ISO 27001 & 22301 - Expert Advice Community

2.4 . 1 /2/3/4 Requirements for logging and monitoring

How are you keeping? I am busy with the process and as you know when done thoroughly takes a lot of time. At the moment I am busy with the Audit logging process and I am Looking for 12.4 . 1 /2/3/4 Requirements for logging and monitoring

Can you please help me out here as I cannot find these the toolkit stops at 12.1

Mandatory policies

Hi, I have a question re mandatory policies.

Do they need to be stand-alone policies? Or can they be combined? For example, combining Risk assessment and risk treatment methodology (clause 6.1.2), Risk treatment plan (clauses 6.1.3 e and 6.2), and Risk assessment report (clause 8.2) policies into one Risk Management policy?

Questions on security incident and clause 4

1. A question came up in our review of Security incident management, we have the following stated in our policy, should we say “must report” or should report?  Is this a legal issue, obviously this policy we would share with our customers and third parties, right? 

Each employee, supplier or other third party who is in contact with information and/or systems of Levi, Ray & Shoup, Inc. or their customers must report any system weakness, incident or event which could lead to a possible incident.

2. It looks like clause 4 is missing from the packet of templates you sent, there is no 04 documents, this is strange. Our external auditors are referencing clause 4 in a finding but I really don’t see anything in the iso document itself on this.

Questions about ISO 27001 implementation

Hi team, I'm not sure if this is the right place. I purchased the ISO 270001 templates package and have a couple of questions:

1. I already read ISO 27001 standard but I've not purchased it yet. We're ready to purchase the document, but I see it also refers to ISO 27000, 27002, 27003, 27004, 27005 and 31000. Do we need to purchase all those documents to pursue certification?

2. We have defined the following objectives for the ISMS:
- Create a better market image which will let it acquire or retain security-conscious clients, at least 4 during next year
- Ensure service uptime of 99.95% throughout the year
- In case of disaster, data loss of a maximum of 24 hours, with time to recovery of 6 hours
- Conformity with data privacy and security regulations
- Reduce the damage caused by potential incidents
- Ensure the confidentiality of the customer data handled by the company

As you can see, some are measurable but some are not. Is there an obligation to make those measurable? What happens if the objectives are not achieved?

3. When preparing the Risk Assessment, some of the risks are under the domain of a supplier. For example, our servers are hosted on a data center and we have a supplier that sub-contracts and manages the servers. How is the appropriate way to document those risks? I'm guessing we still have to list the risks (for example a breach in a server) and then in the Risk Treatment table we'll specify those risks are transferred to a third party? Or should it be instead "selection of controls", regardless of who does it, and then we would draw a contract with the supplier to apply those controls?

4. Our company is fully remote, our employees and contractors work at home. I guess this is an important thing to mention because it affects how the risk analysis is made (for example, there is no "office" asset, which maybe the auditor would not understand). Where is the best place to document this?

A.5 Information Security Policies

Why are there no templates in the Toolkit for the controls under A.5 Information Security Policies?  I would have expected to find these in the folder A.6_Organization_of_Information_Security.

ISO27001 - How to meet the requirement of A.17.1 and A.17.1.2

ISO 27001 statutory requirements

How meet acceptable ISO 27001 statutory requirements, within reasonable resources at disposal?

How to use ISO 27001 in the hospital

How to successfully implement ISO 27001 in the hospital?