Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
Assessment of processes
Hello, I am actually assessing some processes in our ISMS, Can you please help me with some questions to ask or some Threats/vulnerabilities comprimising the availability, confidentiality and integrity of a process? Many Thanks -
Information security incident managment Categories
Hello, There are several categories of Information Security incidents management related to IT, e.g. : -Denial of service attack - Illegal use of software - Malicious code - Spam - ...etc I'd be grateful if you can list me some of IS incident categories other than IT security incidents, for example: - Physical interference in secure areas - Loss/Theft of laptop ... Thanks in advance -
Secure system engineering principles
clause A.14.2.5)Dear Dejan, could you please tell me what document or action should I prepare for the Secure system engineering principles (clause A.14.2.5) ? Thanks in advance Gökhan -
connection between BCP and security
Dear Mr. Kouti?, our CISO and Organisational Officer both see the close connection between BCP and information security in 27001 Standard. The question is whether to put CISO and BCP together in our organisation (perhaps in Compliance) or not. Do you see the connection between them in 27001 Standard and where (how to argue that) ? I work in a financial institution (bank). Thank you in advance and best regards! -
Statement of Applicability & auditor's comments on effectiveness of controls
I have just watched the tutorial video on "How to Write ISO 27001 Statement of Applicability" and noticed that there wasn't a column for the certification bodies' opinion on the effectiveness of the applicable controls. According to the tutorial video this is not a mandatory field. Where then does the certification body document their opinion on effectiveness of each of the controls? Secondly, can the certification body issue certification if there are any weaknesses in how way some controls are implemented or must they all be 100% effective. Regards. CM -
How does IT complete a BIA
In a banking environment, the IT Dept.'s major role is to provide support to the network and their RTOs are for the most parts driven by those of the branches and units they support. In light of this, what is the best approach for an IT Dept in completing a BIA questionnaire? Where should their head space be when completing this questionnaire? -
Certification - RABQSA
I have completed my certification which is RABQSA/NABET certified ( India). I tried registering in RABQSA and also NABET but i am not able to. Can i register myself in other certification bodies. If yes, Can you tell me the procedure. Also, What is the next step which I need to do. Please advice. Thanks, Vijay -
Transition from ISO 27001:2005 to 27001:2013 standard
I wanted to know about the transition from ISO 27001:2005 to 27001:2013 standard. If some company is 27001:2005 certified and their certification is expiring in 2014, then in that case on which version they need to get audited and certified? In how much time, in between, any company can do transition from ISO 27001:2005 to the new one? -
When does RTO begin?
Does RTO begin at time of incident or after assessment of the impact of an incident? To be ISO 22301 certified, will the organizations definition of the starting point for RTO have to match the ISOs definition of RTO. The published ISO definition merely states following an incident and it is not clear of the specific start time of RTO. -
Mandatory processes for ISO 27001:2013 external communications relevant to ISMS
1. Please see clause 7.4e: ....the internal shall include "the processes by which communication shall be effected"..... Does it mean the standard is mandating a 'Communications process'? 2. Apart from the above, I think the standard mandates only Risk Assessment and Risk Treatment processes/ plans. All other mandated docs are implementation level evidences. Am I right?