Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
Standards and Frameworks Integration
I am looking at integrating a bunch of standards and frameworks as one system; is this doable? specifically 20k; 22301; 27k; OHAS; COBIT 5; TOGAF, PMBOK, CMMI -
Residual risk
After conducting initial risk assessment and deciding on the pre-treatment scores, does a control have to be in place for a period of time before it can be measured in order to establish the post-treatment score and therefore the residual risk? Otherwise, what is the process for going from risk assessment to risk treatment in a single paperwork exercise? It seems quite arbitrary to look at a risk and score it pre and post treatment in the same risk assessment session; or is this the nature of -
Toolkit content - business continuity
en cual documento del paquete ISO 27001 puedo localizar los lineamientos de seguridad de la información en la continuidad de negocio? (ISO 27002:2013 Chapter 17) -
Scope definition
We are an IT delivery organization, consisting of several business units (most are projectbased, a few are delivering outsourcing services). These business units are legally private companies (in Dutch: B.V.) -
Residual Risk
After conducting initial risk assessment and deciding on the pre-treatment scores, does a control have to be in place for a period of time before it can be measured in order to establish the post-treatment score and therefore the residual risk? Otherwise, what is the process for going from risk assessment to risk treatment in a single paperwork exercise? It seems quite arbitrary to look at a risk and score it pre and post treatment in the same risk assessment session; or is this the nature of -
Acceptable Risk Document
What can be the contents of an acceptable risk document (ARD) in ISO27001? I am talking about a typical IT Organisation required to be maintained by information security team . -
Incident Response Plan and Recovery Plan
I have one question only in the Incident response plan (IRP) template. Our approach is BCP per department and one coordinator each. My understanding in the IRP is a separate plan to be activated during emergency or incident like if your critical department activities are threatened by one of your identified threats. This IRP also is different from Recovery Plan as this will be activated during the actual disruption or disaster. Is my understanding correct? -
ISO 27001 and Data privacy protection regulations
ISO 27001 and DSGV - Data privacy protection regulations - in Germany and EUROPE - checklist -
ISO 27001 software
Is there a software that automates ISO 27001? -
Information Security Risk Metrics
What will be the Information Security Risk Metrics or KRI (key risk indicators )?