Get a 20% discount on the first year of the Company Training Academy annual plan.
Limited-time offer – ends April 24, 2025
Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
How much of Partial scope is permitted?
In the context where the "Organisation" is a part of larger organisation, there are few clarifications needed: 1. e.g. a Data centre within an Engg. Organisation. A large no of PCs are connected to the Data Centre. The Data centre hosts all the servers and the applications for an ERP. The application is used by a large no of client PCs located within the same premises or outside on leased lines. (Private network) or may be even on the internet through HTTPS. Scenerio 1: Browser based access on the client PC Scenerio 2: Agent loaded on each PC. Then only you can access the application. Scemerio 3: The IT dept. is responsible for pushing the OS updates, application updates at the client end, Virus updates as well as monitors the various other softwares running on the PCs available in the company. (That is their role is not for DC only but maintenance of all the PCs in the company). Scenerio 4: The larger Engg. company has 3 diffrent deptts. One Which runs the DC; 2nd which provides the connectivity to various usesrs/ group of users within the same premises or acro ss various locations in the country and outside. The levels of such users outside the physical premises of the comany may vary from e.g. to a regional office (with say 50 users each) to a sales office (with say only one or few PCs). 2. While the IT dept. is responsible for the maintenance of complete IT infra. including the DC and the client workstations, they want scope to be restricted to DC only excluding the network (LAN/WAN support). Is it allowed. 3. While the scope is partial is is primarily restriced to IT services, The key decion makers and resource providers are outside the IT Deptt. e.g. CEO of the organisation, Fininancial Heard, HR Head, Security Head, Utilities Head etc. 4.Is it true that ISMS Scope and the Certification Scope may be diffrent that too when the organisaion is part of a larger company. In this case, the role of a certification auditor will be confined to see the ISMS within their scope of certification. Who will the external parties (Outside the scope of certification or outside the scope of ISMS as defined by the organsaion). -
Is the computerized machinery considered to be an asset
I work in a manufacturing and want to know if the machines manufacturing with computers, are considered assets of information and what do you think about your treatment. -
Assets dependence
Hello friends, A question: How to handle the assets dependence in your asset inventory? How to you handle this: "Asset valuation is a key factor in the impact assessment of an incident scenario, because the incident may affect more than one asset (e.g. dependent assets), or only a part of an asset." Thanks your for your help Best regards -
Using risks instead of threats
I think in 27001:2013 version we not using the word of threats,we are using risk instead of threats, kindly correct me if i m wrong, -
Security Compromised because of Cost to Company
My company uses Skype for communication, Dropbox to share large documents and some of the projects should have access to social networking sites, such as Facebook, Twitter, because their business demands. -
SoA
Hello friends, The Statement of Applicability (SoA) is applied only to the process of the scope of the ISMS?? or it's applied to whole organization?? Thanks you for your help Best regards -
must I finish the project that implements the controls selected for getting ISO
27001 certification?When I am in process of implementation of ISO27001 I will have to implement several controls that going of Risk Analysis. This controls are going to generate some projects that can extend in the time. If I want to get a ISO 27001 certificacion, then I must wait to finished the projects for getting the ISO 27001 certification? or isn´t necessary? Thanks you for your comments and feedback -
Information Security Objectives and management support
Hi friends, A question, where I can to include the management support and the Information security objectives?? In which document?? The management support could be understand explicity?? Thanks you for your attention Best regards -
Difference between Risk Treatment Plan and Risk Assessment Report
I understand the difference between the Risk Assessment and Treatment plan V the Risk Treatment Plan but what is the difference between the Risk Treatment Plan and Risk Assessment Report -
10.8.5 Business Information systems
I would like to know how to implement the control 10.8.5 Business Information Systems, is there any procedure that we should create, is it about the interconnection (data exchange) between systems? Many Thanks