Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
ISO 27002 clarification
I was recently informed that ISO27002:2013 has "2 Management Standards" within it === Is this true or False. If yes can you kindly confirm what they might be and how the standard is split as i have tried to do some research but CANNOT find anything pertaining to that fact. -
BS 31000
Do you have a copy of the BS 31000 standard, what is it all about / what does it covers and why should information security care about it. -
Interested Parties and Their Requirements
I have a few questions, it is about interested parties. I am in the process of gathering requirements of interested parties. -
Do we need to place camera for server room?
Do we need to place Camera for "server room"?Please suggest regarding this? And what are the things not keep in server room? -
Not implementing 8.2
Classification of Information)Is it possible to accept the risk that comes with not implementing 8.2 and still certify for ISO 27001? Background info: 'Shared Service' organisation that offers IT/Human Resources/ Facility Management to other organisations. There are no legal/contractual obligations known for labeling/classifying info. -
Business continuity certifications for individuals
I have a query regarding different certifications for individuals. I heard about various certifications such as CBCI (from BCI), CBCP (from DRII) and ISO 23301 Lead Implementer or Lead Auditor so which certification has more importance and what is the importance of going for them. -
Treating server as a single asset or viewing it separately for hardware and soft
If you identified an asset for example, an application on a server... Do you have to separate two assets or to treat as an single asset? -
Assessing consequences in risk assessment
Regarding consequences assessment - would you recommend assessing one value or split this factor basing on information security aspects or business consequences category? As I see reviewing some examples available on the Internet, sometimes people assess conseqences of loosing confidentiality, integrity or availability separately. The others assess separately financial conseqences, law and regulatory consequences, reputation consequences and so on. -
ISO 27001 risk methodology and corporate guidelines according to ISO 31000
If you have already a risk assessment methodology as per ISO 27001, and another one for OHSAS18001, and you been requested to implement the ISO 31000 guidelines , is it needed to review the existing risk assessment methodologies and replace it with one corporate one as per ISO 31000? Or we can simply refer in our ISO 31000 manual to the other methodologies? -
Context of the organization in ISO 27001
What does it mean: context of the organization? The auditor want to see the context of the organization chapter in the isms. Can you help me, what to write in it?