ISO 27001 & 22301 - Expert Advice Community

Objective for certification the university

5 clear objective for certification the university would like to achieve according to iso22301 that is the questions

Annex A

1. ISO 27001 Annexe - I have a question regarding A 14 System acquisition, development, and maintenance. We are a software development company. Does this part apply to software we develop (as a business) or only for internal soft we could develop I mean for internal use?

2. ISO 27001 A 15 - May I apply this measure to the Critical IT supplier Only? Or should I apply to all suppliers?

3. In annex A can we justify that we do not choose a measure by saying "company capacity is to light" or things like that?

Fast-track information risk assessments

Hi,

I have very limited time to conduct risk assessments - usually no more than an hour at most.  I think it is important to hold a face-to-face consultation to capture the initial info then follow-up by e-mail for further details to cover the inevitable gaps.

How can I make the best use of the F2F time I have - what are the right questions to be asking when using a basic asset-threat-vulnerability methodology? 

I appreciate this will be subjective and depends on lots of other factors - I'm just looking for a general approach at this point.

Thanks,

Brian.

ISO 22301 Communication Plan

We have sourced the ISO 22301 documents from Advisera. Our Corporate Communications team is asking me to create a "Communications Plan and Crisis Management" Document as part of our BCP update. I don't really see any type of template for a communication plan. Is there one in the ISO 22301 suite of documents? Thank you.

Question about PII data

What about PII Data? It´s necessary to get a Policy or just to make a refence to the laws

Annex A

1. I love your videos. I want to be clear on something. How do the clauses and the Annex A controls work together for ISO 27001?

2. Please does the workshop explain and takes a person through the implementation process.

Cryptography Controls

Can you explain the implementation of cryptography control?

1. Which areas we need to implement in an organization.

2. Example of encryption and decryption policies.

Leadership requirements

Ya hice la fase de diagnóstico, en la parte de implementación hice macromejoras para abarcar los puntos que no cumple la institución, en una macromejora tengo la parte de liderazgo, que puedo desarrollar para cumplir los asquectos de liderazgo? Tomando en cuenta que el proceso es de lotería impresa.

ISO High-Level Structure for standards