ISO 27001 certification scope - include only HQ or also the branches?
If I want to get certify on ISO 27001 for my HQ, is it wise for my to put my branches in scope?
Preparing Statement of Applicability
When performing the SOA phase. Is there a minimum or maximum amount of controls to select? Do you have to select controls from every section of the 35 main security categories?
How much of Partial scope is permitted?
In the context where the "Organisation" is a part of larger organisation, there are few clarifications needed:
1. e.g. a Data centre within an Engg. Organisation. A large no of PCs are connected to the Data Centre. The Data centre hosts all the servers and the applications for an ERP. The application is used by a large no of client PCs located within the same premises or outside on leased lines. (Private network) or may be even on the internet through HTTPS.
Scenerio 1: Browser based access on the client PC
Scenerio 2: Agent loaded on each PC. Then only you can access the application.
Scemerio 3: The IT dept. is responsible for pushing the OS updates, application updates at the client end, Virus updates as well as monitors the various other softwares running on the PCs available in the company. (That is their role is not for DC only but maintenance of all the PCs in the company).
Scenerio 4: The larger Engg. company has 3 diffrent deptts. One Which runs the DC; 2nd which provides the connectivity to various usesrs/ group of users within the same premises or acro ss various locations in the country and outside. The levels of such users outside the physical premises of the comany may vary from e.g. to a regional office (with say 50 users each) to a sales office (with say only one or few PCs).
2. While the IT dept. is responsible for the maintenance of complete IT infra. including the DC and the client workstations, they want scope to be restricted to DC only excluding the network (LAN/WAN support). Is it allowed.
3. While the scope is partial is is primarily restriced to IT services, The key decion makers and resource providers are outside the IT Deptt. e.g. CEO of the organisation, Fininancial Heard, HR Head, Security Head, Utilities Head etc.
4.Is it true that ISMS Scope and the Certification Scope may be diffrent that too when the organisaion is part of a larger company. In this case, the role of a certification auditor will be confined to see the ISMS within their scope of certification. Who will the external parties (Outside the scope of certification or outside the scope of ISMS as defined by the organsaion).
Is the computerized machinery considered to be an asset
I work in a manufacturing and want to know if the machines manufacturing with computers, are considered assets of information and what do you think about your treatment.
A question: How to handle the assets dependence in your asset inventory? How to you handle this: "Asset valuation is a key factor in the impact assessment of an incident scenario, because the incident may affect more than one asset (e.g. dependent assets), or only a part of an asset."
Thanks your for your help
Using risks instead of threats
I think in 27001:2013 version we not using the word of threats,we are using risk instead of threats, kindly correct me if i m wrong,
Security Compromised because of Cost to Company
My company uses Skype for communication, Dropbox to share large documents and some of the projects should have access to social networking sites, such as Facebook, Twitter, because their business demands.
The Statement of Applicability (SoA) is applied only to the process of the scope of the ISMS?? or it's applied to whole organization??
Thanks you for your help
must I finish the project that implements the controls selected for getting ISO
27001 certification?When I am in process of implementation of ISO27001 I will have to implement several controls that going of Risk Analysis. This controls are going to generate some projects that can extend in the time.
If I want to get a ISO 27001 certificacion, then I must wait to finished the projects for getting the ISO 27001 certification? or isn´t necessary?
Thanks you for your comments and feedback
Information Security Objectives and management support
A question, where I can to include the management support and the Information security objectives?? In which document?? The management support could be understand explicity??
Thanks you for your attention