ISO 27001 & 22301 - Expert Advice Community



Create New Topic As guest or Sign in

HTML tags are not allowed

Assign topic to the user

  • Focus area on a surveillance visits

    Our company got ISO 27001 certified this year - and will go through surveillance visits next year.

    I wonder if there are any focus areas during a surveillance visit and if you could provide any guidance and support on what to focus on during the surveillance visit?

  • Is the ISO 27001 Documentation Toolkit for you?

    The toolkit may not be the best thing for me, I normally implement a BCMS alongside a SME carrying out an ISMS but I feel I need to know more about the 27001 processes especially as they are so complimentary!  I can see a time when I may be asked to look at both.  Both in consultancy and looking at jobs I feel I need to improve my knowledge of 27001!  

    Any advice would be helpful!

  • Information Security Risk Assessment and Risk Treatment

    1. What happens if all controls (Existing and additional control(based on Annex A) are implemented? Does it mean we entirely remove the risk from the register - yet based on the activities there are chances of the risk taking place?

    2. How often should an organization undertake risk assessment and risk treatment

    3. When should one calculate the residual risk? Should it determine the risk assessment process of the subsequent year?

    4. Is there any template that you can share for risk assessment and treatment, with criteria and like hood, etc.

  • Scope of legal and contractual requirements

    Hi, In this list
    for France and the European Union, there are mainly regulations regarding personal data protection. In my understanding, ISO27001 requires to list all the regulations that apply to the business of the company seeking the ISO certification, which would be much wider.
    For example, our company provides a billing software. I would have listed all french regulations related to billing and not only data protection. Is my interpretation of the norm too wide ?

  • Is Audit checklist a requirement?

    I have started reading your book and it looks great. Kindly help me with the following,

    I want to find out if Audit checklist  is a requirement or a  choice to the auditor whether to use a checklist or not.

    Also do you have any idea on how to effectively manage corrective actions.

    What is the difference between Nonconformity/Conformity and Noncompliance/Compliance.

    Please, your response is much appreciated.

  • How ISO 27001 differentiates and classifies between security functional and non-functional requirements?

    I am browsing through your website for the ISO 27001 controls and was wondering if you could explain to me how ISO 27001 differentiates and classsifies between security functional and non-functional requirements?

  • Annex A.14.2 controls

    I have a question that I cannot get a clear answer to.  I hope that you can help.

    My customer develops a software product for its customers.  They do not however carry out any software development for themselves.  All of the systems that they use in-house are commercial-off-the-shelf packages like Office365, Slack, PeopleHR, and Xero (all of which are SAAS applications).  They do not customise the code at all.

    We are trying to establish whether or not they need to apply the Annex A.14.2 controls as these are aimed at "developments within the organisation".

    Do you have any thoughts on this?

  • ISO 27017 and ISO 27018

    The ITU recommendation, do we need to prepare any separate documentation for these or are controls included in standard

  • Psychology within the scope of risk treatment and analysis

    Thanks for the update on the course. I have a project that is still in development and I was wondering if you had any information on the issue of psychology within the scope of risk treatment and analysis. If we're going to build the profile of a job that contains a risk at any level either within the task sequence or the individual assessment of the task, how do we determine the responsible strategy of analysis of the situation.

  • ISO 22301:2019

     For the purpose of writing a final thesis at the University of the North on the topic of business continuity with the application of the ISO 22301: 2019 certificate, could you briefly tell me the reasons in your experience why organizations do not decide to introduce this certificate?
    According to the published data of the International Certification Organization for 2019, there are only two valid certificates for the ISO 22301: 2012 standard in the Republic of Croatia.
    Thank you in advance and I hope you can answer me

Page 6 of 411 pages