SPRING DISCOUNT
Get 30% off on toolkits, course exams, and Conformio yearly plans.
Limited-time offer – ends April 25, 2024
Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
Statement of compliance
My previous employer, whom I still support because they are a subsidiary of my current employer (xxxx), has asked me to help them to find and use or to draft an Executive Attestation Statement that they can provide to one of their major clients that will suffice for now to indicate that the company’s (xxxx) IT security policies and standards comply with ISO-27000 standards. They have not had a recent independent audit (such as an xxxx) or an ISO-27000 audit certification. The last xxxx audit they had was done in 2013. -
Risk assessment flowchart
I received your free sample of a RA flow chart showing how to risk assess a laptop. Do you sell other assets flow charted out like the laptop example? If so, what other assets are modelled? -
IT audit
1. How can we carry out the IT Audit of a company? -
Datacenter audit
I am subscribed on your learning platform and would like to know if there are links or referral documents for things to look out for when Auditing or reviewing the appropriateness of a data center. -
Risk assessment questionnaire
Is there a questionnaire that i would give to each asset owner to answer, and with i would be able to know all the necessary info to do a proper risk assessment ? is that plausible? Because if i did an interview i would ask the owner to explain his business process and look at all the aspects where an attacker could attack, but if it was an excel sheet or an email questionnaire ? can that be done? Do you have any questionnaire examples? -
Scope definition
In your blog describing problems with defining the scope in ISO 27001, there is a discussion about problems related to narrowing the scope to part of the organization, as opposed to the whole organization. It is not clear to me whether there would be problems in the situation where the whole organization is included, but only a specific type of information (e.g. only health information) is included in the scope. Do you predict problems with narrowing the scope based on the type of information? -
Example of assets
I need assistance on likely information security assets in a manufacture company. -
Segregation of responsibilities
Could you please explain this: to separate the operational responsibility for networks from the responsibility for sensitive applications and other systems -
Risk treatment options
What about reducing and sharing the risks?¸ -
Risk assessment and PIA for EU GDPR
What about PIA for the EUGDPR - will the risk assessments for ISO be useful for this?