Start a new topic and get direct answers from the Expert Advice Community.
CREATE NEW TOPIC +Search results
11268 results
Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
Using existing Information security policy
Answer:
Sure, you can use your existing security policy, however you have to make sure that existing policy has all the mandatory elements that are prescribed by ISO 27001.
To learn about the mandatory elements of the policy, see this free ISO 27001 Foundations Course: https://advisera.com/training/iso-27001-foundations-course/ -
Duration of the ISO 20000 audit
Answer:
Duration of an ISO 20000 audit is agreed between the organization and the certificating company. It takes from e.g. one day (for small organizations) up to few days (in bigger companies). So, what you should do is pick-up a certifying company and agree with them length of certification audit.
Find out about certification in the article "Process to obtain ISO/IEC 20000 certification: Companies and individuals" https://advisera.com/20000academy/knowledgebase/iso-20000-certification-the-process-of-obtaining-a-certifica/
As for yourself, you can check your compliance to ISO 20000 using "ISO 20000 Gap Analysis Tool" https://advisera.com/20000academy/itil-iso-20000-tools/iso-20000-gap-analysis-tool/ -
Who should have an OS administrator password?
Answer:
The best practice, or the standard commonly used, is to use an unique user ID for each employee, because with this way employees are clearly linked with users, and is easy to follow their actions (for example reviewing logs). So, if you have an user that needs to have special privileges to configure an information system (or to access to special resources), this user is the unique person that should have the password of the administrator, because only this user should perform the changes.
By the way, you can define this through a Password Policy, so our template can be interesting for you (you can see a free version clicking on “Free demo” tab) “Password Policy” : https://advisera.com/27001academy/documentation/Password-Policy/
And our online course can be also interesting for you because we give more best practices about information security “ISO 27001:2013 Foundations Course” : https://advisera.com/training/iso-27001-foundations-course/ -
Arriving on an SOA
Please fill out this form to get live consultation: https://advisera.com/27001academy/consultation/
And here's the article which best describes what is the process of getting all the information important for the Statement of Applicability: ISO 27001 risk assessment & treatment – 6 basic steps https://advisera.com/27001academy/knowledgebase/iso-27001-risk-assessment-treatment-6-basic-steps/ -
SOA for two sites?
Answer:
From my point of view it is not necessary, I mean, you do not need to have 2 different SOA, but in your unique SOA you can add specific information about each site when a control is implemented in a different way in both sites (although I think that generally the implementation of controls will be equal or similar in both sites). So, you can add a column in your SOA document.
This article about the SOA can be interesting for you “The importance of Statement of Applicability for ISO 27001” : https://advisera.com/27001academy/knowledgebase/the-importance-of-statement-of-applicability-for-iso-27001/
And our online course can be also interesting for you because we give more information about the SOA “ISO 27001:2013 Foundations Course” : https://advisera.com/training/iso-27001-foundations-course/ -
Asset-based risk assessment
Answer:
From my point of view, the term “risk based risk assessment” is not correct, because you cannot based the risk assessment on a risk to calculate it (has no sense). On the other hand, the asset based risk assessment means that you use assets of your organization to determine and calculate risks.
Important, ISO 27001:2013 does not require an asset based risk assessment, or any other specific method, so you can perform the risk assessment for example with a process based, although our recommendation is the asset based methodology.
If you are interested to write an asset based methodology, this article can be interesting for you “How to write ISO 27001 risk assessment methodology” : https://advisera.com/27001academy/knowledgebase/write-iso-27001-risk-assessment-methodology/
And our on line course can be also interesting for you because we give more information about the asset based methodology “ISO 27001:2013 Foundations Course” : https://advisera.com/training/iso-27001-foundations-course/ -
Deadline in the List of legal, regulatory, contractual and other requirements
Answer:
In the column "Deadline" of "List of legal, regulatory, contractual and other requirements" you should fill in a deadline until which the compliance job needs to be finished - e.g. if you have a contractual obligation, you should set a date until all the information security obligations must be fulfilled - for example, a client of yours might ask you to implement a special type of authentication when working with them. -
Server hardening and ISO 27001
Answer:
ISO 27001 does not require 100% conformity with environment hardening, although you can perform the environment hardening as a best practice. On the other hand, the implementation of ISO 27001 is based on processes and procedures, which can include process to ensure server environment hardening, although this process is not mandatory in ISO 27001 (I mean, it is not mandatory to have specific process to ensure the server environment hardening, although can be a best practice). So, during the review of the implementation of the ISO 27001, all processes and procedures will be reviewed, including process to ensure server environment hardening, obviously if you have implemented it.
Finally, our online course can give you detailed information about the ISO 27001 “ISO 27001:2013 Foundations Course” : https://advisera.com/training/iso-27001-foundations-course/ -
Best practice to communicate
We didn't include the Communication Plan in the ISO 27001 toolkit because it is not a mandatory document, and more importantly we think this document would not be very convenient for smaller or mid-sized companies. The problem is - such central document would be very difficult to maintain, because every change in some policy or a procedure would require this plan to change as well.
Much better approach would be to use the elements from the article my colleague has referred to, and place them in particular documents - e.g. in the policy itself define who is in charge of communication, what has to be communicated and to whom. -
Who is accountable and responsible for applications and for the operating system
Answer:
ISO 27001 doesn't distinguish between persons accountable and person responsible for assets - the only thing that is required by the standard is to define the asset owners, who are responsible for those assets (control A.8.1.2).
In your case, there are different options possible:
a) That the same person or organizational unit is owner of the server and of all applications
b) That one person or organizational unit is owner of the server, and other person/unit is the owner of all applications
c) That one person/unit is responsible for the ser ver, and that each application has different owner
For each change process, it is crucial that one person approves the change (e.g. Head of IT department), and that the other person executes the change (e.g. the IT administrator). This is one of the reasons why it is much better to have persons as asset owners, not organizational units.