ISO 27001 & 22301 - Expert Advice Community

Security policies for cloud environment

As my security and compliance team are preparing annual policy review.

Can you guide me some security policies for cloud environment, controlled data border  ( PaaS, SaaS … ). For example, in ***, the State Bank requires data must be accessed by the government when necessary (data center in ***...)

Question about ISO 27018 certification

I am trying to determine if ISO 27018 is certifiable same as ISO27001. If not how are companies saying they have a certificate. How does that work?

Aligning business strategy to ISMS

How do you align business strategy to ISMS?

ISO certification

1. What are all the procedures for getting ISO 27001 certification for an organization?
2. What are all the requirements (i.e., qualification for company, needs for getting ISO certification)?
3. Where we can apply for that ISO certification?
4. What is the cost of this ISO certification?
5. If we applied when it will reach us?
6. How much the period of time for this ISO certification? Once we got that certification when we renew that or not needed.

ISO certification

Una pregunta.
Necesitamos certificarnos en seguridad de borrado de datos o destrucción de discos.
Cual de las ISO nos serviría para revisar los paquetes?

2.4 . 1 /2/3/4 Requirements for logging and monitoring

How are you keeping? I am busy with the process and as you know when done thoroughly takes a lot of time. At the moment I am busy with the Audit logging process and I am Looking for 12.4 . 1 /2/3/4 Requirements for logging and monitoring

Can you please help me out here as I cannot find these the toolkit stops at 12.1

Mandatory policies

Hi, I have a question re mandatory policies.

Do they need to be stand-alone policies? Or can they be combined? For example, combining Risk assessment and risk treatment methodology (clause 6.1.2), Risk treatment plan (clauses 6.1.3 e and 6.2), and Risk assessment report (clause 8.2) policies into one Risk Management policy?

Questions on security incident and clause 4

1. A question came up in our review of Security incident management, we have the following stated in our policy, should we say “must report” or should report?  Is this a legal issue, obviously this policy we would share with our customers and third parties, right? 

Each employee, supplier or other third party who is in contact with information and/or systems of Levi, Ray & Shoup, Inc. or their customers must report any system weakness, incident or event which could lead to a possible incident.

2. It looks like clause 4 is missing from the packet of templates you sent, there is no 04 documents, this is strange. Our external auditors are referencing clause 4 in a finding but I really don’t see anything in the iso document itself on this.

Questions about ISO 27001 implementation

Hi team, I'm not sure if this is the right place. I purchased the ISO 270001 templates package and have a couple of questions:

1. I already read ISO 27001 standard but I've not purchased it yet. We're ready to purchase the document, but I see it also refers to ISO 27000, 27002, 27003, 27004, 27005 and 31000. Do we need to purchase all those documents to pursue certification?

2. We have defined the following objectives for the ISMS:
- Create a better market image which will let it acquire or retain security-conscious clients, at least 4 during next year
- Ensure service uptime of 99.95% throughout the year
- In case of disaster, data loss of a maximum of 24 hours, with time to recovery of 6 hours
- Conformity with data privacy and security regulations
- Reduce the damage caused by potential incidents
- Ensure the confidentiality of the customer data handled by the company

As you can see, some are measurable but some are not. Is there an obligation to make those measurable? What happens if the objectives are not achieved?

3. When preparing the Risk Assessment, some of the risks are under the domain of a supplier. For example, our servers are hosted on a data center and we have a supplier that sub-contracts and manages the servers. How is the appropriate way to document those risks? I'm guessing we still have to list the risks (for example a breach in a server) and then in the Risk Treatment table we'll specify those risks are transferred to a third party? Or should it be instead "selection of controls", regardless of who does it, and then we would draw a contract with the supplier to apply those controls?

4. Our company is fully remote, our employees and contractors work at home. I guess this is an important thing to mention because it affects how the risk analysis is made (for example, there is no "office" asset, which maybe the auditor would not understand). Where is the best place to document this?