Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
Scope and Policy Definition
I'm a student and I have in my training ship a project about ISMS (information security management system). I found a problem to define my scope project and politic in the first Step PLAN I work with the best practice of ISO 27002 . If you have more information about can you help me please. -
Asset owner
I have a question about the ISO 27001 Risk Assessment: If all employees have a laptop, do they all have to be mentioned separately in the Risk Assessment Table? Or can I just put 'all employees' as asset owner? -
Risks related to ID cards
Could you please help me to know the risk if an employee forgets his/her Permanent ID card. -
Information security policies
Do you have an Information Security Policy that is not referencing ISMS and ISO 27001. We are not there yet and looking for something more generic for first time round -
Templates content
I would like to ask what is described in Documents? What should be done or also how it should be done? For example: Access Control Policy - is it proposed and described (technical way) how to implement the policy? Or Bring Your Own Device (BYOD) Policy - is it proposed what kind of technology to use? Disposal and Destruction Policy - how to implement? -
Audit Objective
I purchased the ISO 27001 Audit Toolkit and noticed that there is nothing about the Objective of the Audit in any of the documents. Please advice me where it is supposed to be added -
Cloud risks
We signed up for Conformio and are using the ISO 27001 Toolkit. We have defined the scope, listed the assets and are currently working through the threats and vulnerabilities. We have limited the scope to our main application that relies heavily on cloud services. My questions are as follows: -
Risk treatment
1 - Regarding the Risk Assessment Table, Can I use '3rd party' as a Risk Owner in some cases? -
Data classification and labelling
I was just wondering if you can explain to me how the ISO document “Data classification and labeling” is linked to gathering and recording information on security? I am an apprentice student and need this for one of my assignments. I have to explain how Data classification and labeling is related to gathering and recording information on security. Can you please help?