking the ISO certification, which would be much wider.
    For example, our company provides a billing software. I would have listed all french regulations related to billing and not only data protection. Is my interpretation of the norm too wide ?

  • Annex A.14.2 controls

    I have a question that I cannot get a clear answer to.  I hope that you can help.

    My customer develops a software product for its customers.  They do not however carry out any software development for themselves.  All of the systems that they use in-house are commercial-off-the-shelf packages like Office365, Slack, PeopleHR, and Xero (all of which are SAAS applications).  They do not customise the code at all.

    We are trying to establish whether or not they need to apply the Annex A.14.2 controls as these are aimed at "developments within the organisation".

    Do you have any thoughts on this?

  • ISO 27017 and ISO 27018

    The ITU recommendation, do we need to prepare any separate documentation for these or are controls included in standard

  • Psychology within the scope of risk treatment and analysis

    Thanks for the update on the course. I have a project that is still in development and I was wondering if you had any information on the issue of psychology within the scope of risk treatment and analysis. If we're going to build the profile of a job that contains a risk at any level either within the task sequence or the individual assessment of the task, how do we determine the responsible strategy of analysis of the situation.
Page 141 of 544 pages