Start a new topic and get direct answers from the Expert Advice Community.
CREATE NEW TOPIC +Search results
11294 results
Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
Standard for protection of personally identifiable information
Any standard or guidelines by ISO for protection of personally identifiable information (PII) other than 27018 i mean not for cloud
Answer:
The standard ISO with guidelines about the protection of personally identifiable information is ISO 27002. This standard has the control "18.1.4 Privacy and protection of personally identifiable information, which is exactly what you need. You can download and buy the standard from the official site of ISO.org : https://www.iso.org/standard/54533.html
Finally, keep in mind that most of countries in the world have laws related to the protection of personal data, so maybe this list of laws and regulations on information security in most important countries can be interesting for you Laws and regulations on information security and business continuity : https://advisera.com/27001academy/knowledgebase/laws-regulations-information-security-business-continuity/ -
ISO 27001 - Document Control on non-ISMS documentation
In accordance with the clause "7.5.3 Control of documented information" : "Documented information required by the information security management system and by this International Standard shall be controlled...". So it is not necessary that non-ISMS documents follow the control of documented information, although from my point of view can be a best practice. So, "document coding", "classification", "Change history block", "distribution", etc. are not strictly necessary for non-ISMS documents, but can be useful and a best practices for your business.
This article can be interesting for you "Document management in ISO 27001 & BS 25999-2" : https://advisera.com/27001academy/blog/2010/03/30/document-management-within-iso-27001-bs-25999-2/ -
Data center as secure area
Just a quick one on the Physical Security aspect of the policy - specifically with regards to "Procedures for Working in Secure areas". The only secure area is actually the data centre location where our server is located. Should that be listed as a secure area? If so, it's a little different to the template as access is generally only to data centre staff who actually manage the facility and these are not direct employees. Or do we not need such procedure in this scenario?
Answer:
Yes, from my point of view you can list the data centre as secure area, and in your scenario the procedure is necessary, although is not mandatory to be documented. This article about the list of mandatory documents can be interesting for you List of mandatory documents required by ISO 27001 (2013 revision) : https://advisera.com/27001academy/knowledgebase/list-of-mandatory-documents-required-by-iso-27001-2013-revision/
And also this article abou t the physical security Physical security in ISO 27001: How to protect the secure areas : https://advisera.com/27001academy/blog/2015/03/23/physical-security-in-iso-27001-how-to-protect-the-secure-areas/ -
Interested party and BIA
Can you assist me with these two quick questions:
1. How do you determine the relevant external parties within capture too much and their interest (is this directly to the company)?
2. As it relates to the BIA was are the critical focus of that evaluation?
Answers:
1.- To determine interested parties you need to ask your top executives, and/or heads of departments about who is important for the business, taking into account that an interested party can be an employee, owners of the business, regulators, clients, etc. To determine their interests you can also ask to each top executives and/or heads of departments, and yes, this is directly to the company. This article can be interesting for you How to identify interested parties according to ISO 27001 and ISO 22301 : https://advisera.com/27001academy/knowledgebase/how-to-identify-interested-parties-according-to-iso-27001-and-iso-22301//
2.- I am not sure if I have understood your question, but during the BIA basically you need to collecting information from the responsible persons of each activity (some information: impact assessment, assessment of RPO/Maximum Data Loss, Minimum Business Continuity Objectives, etc), after this, with all information acquired you need to make decisions. I think that this article can be very interesting for you How to implement business impact analysis (BIA) according to ISO 22301 : https://advisera.com/27001academy/knowledgebase/how-to-implement-business-impact-analysis-bia-according-to-iso-22301/
By the way, for the collection of information you can use our questionnaire (you can see a free version clicking on Free Demo tab) Business Impact Analysis Questionnaire : https://advisera.com/27001academy/documentation/business-impact-analysis-questionnaire/
You can also download our "ISO 22301 Business Impact Analysis Toolkit" : https://advisera.com/27001academy/iso22301-business-impact-analysis-documentation-toolkit/ You can download a free demo of this toolkit, and you can find the questionnaire template in the folder "Business_Impact_Analysis_Toolkit_Preview_EN". -
Template simple and functional for the BCP
Gostaria de desenhar o PCN qual é a melhor forma para mininizar erros e fazer um plano suscinto e consistente? Não quero me perder no preciosismo de detalhes e fazer algo simples e funcional.
Answer:
You can use our template, which is simple and functional. You can see a free version clicking on Free Demo tab here Plano de continuidade de neógcios : https://advisera.com/27001academy/pt-br/documentation/plano-de-continuidade-de-negocios/
And this template can be also interesting for you "Plano de recuperaçao de desastre" : https://advisera.com/27001academy/pt-br/documentation/plano-de-recuperacao-de-desastre/ -
We need ISO 27001?
why we need ISO 27001 and how to make documentations and list of documents we need
Answer:
ISO 27001 can give to your business some benefits: compliance, marketing edge, lowering the expendes, putting your business in order, so ISO 27001 can be very interesting for any type of business. Please read this article Four key benefits of ISO 27001 implementation : https://advisera.com/27001academy/knowledgebase/four-key-benefits-of-iso-27001-implementation/
Regarding the list of documents, here you can find the list of mandatory documents List of mandatory documents required by ISO 27001 (2013 revision) : https://advisera.com/27001academy/knowledgebase/list-of-mandatory-documents-required-by-iso-27001-2013-revision/
And it is important to know that we have a toolkit with all necessary documents (and best practices) for the implementation of ISO 27001, you can see a free version of each document clicking on Free Demo tab here ISO 27001 Documentation Toolkit : https://advisera.com/27001academy/iso-27001-documentation-toolkit/ -
How can a business measure and monitor the effectiveness of the ISMS?
I would like to ask you the following question question pertaining to ISO 27001 ISMS.....
How can a business measure & monitor the effectiveness of the the ISMS?
Answer:
Generally you need to to define what needs to be monitored/measured, which methods may be use, when monitoring/measurement must be done, when monitoring/measurement results must be analyzed and evaluated, who must analyze and evaluate monitoring/measurement results, etc.
For more information, this article can be interesting for you How to perform monitoring and measurement in ISO 27001 : https://advisera.com/27001academy/blog/2015/06/08/how-to-perform-monitoring-and-measurement-in-iso-27001/
This free webinar can be also interesting ISO 27001 and ISO 27004: How to measure the effectiveness of information security? : https://advisera.com/27001academy/webinar/iso-27001-iso-27004-measure-effectiveness-information-security-free-webinar/ -
ISO 27001 and ISO 27002
I'm a student of Computer Engineering, and in my final project I have to define a security policy to my School.
So I have been analysed the ISO 27000 and COBIT, to see the differences between them and I decided that the ISO 27000 is the most benefit to this project.
So I'm trying to understand how the ISO 27000 works, I know that the ISO 27001 is referral to the implementation of one Information Security Management System and the ISO 27002 is referred to the elaboration of the Security Policy.
Right know I'm trying to understand how the ISO 27002 works, and how can I construct my Security Policy.
I don't have, yet, time to analyse the documentation that I've downloaded.
Answer:
You are partially ok, because ISO 27001 is an international standard with requisites for the implementation on an ISMS, but ISO 27002 is not only for the elaboration of the Security Policy. Let me explain the differences: The core of ISO 27001 is the risk management (you need to identify risks and reduce them) for the protection of the information. ISO 2700 2 has 114 security controls, which you can use to reduce risks (one of them is A.5.1.1 Policies for information security).
So, with ISO 27001 you identify risks, and you need controls to reduce them, and you can do it with the security controls of ISO 27002. You can also see the same security controls in the Annex A of ISO 27001, although you can only see a brief description, in ISO 27002 you can see a guide of implementation of each control.
This article about ISO 27001 and ISO 27002 can be interesting for you ISO 27001 vs. ISO 27002 : https://advisera.com/27001academy/knowledgebase/iso-27001-vs-iso-27002/
And this free tutorial can be also interesting for you How to write the information Security Policy According to ISO 27001 : https://advisera.com/27001academy/tutorial/free-tutorial-how-to-write-the-information-security-policy-according-to-iso-27001/ -
ISO 27001 and SOC 2
I am looking for Information Security document templates to assist in my SOC 2 Type 1 audit process are you familiar with SOC 2? And will your ISO 27001 toolkit allow me to develop the policies required for IT for SOC 2?
Answer:
I am sorry but our templates are developed for ISO 27001. Anyway, this information (from the official site of American Institute of CPAs) about SOC 2 and ISO 27001 can be interesting for you (see the Excel Trust Services Map to ISO 27001") : https://www.aicpa.org/interestareas/frc/assuranceadvisoryservices/soc2additionalsubjectmatter.html
As you can see in the Excel, there are some points in common between ISO 27001 and SOC 2, so for these points you can use our toolkit ISO 27001 Documentation Toolkit : https://advisera.com/27001academy/iso-27001-documentation-toolkit/ -
How to protect secure areas
I´m looking for more detail information linked to the Physical security in ISO 27001: How to protect the secure areas. I´d like to know either there are some more detailed information linked to the 4 level protection zones.
What are the minimum protective measures for Level 1, 2,3 and 4 ? can you share with me some example of proper zoning concept and its measures and Norm with chapter which is about this Topic.
Answer:
I am sorry but we do not have specific information about the 4 levels protection zones (level 1, 2, 3 and 4), and ISO 27001 does not use the zoning concept. Anyway, regarding the Annex A of ISO 27001:2013, A.11.1 Secure areas, you can find these controls and establish different levels of protection:
A.11.1.1 Physical security perimeter: It is the reception, where any people can enter and says I am Antonio Segovia, from ISO27001Academy, and I want to talk with Bill Gates"
A.11.1.2 Physical entry controls: If the previous point is ok (Bill Gates knows me and approves my entry), they give me a card to pass the fir st physical entry control of Microsoft (by the way, my entry is registered: date, hour, etc).
A.11.1.3 Securing offices, rooms and facilities: Bill Gates is in the facility A of the Microsoft Campus, and in the entry of each facility there is another physical entry. But no problem, with my visit card I can enter (only to the facility A)
A.11.1.5 Working in secure areas: Inside of each facility there are secure areas where people are working with very confidential information (for example working about prototypes, or working about military or governmental projects, etc) and additional security controls are necessary.
For more information about the implementation of these controls, you can read the ISO 27002:2013, which is a code of best practices for the implementation of the controls of the Annex A of ISO 27001:2013. And this article can be also interesting for you Physical security in ISO 27001: How to protect the secure areas : https://advisera.com/27001academy/blog/2015/03/23/physical-security-in-iso-27001-how-to-protect-the-secure-areas/
Additionally from the software point of view, you need to implement security controls related to the access control, to avoid unauthorized access to the information (the information can be in servers, desktops, laptops, etc). For this, you can use the A.9 Access control of the Annex A of ISO 27001:2013 (and again ISO 27002:2013 for more information about the implementation of each control). This article can be also interesting for you How to handle access control according to ISO 27001 : https://advisera.com/27001academy/blog/2015/07/27/how-to-handle-access-control-according-to-iso-27001/