Start a new topic and get direct answers from the Expert Advice Community.
CREATE NEW TOPIC +Search results
11295 results
Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
Difference between total risk and residual risk
difference between total risk and residual risk?
Answer:
I am sorry but ISO 27001 uses the term risk and residual risk (total risk is not used). A risk is the effect of uncertainty on objectives, while residual risk is the risk remaining after the risk treatment. So, basically before implement the security controls you have risks related to information security in your business (you need to reduce them), and after implementing controls the reduced risk is the residual risk (keep in mind that generally you cannot eliminate absolutely the risk).
Maybe this article about the residual risk can be interesting for you Why is residual risk so important? : https://advisera.com/27001academy/knowledgebase/why-is-residual-risk-so-important/ -
Standard for protection of personally identifiable information
Any standard or guidelines by ISO for protection of personally identifiable information (PII) other than 27018 i mean not for cloud
Answer:
The standard ISO with guidelines about the protection of personally identifiable information is ISO 27002. This standard has the control "18.1.4 Privacy and protection of personally identifiable information, which is exactly what you need. You can download and buy the standard from the official site of ISO.org : https://www.iso.org/standard/54533.html
Finally, keep in mind that most of countries in the world have laws related to the protection of personal data, so maybe this list of laws and regulations on information security in most important countries can be interesting for you Laws and regulations on information security and business continuity : https://advisera.com/27001academy/knowledgebase/laws-regulations-information-security-business-continuity/ -
ISO 27001 - Document Control on non-ISMS documentation
In accordance with the clause "7.5.3 Control of documented information" : "Documented information required by the information security management system and by this International Standard shall be controlled...". So it is not necessary that non-ISMS documents follow the control of documented information, although from my point of view can be a best practice. So, "document coding", "classification", "Change history block", "distribution", etc. are not strictly necessary for non-ISMS documents, but can be useful and a best practices for your business.
This article can be interesting for you "Document management in ISO 27001 & BS 25999-2" : https://advisera.com/27001academy/blog/2010/03/30/document-management-within-iso-27001-bs-25999-2/ -
Data center as secure area
Just a quick one on the Physical Security aspect of the policy - specifically with regards to "Procedures for Working in Secure areas". The only secure area is actually the data centre location where our server is located. Should that be listed as a secure area? If so, it's a little different to the template as access is generally only to data centre staff who actually manage the facility and these are not direct employees. Or do we not need such procedure in this scenario?
Answer:
Yes, from my point of view you can list the data centre as secure area, and in your scenario the procedure is necessary, although is not mandatory to be documented. This article about the list of mandatory documents can be interesting for you List of mandatory documents required by ISO 27001 (2013 revision) : https://advisera.com/27001academy/knowledgebase/list-of-mandatory-documents-required-by-iso-27001-2013-revision/
And also this article abou t the physical security Physical security in ISO 27001: How to protect the secure areas : https://advisera.com/27001academy/blog/2015/03/23/physical-security-in-iso-27001-how-to-protect-the-secure-areas/ -
Interested party and BIA
Can you assist me with these two quick questions:
1. How do you determine the relevant external parties within capture too much and their interest (is this directly to the company)?
2. As it relates to the BIA was are the critical focus of that evaluation?
Answers:
1.- To determine interested parties you need to ask your top executives, and/or heads of departments about who is important for the business, taking into account that an interested party can be an employee, owners of the business, regulators, clients, etc. To determine their interests you can also ask to each top executives and/or heads of departments, and yes, this is directly to the company. This article can be interesting for you How to identify interested parties according to ISO 27001 and ISO 22301 : https://advisera.com/27001academy/knowledgebase/how-to-identify-interested-parties-according-to-iso-27001-and-iso-22301//
2.- I am not sure if I have understood your question, but during the BIA basically you need to collecting information from the responsible persons of each activity (some information: impact assessment, assessment of RPO/Maximum Data Loss, Minimum Business Continuity Objectives, etc), after this, with all information acquired you need to make decisions. I think that this article can be very interesting for you How to implement business impact analysis (BIA) according to ISO 22301 : https://advisera.com/27001academy/knowledgebase/how-to-implement-business-impact-analysis-bia-according-to-iso-22301/
By the way, for the collection of information you can use our questionnaire (you can see a free version clicking on Free Demo tab) Business Impact Analysis Questionnaire : https://advisera.com/27001academy/documentation/business-impact-analysis-questionnaire/
You can also download our "ISO 22301 Business Impact Analysis Toolkit" : https://advisera.com/27001academy/iso22301-business-impact-analysis-documentation-toolkit/ You can download a free demo of this toolkit, and you can find the questionnaire template in the folder "Business_Impact_Analysis_Toolkit_Preview_EN". -
Template simple and functional for the BCP
Gostaria de desenhar o PCN qual é a melhor forma para mininizar erros e fazer um plano suscinto e consistente? Não quero me perder no preciosismo de detalhes e fazer algo simples e funcional.
Answer:
You can use our template, which is simple and functional. You can see a free version clicking on Free Demo tab here Plano de continuidade de neógcios : https://advisera.com/27001academy/pt-br/documentation/plano-de-continuidade-de-negocios/
And this template can be also interesting for you "Plano de recuperaçao de desastre" : https://advisera.com/27001academy/pt-br/documentation/plano-de-recuperacao-de-desastre/ -
We need ISO 27001?
why we need ISO 27001 and how to make documentations and list of documents we need
Answer:
ISO 27001 can give to your business some benefits: compliance, marketing edge, lowering the expendes, putting your business in order, so ISO 27001 can be very interesting for any type of business. Please read this article Four key benefits of ISO 27001 implementation : https://advisera.com/27001academy/knowledgebase/four-key-benefits-of-iso-27001-implementation/
Regarding the list of documents, here you can find the list of mandatory documents List of mandatory documents required by ISO 27001 (2013 revision) : https://advisera.com/27001academy/knowledgebase/list-of-mandatory-documents-required-by-iso-27001-2013-revision/
And it is important to know that we have a toolkit with all necessary documents (and best practices) for the implementation of ISO 27001, you can see a free version of each document clicking on Free Demo tab here ISO 27001 Documentation Toolkit : https://advisera.com/27001academy/iso-27001-documentation-toolkit/ -
How can a business measure and monitor the effectiveness of the ISMS?
I would like to ask you the following question question pertaining to ISO 27001 ISMS.....
How can a business measure & monitor the effectiveness of the the ISMS?
Answer:
Generally you need to to define what needs to be monitored/measured, which methods may be use, when monitoring/measurement must be done, when monitoring/measurement results must be analyzed and evaluated, who must analyze and evaluate monitoring/measurement results, etc.
For more information, this article can be interesting for you How to perform monitoring and measurement in ISO 27001 : https://advisera.com/27001academy/blog/2015/06/08/how-to-perform-monitoring-and-measurement-in-iso-27001/
This free webinar can be also interesting ISO 27001 and ISO 27004: How to measure the effectiveness of information security? : https://advisera.com/27001academy/webinar/iso-27001-iso-27004-measure-effectiveness-information-security-free-webinar/ -
ISO 27001 and ISO 27002
I'm a student of Computer Engineering, and in my final project I have to define a security policy to my School.
So I have been analysed the ISO 27000 and COBIT, to see the differences between them and I decided that the ISO 27000 is the most benefit to this project.
So I'm trying to understand how the ISO 27000 works, I know that the ISO 27001 is referral to the implementation of one Information Security Management System and the ISO 27002 is referred to the elaboration of the Security Policy.
Right know I'm trying to understand how the ISO 27002 works, and how can I construct my Security Policy.
I don't have, yet, time to analyse the documentation that I've downloaded.
Answer:
You are partially ok, because ISO 27001 is an international standard with requisites for the implementation on an ISMS, but ISO 27002 is not only for the elaboration of the Security Policy. Let me explain the differences: The core of ISO 27001 is the risk management (you need to identify risks and reduce them) for the protection of the information. ISO 2700 2 has 114 security controls, which you can use to reduce risks (one of them is A.5.1.1 Policies for information security).
So, with ISO 27001 you identify risks, and you need controls to reduce them, and you can do it with the security controls of ISO 27002. You can also see the same security controls in the Annex A of ISO 27001, although you can only see a brief description, in ISO 27002 you can see a guide of implementation of each control.
This article about ISO 27001 and ISO 27002 can be interesting for you ISO 27001 vs. ISO 27002 : https://advisera.com/27001academy/knowledgebase/iso-27001-vs-iso-27002/
And this free tutorial can be also interesting for you How to write the information Security Policy According to ISO 27001 : https://advisera.com/27001academy/tutorial/free-tutorial-how-to-write-the-information-security-policy-according-to-iso-27001/ -
ISO 27001 and SOC 2
I am looking for Information Security document templates to assist in my SOC 2 Type 1 audit process are you familiar with SOC 2? And will your ISO 27001 toolkit allow me to develop the policies required for IT for SOC 2?
Answer:
I am sorry but our templates are developed for ISO 27001. Anyway, this information (from the official site of American Institute of CPAs) about SOC 2 and ISO 27001 can be interesting for you (see the Excel Trust Services Map to ISO 27001") : https://www.aicpa.org/interestareas/frc/assuranceadvisoryservices/soc2additionalsubjectmatter.html
As you can see in the Excel, there are some points in common between ISO 27001 and SOC 2, so for these points you can use our toolkit ISO 27001 Documentation Toolkit : https://advisera.com/27001academy/iso-27001-documentation-toolkit/