ISO 27001 & 22301 - Expert Advice Community

Home / ISO 27001 & 22301

Discussions

Top Contributors

Expert

Rhand Leal

4151
Discussions
Expert

Carlos Pereira da Cruz

1915
Discussions
Expert

Dejan Kosutic

365
Discussions

Most Popular Tags

Product: Conformio Product: ISO 27001 Documentation Toolkit Product: ISO 13485 & MDR Integrated Documentation Toolkit ISO 27001 Product: ISO 27001 & ISO 22301 Premium Documentation Toolkit Risk Assessment ISO 9001 Product: ISO 13485 Documentation Toolkit ISMS Internal Audit register of requirements Product: ISO 27001/Risk Assessment Table Product: ISO 27001 & ISO 27017 & ISO 27018 Cloud Documentation Toolkit Product: ISO 27001 Internal Auditor Course Product: EU GDPR Documentation Toolkit
Select
CREATE NEW TOPIC +
Guest

Guest

Create New Topic As guest or Sign in

HTML tags are not allowed

Select

Assign topic to the user

  • The Statement of Acceptance of ISMS System Documents

    The Statement of Acceptance of ISMS System Documents. Can you please supply a consolidated list of policies the auditor requires each employee to sign for?

  • Templates identification

    I recently purchased the ISO 27001 Toolkit. I see on your website (which is great, BTW) the Acceptable Use Policy for purchase and it appears to be identical to the IT Security Policy that ships in the Toolkit. Is one name preferred over the other? Our customers tend to ask for our Acceptable Use Policy, so I’m inclined to call it that. Would there be any reason not to?

  • Audit scope

    My ISO 27k certification auditor is asking to audit one critical service provider (internal service in the company), this will be part of the surveillance audit . Is he authorized to do so?

  • ISO 27001 Roles and responsibilities

    I couldn't find any document regarding "roles and responsibilities", however according to one of your articles (https://advisera.com/27001academy/blog/2016/06/20/how-to-document-roles-and-responsibilities-according-to-iso-27001/) it should be documented through the Risk Treatment Plan. If I take a look at the Risk Treatment Plan, I just see one big table where you have to document all the risks.

  • BYOD and ISO 27001

    I do have a question on BYOD – what is required by the ISO 27001 standard? And is there any guidance you can provide?

  • Roles and responsibilities

    I have been going through the documentation. Under A6. Organization of Information Security there is no template for ISMS roles and responsibilities but just the BYOD policy and Mobile device and teleworking policy. Would you share a template for Roles and Responsibilities if you have any?

  • Physical security

    1. I would like to clarify one thing please. In terms of physical security/access control. Would the departments who are in scope need to be physically isolated from the other departments who are out of scope?

  • Performing audits

    1. How are the audits conducted?

  • Inventory of assets

    I have a question about inventory of assets. The communication tool in our company is Slack. Should it be added in inventory list? The same question is for CRM. We are using Zoho CRM. Should we add it in our inventory list?

  • Defining scope

    I am trying to scope out my ISMS. We have around 370 employees. 50 of them are remote workers. The business is an insurance brokers and the sales team rely on three brooking platforms to operate. I am unsure whether to include everything and the kind of business functions to include in the scope boundaries.
Page 260 of 544 pages