It says it's reasonable to have 500 risks at Enterprise level, we need to narrow down that list to a even shorter list
Asset register
I am progressing on with the asset register for the organisation however I am unsure what information I need to include with regards to our server information. We rent an office off the local authority which allows us to have a channel to connect with the internet via a IT company who are ISO 27001 certified. Our main infrastructure is hosted at Data Centre who are also ISO 27001 certified. Do I need to include all of this on my asset register or would this be covered in the Supplier section?
Cabling security
Is documenting and demonstrating the physical access controls that are in place mitigate not performing physical inspections or technical sweeps for unauthorized devices being attached to the cables?
Maturity models
There are evaluation ranges lSO 27001. Which it is the range of application of ISO 27001? What are the ranges of evaluation?
Previous and current ISO 27001 and the risk management
Does it make sense to create a concept according ti ISO 27001 and combine it with BSI? (especially in the risk assessment and the implementation)?
The CISO
ISO 27001 DEFINITION OF SECURITY ROLES AND RESPONSIBILITIES. CLAUSE A.7.1.2 AND A.13.2.4
Corrective actions
Is it necessary to mention the root cause analysis in the corrective actions of an internal audit? whether there is clause in the standard requiring companies to document their KPIs?
IT audits and CISO
Good day, does the IT auditor audits the work of the information security officer?
Threats and vulnerabilities list
Hi i have a question concerning the Threats and Vulnerabilities list, what you have is simply examples or they cover all the aspects?
The best way to perform the internal audit
Currently we are doing our IT audits via Excel and we plan to replace Excel-based audits (Excel-List with all of the ISO 27001 chapters) via SharePoint (we would like to map/move the excel content to SharePoint tables). I am the opinion, that this is not the best way of doing IT audits according to ISO 27001. So I would like to know if there are better solutions?