ISO 27001 & 22301 - Expert Advice Community

Home / ISO 27001 & 22301

Discussions

Top Contributors

Expert

Rhand Leal

4151
Discussions
Expert

Carlos Pereira da Cruz

1915
Discussions
Expert

Dejan Kosutic

365
Discussions

Most Popular Tags

Product: Conformio Product: ISO 27001 Documentation Toolkit Product: ISO 13485 & MDR Integrated Documentation Toolkit ISO 27001 Product: ISO 27001 & ISO 22301 Premium Documentation Toolkit Risk Assessment ISO 9001 Product: ISO 13485 Documentation Toolkit ISMS register of requirements Internal Audit Product: ISO 27001/Risk Assessment Table Product: ISO 27001 & ISO 27017 & ISO 27018 Cloud Documentation Toolkit ISO Product: ISO 27001 Internal Auditor Course
Select
CREATE NEW TOPIC +
Guest

Guest

Create New Topic As guest or Sign in

HTML tags are not allowed

Select

Assign topic to the user

  • Controls A.6.1.3 and A.6.1.4

    1. How can the Organization be compliant with these Controls?

    A.6.1.3: Contact with Authorities: Does it mean contact with the Superior Authority who is also the supreme body for GDPR?

    2. A.6.1.4: Contact with Special Interest Groups: Does having ISACA Memberships of some other Interest Groups are taken into consideration?

  • Control A.14.2.7

    We are in the process of implementing ISO 27001, the company doesn’t have external development so the A.14.2.7 control for outsourced development is not applicable, shall we consider all A. 14 controls are not applicable or only A.14.2.7 Your advice is highly appreciated

  • Risk treatment plan vs Statement of applicability

    trying to understand the difference between the risk treatment plan and the statement of applicability.  Shouldn’t one document show what controls need to be implemented, seems like the purpose is the same.

  • ISO 27001-13 114 control

    Hi, is there any list of processes and procedures which are aligned with ISO 27001-13 114 controls?
    i mean for example , Access control policy, how many processes and procedures are good enough to be developed for this policy. same is for other domains

  • Documentation versioning

    does ISO27001 mandate documentation versioning?
    I mean like a clear mandate for versions within the document itself, as some sort of version control.

  • SoA justification for selection (of control)

    I have a question about SoA’s justification for the selection of control: A lot of controls have been established in use over the years (as kind of “security best practices”), so there is no recent risk treatment nor risk number for the control, how the justification for selection is written in the SoA in these cases?  

  • ISO 27001 PCI DSS mapping

    Hi. Just started with ISO 27001 toolkit. As I work through I would like to map to PCI DSS as I go along. Do you have anything like this? Thanks!

  • Denial of Service Attack

    I'm thinking when I have Denial of Service Attack what asset should I put this into
    I mean it is digital, but what documents can be affected by this

    My question was regarded to DDoS attack as I am filling up the risk report. I downloaded a template and Im trying to follow that. I work for Web Hosting company so this report is for IT department only and obviously it is just a starting point.

  • Annex A

    Can you help us by giving us various examples of justification (applied or not ) for the different measures in Appendix A?

  • Integrated Management System

    My company has taken an integrated approach to ISO 27001, 9001 and 22301. I have 2 questions:

    1. We have integrated the 3 risk registers and have been having monthly risk meetings but we would like to find out how often would the SOA change from the ISO 27001 perspective?  Would it be after each risk meeting?  What happens if a control has been implemented and another risk is identified to the same control? 

    2. We are approaching our surveillance audit soon and would like to find out what an auditor would typically look out for during the surveillance audit.
Page 178 of 544 pages