ISO 27001 & 22301 - Expert Advice Community

Queries ISO 27001

Hola, hice una traducción a una documentació que encontre del Ingles al Español y hay cosas que no entiendo a que se refieren como por ejemplo:

La apreciación de riesgos de seguridad de la información no requiere...

que es lo que no requeriría en este caso, definir los criterios de aceptación de los riesgos, definir sanciones por imcumplimiento en la seguridad de la información, la identificación de los riesgos de seguridad o la identificación de los dueños del riesgo?

Query on ISO 27001:2022 SOA

I have a question where I need your help:

You can refer to this link:
https://advisera.com/27001academy/knowledgebase/the-importance-of-statement-of-applicability-for-iso-27001/

Now for the ISO 27001:2022 SOA

do we need to add a column on how each control is implemented or it is not mandatory?

and only the following columns are sufficient:

- definition of which controls (security measures) will be applied, covering the suggested controls from ISO 27001 Annex A
- justification for inclusion of controls that are applicable
- the implementation status of applicable controls (i.e., if they are implemented or not)
- justification for the exclusion of controls from Annex A that are not applicable

Improvement Log

Should one have an Improvement Log and what fields should we use?

ISO Standard for KYC

Hi, I need some information; what are the ISO 27001 standards to apply for the KYC process?

Gap analysis

Me han pasado una agenda de gap análisis sobre la implementación de la ISO 27001:2013.

La documentación que he adquirido me permite, entiendo, una vez completada, responder a este gap análisis.

¿Esto es correcto?

Internal Audit and Statement of Applicability

1. Does the internal audit need to happen before Stage 1 certification audit? Or can we schedule an internal audit to happen following Stage 1 when we have implemented the feedback?

2. Currently working on the Statement of Applicability and I wanted to ask if all of the controls we say YES to implementing, do they need to be noted down in the Risk Treatment process? Or is it okay to have some additional controls in the Statement of Applicability in comparison to the Treatment?

Documented processes

I have a question - must a team have documented processes to comply with ISO 27001? In other words, if during an audit you come across a team that has not documented their processes, is that a non conformity?

Gap analysis question

They have sent me a gap analysis agenda on the implementation of ISO 27001:2013. The documentation I have acquired allows me, I understand, once completed, to respond to this gap analysis. This is correct?

Question for assignment

1 - For instance, in documents like SECURITY PROCEDURES FOR IT DEPARTMENT and IT SECURITY POLICY, record names, storage locations, etc. must be specified. So my concern is, how will it be if we are progressing with IT Security policy and have to write the same document name in the record name? According to my understanding, if we define a record name, there would be various documents pointing to that procedure. Let me know briefly what we can write, please.

2 - The situation you presented is very unusual, because a record related to a document in general refers to a specific action described in the document, and would not include the name of the type of the document. For example, for the “Backup Policy” you would have a record named “backup record” or “restoration record”

Another concern is that we don't use antivirus software, yet the IT Security Policy has a section about it. "What should we say in that section if our company doesn't use antivirus software?

3 -If you could clarify my confusion regarding the fact that the record name here in the secure development policy prepopulates the information for the record name and also shows the procedure for secure information system engineering and testing plan for security requirements and system acceptance, will we still need to create these documents on our own? How will the records be created?

This question is related to Section 4 in security development policy document