Get a 20% discount on the first year of the Company Training Academy annual plan.
Limited-time offer – ends April 24, 2025
Use promo code:
CTA20

ISO 27001 & 22301 - Expert Advice Community

Home / ISO 27001 & 22301

Discussions

Top Contributors

Expert

Rhand Leal

4151
Discussions
Expert

Carlos Pereira da Cruz

1915
Discussions
Expert

Dejan Kosutic

365
Discussions

Most Popular Tags

Product: Conformio Product: ISO 27001 Documentation Toolkit Product: ISO 13485 & MDR Integrated Documentation Toolkit ISO 27001 Product: ISO 27001 & ISO 22301 Premium Documentation Toolkit ISO 9001 Risk Assessment Product: ISO 13485 Documentation Toolkit ISMS Internal Audit register of requirements Product: ISO 27001 & ISO 27017 & ISO 27018 Cloud Documentation Toolkit Product: ISO 27001/Risk Assessment Table ISO 9001:2015 ISO27001
Select
CREATE NEW TOPIC +
Guest

Guest

Create New Topic As guest or Sign in

HTML tags are not allowed

Select

Assign topic to the user

  • ISO 27001 Scope Document

    1- Do we need to show network documentation of all offices in the ISMS scope, or can we put reference links to the documentation?

    2 - Do we need to include network diagrams of each office in the ISMS scope document?

    3 - Do we need to include the XYZ1 office in the scope as the whole outsourcing department works from XYZ2, and it's only the senior managers like the CEO and Founder who work from XYZ1 including the IT security administrator?

    4 - Will the ISMS scope focus on the outsourcing department's IT infrastructure be enough, or do we need to implement the ISMS scope to cover the *** IT operations infrastructure across the business?

  • SOA Control Objectives

    I am reviewing the “Statement of Applicability” document within the 27001 2022 toolkit and noticed that under the SOA table in para. 3. Applicability of controls there isn’t any control objectives.

    Can you confirm that the controls listed in the 27002-2022 are the same controls used in the 27001 2022.

  • Add Further Reference Documents

    Hi firstly, thank you for creating a great product. We have a few further reference documents that we would like to include as part of the ISMS. These are related to our regulatory requirements, we should include the Australian Governments Information Security Manual (ISM) and Right Fit for Risk (RFFR). Can I please confirm the best way to add these two key documents?

  • ISO 27001 - Question nonconformities

    We have a question about non-conformities.

    We are now awaiting the results from our internal audit, and wonder what of their findings that should count as non-conformities (if any)? Is it only those with risk level "high" or "Critical" that should count as non-conformities, and the other ones as regular risks? Or how do we know how to classify the findings?

  • Supplier Security Policy

    I am currently reading over the Supplier Security Policy and wanted to check something. Under the "Monitoring and review" section, it mentions auditing the supplier or auditor once a year. What exactly is meant by this? And is it required?

  • Internal Audit Questions

    1. On the first management review meeting should we discuss about the Internal Audit  

    2. Should the project manager gather all pieces of information during the project implementation

  • ISO security framework or standard for IoT

    Curious if there's any ISO security framework or standard for IoT like CSA? Thanks

  • A.18.1.1 Identification of applicable legislation and contractual requirements

    A.18.1.1 is good to go (just reference the policy and note that due to sensitivity and attorney client privildge, the policy was retained)

     

    To satisfy the control, is it enough for an organization to just state that they identify & manage the relevant legislative statutory, regulatory, contractual requirements in their information security policy document? I am trying to understand if other evidence like a separate defined list of laws or at least an email from their legal department is absolutely necessary to fulfill it. For context, what if the organization has stated that "due to sensitivity and attorney client privildge" they would not share anything more than that first statement to reference? Thank you.

  • Risk Assessment Question

    Going back through the risk assessment, I had a question! When including the risks, are we supposed to come at it with professional skepticism? For example, we have a system administrator who is a great employee. We would never expect them to do anything malicious. BUT, when looking at the possible threat of "falsification of records", should I still list it as a threat? Even if it is very unlikely, it is something that someone in their position is capable of doing.

  • Requirements for MSP Company Regarding Supplier Security Policy

    What requirements are there for an "MSP* - managed service provider" type of a company regarding Supplier Security Policy and Security Clauses for Suppliers and Partners? I am curious about the data exchange, as the only data exchanged was in the data servers and we are not sure if there is anything necessary for us to do in that regard.

    * managed service provider (MSP) is a third-party company that remotely manages a customer's information technology (IT) infrastructure and end-user systems.
Page 39 of 544 pages