ISO 27001 & 22301 - Expert Advice Community

Home / ISO 27001 & 22301

Discussions

Top Contributors

Expert

Rhand Leal

4151
Discussions
Expert

Carlos Pereira da Cruz

1915
Discussions
Expert

Dejan Kosutic

365
Discussions

Most Popular Tags

Product: Conformio Product: ISO 27001 Documentation Toolkit Product: ISO 13485 & MDR Integrated Documentation Toolkit ISO 27001 Product: ISO 27001 & ISO 22301 Premium Documentation Toolkit ISO 9001 Risk Assessment Product: ISO 13485 Documentation Toolkit ISMS Internal Audit register of requirements Product: ISO 27001 & ISO 27017 & ISO 27018 Cloud Documentation Toolkit Product: ISO 27001/Risk Assessment Table ISO 9001:2015 ISO27001
Select
CREATE NEW TOPIC +
Guest

Guest

Create New Topic As guest or Sign in

HTML tags are not allowed

Select

Assign topic to the user

  • Valuating criteria through formula for BIA

    Hola, me gustaría saber lo siguiente: Si se explica la obtención de los valores de los diferentes criterios: Financiero, regulatorio, at. cliente, a través de una fórmula.

  • Creating risks list

    Oye tengo una gran duda con unos templates que compre con ustedes para Risk Assessment, en los videos no muestran como crear la lista de Riesgos. Solo indica que primero hay que identificar los Activos, a través de las amenazas y vulnerabilidades pero no veo ningún template que muestre el resultado final después de haber identificado los Riesgos, estoy confundido. Me puede ayudar?

    (Hey, I have a big question with some templates that I bought with you for Risk Assessment, in the videos they don't show how to create the list of Risks. It only indicates that the Assets must first be identified, through threats and vulnerabilities but I don't see any template that shows the final result after having identified the Risks, I am confused. Can you help me?)

  • Internal audit questions

    Buenos días, haré mis primeras consultas como parte de la compra del paquete de implementación de la ISO 271001, y mis consultas son las siguientes:

    En un informe de Auditoría Interna ISO 27001 es posible detallar las conformidades como Mayores y Menores o solo como No Conformidades? ya que si tomo la Directriz de la ISO 19001 no la sub divide como mayor y menor, simplemente como solo No Conformidad.

    Si bien es cierto un Informe de Auditoría Interna, detalla los Hallazgos (No conformidades) y observaciones, que pasaría sí en la organización auditada es todo CONFORMIDAD?, Es posible que en el Informe de Auditoría Interna mencione cuantas CONFORMIDADES encontré?

  • Template content about spam e-mail

    Form the IT Security Policy 3.14: Should a user receive a spam e-mail, he / she must inform [job title].) This may be something to think about for (specific) phishing mails, but is certainly not suitable for spam, here 98% of all email is spam and once in a while one gets through the filters.

  • Evidencing requirements

    I have the next question. A customer of ours participates in a government tender. He must therefore demonstrate that he meets a number of requirements of the ISO 27001 standard. In total it concerns 200 requirements.

  • Filling SoA

    I already used risk ID's inside the SoA template and wrote down „Risk #8, #10, #38“ for example. I did it like Dejan’s video tutorial said. But control A.12.6.1 includes (in my opinion) almost any risks out of the risk assessment table and I would like to write a general statement for „reason for selection / exclusion“ instead of writing each risk ID down. Is this possible? I did it for some other controls inside the SoA already too.

  • Scope definition

    Espero se encuentre muy bien, escribo ya que la empresa donde me encuentro laborando actualmente quiere certificarse en 27001, pero solo quiere certificar un "producto" el cual es la facturación electrónica, quería saber si esto es posible, ya que tengo confusión al momento de delimitar el alcance del SGSI y la política de seguridad de la información, ¿la política excluiría a los demás procesos y áreas de la compañía?, ¿y por tema de costos también sería menos beneficioso ya que incrementaría al momento de querer certificar los demás procesos de las compañía?

  • Filling SoA justification

    I have a question about control A.12.6.1 handling of technical vulnerabilities (inside the SoA table). In the column „reason for selection / exclusion“ I could basically enter almost any risk from the risk assessment table. Cause a lot of risks are based on technical things. I'm guessing that's not the way to go(?) For some other controls out of this table I have chosen general statements as the "reason for selection / exclusion“ without mentioning the concrete risks out of the risk assessment table. Would that make sense with control A 12.6.1, too?

  • Filling asset inventory

    You told me that listing the consequences inside the Asset Inventory comes out of the Risk Assessment Table and isn’t mandatory (but best practice). So far I totally got it and it makes more sense as the comment says before. But here is the thing: If I take the asset "top management" for example, I have for one asset different consequences inside the Risk Assessment Table, cause I have more than one vulnerability and threat. One asset with two different consequence-levels. The Asset Inventory consists of the asset „top management“ but needs just one consequence-level, right(?) Or shall I put both consequence-levels for one asset inside the Asset Inventory?
Page 220 of 544 pages