ISO 27001 & 22301 - Expert Advice Community

Vendor risk management career

Audit planning

Hi, I am an IT Audit Manager at XXXX and XXXX maintains 3 different ISO 27001 certifications on different continents. There are only 2 of us working on ISO internal auditing and we are finding that testing all of the controls for 3 programs is no longer feasible, even if we divide them up over 3 years. Is it actually required that every control is tested by internal audit every 3 years? Or is there an easier way? How do other companies do this? Any help you can give would be appreciated.

Filling template

1. Hello, in which document is my question: "Method for identifying requirements“ (chapter "02" of the toolkit). Where inside the document is my question: "5. Management of records for this document“ Column 4: Measure to protect the recording. The record will be the "list of requirements“. The defined measure to protect the recording doesn’t make sense to me (the German version): "Nurfalls [Stellenbezeichnung] zur Bearbeitung von Daten berechtigt ist“. Can you please explain that to me?
2. My question is inside chapter 4 of the method for identifying requirements. How does the annual assessment of the ISMS compliance with the requirements take place? What proof is required for this?

Third-party risk assessment questionnaire

Can you pls share the link of third party risk assessment questionnaire?

Lead Auditor and implementer consultant

Can someone be lead Auditor and implementer consultant at the same time?

Certifying ISO 270001 & 9001

When certifying ISMS according to ISO 27001, what additional documentation do I need for ISO 9001 certification of QMS?

Risk assessment and treatment and business continuity plan

1 - What is the best approach to assess risks where the treatment option would be to set up a business continuity plan?

If a company has a risk register with two risks at the same level, for example, fire and flood. These risks both score the lowest likelihood and highest impact. Typically for IT companies, the likelihood matrix used for assessing risks have low scales, ie the lowest is 10 years+ compared to 100 years+. This is because technology changes rapidly so it is not beneficial to used scales with to high time span. By using these low scales a lot of environmental risks assessed will fall under the same likelihood even though fire will be more likely than a flood. So how can we justify where we want treatment option to be to document a business continuity plan where we see that we only want to create one for fire but not for flood even though they have the same risk level?

Please note that these are only examples. We just need support on how we should go about justifying assessed risk where we see the treatment option is to create a business continuity plan.

 2 - And is there a good way to define what will go from risk register to business continuity plans based on impact and likelihood scales? Or will this always be an extra round of assessing from the risk register what needs to go to continuity plans?

Filling template List of Legal, Regulatory, Contractual and Other Requirements

We acquired the ISO 22301 Documentation Toolkit some time ago and just started to implement the ISMS for our company. I was delegated the project manager role for this project and as this kind of project is completely new to me, I’m not sure whether I understand everything correctly. Right now we are at the stage of identifying the requirements and expectations of interested parties and I expect that people I’m about to interview will have trouble formulating their needs. I anticipate them going into much technical details about defining SLA, RTO, and RPO for their related Information Systems which, as I understand, must be done later. However, I’m not sure what can be mentioned as requirements and how to help interested parties formulate their requirements. Could you please share some experience, maybe in a form of real-life examples, for filling up the “List of Legal, Regulatory, Contractual and Other Requirements”, with the focus on internal Information Resource owners’ requirements?

Templates content

I’ve looked over the policy and found most of the topics I was looking for. However, I can’t see where the topics below would be covered—can you clarify?

Document retention
Individual user agreement (employee agreement/ responsibilities, often attached to hiring documents)
Reporting InfoSec Weaknesses and Events
Responding to InfoSec Reports
Rules for Use of E-mail

Applicability of training for suppliers' employees

Is it absolutely necessary to train selected employees of our suppliers (Chapter 3.4 Training and Awareness) if the risk out of the risk assessment table is very low? Is it in that case described before possible to delete control A.7.2.2 from the security policy for suppliers?