Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
Risk assessment and information security audit
1. How does information security audit relate to information security risk assessment? -
Risk assessment
With regards to Risk Management I need your advice. In my organization we are planning to start IT risk Assessment process. I want to make sure we start right. There are many approaches and templates for this. How do I choose which one is the best and also which in-house training will start from basic risk assessment? -
Inventory of assets table
In the Inventory of assets table there is a column with heading “Impact”. The instruction at the top of the table states that one should copy the score from the Risk Assessment table. However, each item from the Inventory of Assets table may have several risks attached to it in the Risk Assessment table. Moreover if one uses the suggested scores by Advisera (0, 1, 2) for both Consequence and Likelyhood, most assets can have several scores between 0 and 4. What am I to do with the Impact column and what is the significance of this column? In other words what does it add to the entire system? If I should copy all scores then I need to copy all risk descriptions as well. This seems like a lot of unnecessary work. Can you please advise? -
NIST and ISO
In your opinion, does NIST standards supersedes aspects of ISO? Some of the NIST standards are quite granular and popular when considering security best practices. -
Security tools
There was a cyber attack on all Pakistani banks. U fortunately the banks are poorly managed The central bank is a poor regulator. Can you suggest the best cyber security software. What steps can one take to protect ones account? -
Competences management and improvement
What is best manner to update my skills in Risk Management & I T compliance & security certifications? -
Responsibility of the CEO for management review minutes
The ISMS Policy talks in section 4.4 Responsibilities (mark 3) about the responsibilities of the ceo (the ceo must have the ISMS reviewed at least once a year and has to create a protocol). Is the protocol the document for the management review? -
Risk assessment
I have a couple of questions about the Risk assessment: -
Toolkit content
1. I have gone through the toolkit and couldn’t see some of the mandatory documents under Annex A, for example, A.6 Organization of information security I didn’t find all the mandatory document. -
Background check
1. Is it mandatory to do background check for all the employees?