ISO 27001 & 22301 - Expert Advice Community

ISO 27001 Implementation Committee

I was hoping to ask you which parts of an organization would sit on the ISO 27001 Implementation Committee for a company?
HR/ Legal / IT representatives / Security personnel for example

Justification in the SoA

1. Some of the Annex A clauses are worded as if they are mandatory; for example, 5.1.1: "A set of policies for information security shall be defined [...]". Is it acceptable to justify selection on the basis that this is a mandatory element of 27001?
2. We have multiple risks associated with the same vulnerability (as expected); for example, the vulnerability “inadequate protection from unauthorized access” occurs many times. Is it acceptable to justify on the basis of 'All risks associated with “inadequate protection from unauthorized access”' rather than itemize each risk?"

Recommended file/folder structure

Management review

I have a question about the Management evaluation protocol.
My question is about documents that need to be checked during the meeting.
"Documents or descriptions of monitoring results and analysis of evaluation measures“. Can you please explain that fact to me? I don’t understand that.

ISO 27000 definition

It has been a long time.  I have been reading one of the articles from Rhand Leal and it is causing me concern.  Advisera is a good source but when your recommendations run counter to my advice to my customers I need try and fix that.

I know everyone has a different take on what security incidents and events are.  Rhand Leal’s article is very difficult to reconcile with my recommendations.

My definitions:

Security Events are events: Things that are logged by tools like Event Monitor on Windows:

Successful logins are events just like unsuccessful logins are, access to files are events, locking and unlocking a screen is an event.  In the analog-world leaving a laptop unattended would also be an event

When Rhand says that, an event has to be related to the possible failure of controls or “compromise of policies” is like saying that an incident is just a lot of events, or that all events are really junior incidents. I think that is really incorrect.  Events are the data upon which you can determine if controls are effective or not but events by themselves have no positive or negative connotations.  A door being opened with a LEGIC Card is an event, If the person with the card is not authorized then it is an incident.

A security incident I agree can be an event or group of events that indicate a compromise of business operations (Confidentiality, Availability, Integrity).  Example would be a door being opened with a valid key by an unauthorized person.

For me, non-compliance is something, which is not in accordance with a standard or policy.  Sometimes a non-compliance can actually identify an obsolete standard. Just an example would be the conflict between Password policies and the newest recommendations from NIST, (e.g. changing passwords every 90 days is no longer recommended procedure).

For me, the preferable category is “weakness”.  Usually, if not always, a valid non-compliance will identify a weakness.  A weakness being the state of affairs that promotes an incident. Examples of weaknesses would be missing patches. Another example would be insufficient Awareness trainings.  Basically, a weakness could be the lack of any relevant security control.

So with that could you (or Rhand) try and convince me that I am wrong or get Rhand to change or delete his post.

Thanks in advance.

iso27001 LI course with the workshop / which certificate do you provide?

I am interested in the iso27001 LI course with the workshop on the 22nd of November. However, I can only take this course if you are an accredited CB as I need the certificate to be issued from an LI course provided by an accredited CB.

Are you an accredited CB. Or do I get any certificate for this course provided by an accredited CB?

Does your course match my needs to get the right certificate?

Audit evidence

We recently went through our external audits and one of the findings that the auditor is looking for is the interface or integration of ISO 20000-1: 2018 and ISO 27001. This is not a requirement of the standard but this is something he is asking for,
Can you help us with the same?

ISO27001 - Who should sign off on a risk?

What is the best practice, Is there any recommendation as, Who is resposible to sign-off on a risk? 

Is it CIO, CISO, Board of Directors or someone else?

Template contents

I had noted that the toolkit covered the elements below but what about 18.1.2a&b, 18.1.3, 18.1.4&a&b, 18.2.1 and 18.2.2?

Cyber-security Career

I am a Software professional having around 16+ years of IT experience, worked as Developer, Support Lead, ERP Technical Manager and Delivery Manager, etc.,
For the last couple of years, I wanted to venture into the Cybersecurity domain and start my career in the Cybersecurity space.
Could you please advise me on how to and where to start my path into this interesting zone?