Search results

Home / Search

Category:
Select
Select

11269 results

Guest

Guest

Create New Topic As guest or Sign in

HTML tags are not allowed

Select

Assign topic to the user

  • Number of policies and procedures required by Annex A

    ISO 27001 does not prescribe the number of policies or procedures to be written, so you can choose the approach that best fits your needs.

    From the new set of ISO 27001 Annex A controls, only controls A.5.10 (Acceptable use of information and other associated assets), A.5.26 (Response to information security incidents), and A.5.31 (Legal, statutory, regulatory and contractual requirements), requires documentation (but does not specify they need to be separated documents).

    The main criteria to decide the number of documents to be written are their content (i.e., if each one covers similar purposes) and if by writing them this way they would not become documents too big to understand or read.

    So, in this case, if a single document covering several controls becomes too big to use and manage, you should consider writing separate documents.

    These articles will provide you a further explanation about developing policies:
    - One Information Security Policy, or several policies? https://advisera.com/27001academy/blog/2013/06/18/one-information-security-policy-or-several-policies/
    - 8 criteria to decide which ISO 27001 policies and procedures to write https://advisera.com/27001academy/blog/2014/07/28/8-criteria-to-decide-which-iso-27001-policies-and-procedures-to-write/
    - How to structure the documents for ISO 27001 Annex A controls https://advisera.com/27001academy/blog/2014/11/03/how-to-structure-the-documents-for-iso-27001-annex-a-controls/

    Our ISO 27001 Documentation Toolkit has 45 documents that cover the mandatory documents, and the most commonly used ones, providing an optimized quantity of documents for small and mid-sized organizations. You can see a demo of them at this link: https://advisera.com/27001academy/iso-27001-documentation-toolkit/

    Regarding ISO 27002, please note that while it is not mandatory for the implementation of ISO 27001, it provides guidance and recommendation about how to implement controls from Annex A (ISO 27001 Annex A only provides the requirements of the controls, not how to implement them).  

    For further information, see:
    - 11 most important facts about changes in ISO 27001/ISO 27002 https://advisera.com/27001academy/blog/2022/02/09/iso-27001-iso-27002/

  • Question about Conformio project results

    1 - Why are the mandatory documents reflected here https://advisera.com/27001academy/knowledgebase/list-of-mandatory-documents-required-by-iso-27001-2013-revision not mentioned in Conformio project results?

    Answer: I’m assuming you are referring to the Project Plan document.

    Considering that, please note that in the project results section (3.2) we have two paragraphs:

    “During the ISMS implementation project, the following documents (some of which contain appendices that are not expressly stated here) will be delivered:”

    In this paragraph, the mentioned “…appendices that are not expressly stated…” refer to some of the mandatory documents. For example, the Internal audit program is an appendix of the Procedure for Internal Audit.

    “Policies and procedures that describe specific security activities will be determined only after the Statement of Applicability is completed. Detailed timing for those security policies and procedures will be determined in the Risk Treatment Plan.”

    This paragraph covers the remaining mandatory documents that are not explicitly mentioned. Some documents are only mandatory if related controls are applicable, and this information you can have only during project execution. So, until you have this information you cannot state some documents explicitly as project results.  

     

    2 - If Conformio project results are not mandatory, why do we need it?

    Answer: Project plan document is used to help you evaluate project progress, since they provide a measurable way to check performed activities.

    For example, if you have 17 steps in your project, and you already have delivered 7 of them, you can roughly evaluate that 40% of the project has been completed.

  • Rule 19 nanoparticle antibacterial coatings

    All medical devices which have nanoparticles are classified according to rule 19. If you are a manufacturer of nanocoating material that some other manufacturers put on the endotracheal tube, in that case, you do not have a medical device. Nanoparticle coating is not a medical device alone. 

  • Standard Contractual Clauses template

    How can I acquire the UK Employee Clauses (Standard Contractual Clauses) template?   I purchased the GDPR & ISO combination Toolkit from Advisera a few years ago;  is this template available as an add on to the Toolkit or as a  Separate Purchase from Advisera?  I serve as a DPO (Data Protection Officer) as our HR department wants to add this to the employee handbook for our UK employees

  • GDPR - Collection of marketing consent from consumers

    As you are a data controller, according to Article 4 GDPR – Definitions – you determine the purpose and means of the processing of personal data. I am supposing that you use consent as a legal ground or processing personal data in order to send marketing messages to the customers who accepted this. Article 4 GDPR – Definitions and Article 7 GDPR - Conditions for consent – request the consent to be “freely given, specific, informed and unambiguous” and presented “in an intelligible and easily accessible form, using clear and plain language”. That being said, you can choose what communication channels you offer to your customers – whether online or postal. So you can remove the postal option, just make sure that you collect the consent properly and you process the data respecting all GDPR requirements.

     

    Please also visit these links for more details:

  • Annex A

    Please note that according to ISO 27001, security controls can be demanded to treat relevant risks, fulfill legal requirements (e.g., laws, regulations, contracts, etc.), or by management decisions.

    Considering that, you need to verify the results of risk assessment, applicable legal requirements, and your management objectives and strategies to decide which controls are applicable / not applicable.

    For example, control A.14.2.9 System acceptance testing can be required for the acceptance of new information systems, upgrades, and new versions of the software provided by third parties.

    This article will provide you with a further explanation about the selection of controls:

  • Advise on Project timelines for ISO 27001 Certification

    1 - Our ISO 27K implementation project is on track to complete the documentation phase by the end of March. The plan after that is to have all Control records and evidence in place for an Internal Audit by April 22nd.  Thereafter (all being well) the plan is to engage with an external Auditor to commence the external Audit process on June 15th with an aim to be certified by June 30th

    The question I have is, are these dates realistic? 

    An internal audit can be performed within 1 day, with whatever records you may have, so a three-week period for generating evidence is more than enough to gather evidence for the internal audit.

    Two weeks for the certification audit process is a realistic timeframe (in general certification audits last from 2 to 5 days, depending on scope size and complexity).

    For further information, see:

    2 - My second question relates to Major nonconformities.  As I understand it,  if the Audit finds a major nonconformity we have 3 months to correct it.  Is this a fix period, as in we can only move the audit process forward until the 3 months have elapsed, or does it restart after we have resubmitted the evidence that proves we have corrected it.

    The certification audit is not resumed after the nonconformity is corrected. The auditor will verify if the nonconformity is resolved (after the official part of the certification audit is completed) and the evidence is sent to him.

    For further information, see:

  • Implementation of ISO-27001

    According to ISO 27001, the ultimate actions and decisions to be considered for the ISMS are those from the top management, not those from the owner of the company - of course, if the owner of the company is also its CEO then this person will have full power to make decisions.

    In practice, the top management will have to act and decide on how to support the ISMS with resources and ensure security policies and procedures are followed, if not, the company might lose its certificate.

    In case the top management wants to change some security objectives/controls/priorities/resources, etc. this must be in writing, taking into account risks and requirements of interested parties (e.g., the company’s owner, customers, suppliers, government, etc.) - in other words, such decisions must be made taking into account the security needs.

  • Video of A17 (ISO 27001 lead implementer course)

    The IT disaster recovery refers to point 4 – Redundancies, which is covered by controls A.17.1.2 - Implementing information security continuity, and A.17.2.1 - Availability of information processing facilities.

    This article will provide you a further explanation about Disaster Recovery:
Page 101-vs-13485 of 1127 pages

Didn’t find an answer?

Start a new topic and get direct answers from the Expert Advice Community.

CREATE NEW TOPIC +