Get a 20% discount on the first year of the Company Training Academy annual plan.
Limited-time offer – ends April 24, 2025
Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
Confidentiality of Government Information
Our government requires its agencies to be transparent in providing information. One agency is adamant to implement ISMS because of this. How can they implement ISMS while remaining transparent? -
7.2 Competence
According to Clause 7.2 Competence - ISO 27001-13 a)determine the necessary competence of person(s) doing work under its control that affects its information security performance; d) retain appropriate documented information as evidence of competence. For example the competence of CISO would affect its IS performance so should it be recorded,what type of information should be documented Eagerly awaiting replys, Thanks, Itommy -
Advantages/Disadvantages of Asset Based Risk Assessment
Hi All, I find that many organizations have adopted an asset based risk assessment.I am concenred that many generic risks would be missed out. I would like to know your views on pros and cons of Asset based RA. Many Thanks, Itommy -
User profiles in Access Control Policy
With regard to the Access Control Policy, do you recommend developing the user profiles in 3.2 and 3.3? Or would it be sufficient to describe generally the sorts of positions that get access to certain sorts of accounts? -
ISO 17799/27001/27002?
What is a difference between ISO 17799/27001/27002? Pls do also throw a light on COBIT also. -
mandatory backup policy?
I have a question on the following forum post by you: -
Who can access the Business continuity plan?
I have one question regarding the BCP document itself: The level of classification and the people who can access to it are: -
Which comes first in risk assessment: threat or asset?
We are a small organization say 100 employees or even less. For risk assessment purpose, I chose the threat and then thought about which assets would get affected, and then the vulnerabilities were identified. However, in the toolkit you advise to select the asset then the threats and then map vulnerabilities. Is my approach correct or should i rework this activity. -
Regarding ISO 27001
Hi, Please provide your view on this I've invited External auditor for ISO 27001 for one of the client. As if now, the client Datacenter managed by them (Datacenter room is situated in same building where client is operating (workplace) but all other controls are managed by client only) Now client is planning to move their data center at different place provided third party datacenter provider. Now all controls related to physical security managed by third party and it is already ISO 27001 certified. My Queries: What is going to be the difference in case client move its datacenter after gets certified. How we can leverage that datacenter service provider ISO 27001 once client will move its datacenter. -
Security Policy Information
I would like to get your opinion regarding an issue on Security Policy Information . The A.5.1 control 27001 : 2005 provides that the Security Policy Information should be critically analyzed at planned intervals or when significant changes occur. In the case of significant changes were not identified during the review of the Policy, you understand that we can maintain the same policy and that there is no need to republish it ?