Start a new topic and get direct answers from the Expert Advice Community.
CREATE NEW TOPIC +Search results
11272 results
Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
ISO 27001 in the field of media production
I was wondering if there is a possibility to consider ISO 27001 in the field of media production. I've been thinking about the matter since i'm involved in working with such an industry for the time being. I was trying to look for an approach to present the idea with no success until now. Appreciate your valuable assistance.
Answer:
Sure, ISO 27001 is interesting for media production companies because the main objective of the standard is the protection of information, and I am sure that you have sensitive data in your business. Furthermore, ISO 27001 is for any type of business, so you can implement and certify it in your company. I think that the important in your situation is to obtain the management support, so I think that this webinar can be interesting for you ISO 27001 benefits: How to obtain management support : https://advisera.com/27001academy/webinar/iso-27001-benefits-how-to-get-management-buy-in-free-webinar-on-demand/
Also this article can be interesting Four key benefits of ISO 27001 implementation : https://advisera.c om/27001academy/knowledgebase/four-key-benefits-of-iso-27001-implementation/
And finally this article can be also interesting for you Applicability of ISO 27001 across industries : https://advisera.com/27001academy/blog/2015/06/29/applicability-of-iso-27001-across-industries/ -
MBCO, RTO, MPTD/MAO
Sorry, but we do not have a specific diagram about this, although we have an interesting article where we talk about MBCO, RTO and MAO with a brief example How to implement business impact analysis (BIA) according to ISO 22301: https://advisera.com/27001academy/knowledgebase/how-to-implement-business-impact-analysis-bia-according-to-iso-22301/
I hope that this information can help you, if not please let us know any doubt. -
IRCA, RABQSA, PECB
1.- I wonder if you can help answer my query. I want to know if there are any disadvantages in doing ISO 27001 with one board rather than other? I am looking at a course which is run over 2 consecutive weekends and certified by PECB. All other courses I have looked at are certified by IRCA.
2.- Do you have any suggestions on opinions on this? Also are the exams the same format/difficulty for both boards?
Answer:
Point 1: There are many companies and all are good, our recommendation is that you search a course accredited by IRCA or RABQSA (although PECB is also a good entity), because this means that, once you pass the exam, this certificate will be accepted by any certification body if you want to work as lead auditor with them. Maybe this article can be interesting for you How to become ISO 27001 Lead Auditor : https://advisera.com/27001academy/knowledgebase/how-to-become-iso-27001-lead-auditor/
Point 2: Regarding the exam, I think that the important is to know in detail the basic points of the standard (risks assessment & tr eatment and security controls), and depending on the entity there will be more or less questions about one or other, but if you have good knowledge about them, surely you do not have problems. So, if you want to prepare the exam, this webinar can be interesting for you ISO 27001 Lead Auditor Course preparation training : https://advisera.com/training/iso-27001-lead-auditor-course/ -
Políticas de desarrollo
Estuve revisando el sitio de ustedes y al parecer es justo lo que necesito, tengo una auditoria ISO27001:2013 el próximo mes y necesito tener listas las siguientes políticas del Anexo 14.2, y serias estas:
A14.2.1 Política de Desarrollo
A14.2.5 Los procedimientos del sistema de desarrollo
A14.2.6 Entorno de Desarrollo Seguro
A14.2.8 Pruebas de la Seguridad del Sistema
Necesito saber si lo que ustedes venden contiene toda la descripción de las políticas anteriores solo para que yo les pueda hacer los ajustes a lo que autorice mi empresa, de ser afirmativo necesito que me indiquen cuanto cuesto y como lo pago.
Respuesta:
En relación a los documentos que has listado, sólo es obligatorio tener el que aplica para el control "A.14.2.5 Los procedimientos del sistema de desarrollo", de todas formas, con nuestra plantilla "Política de desarrollo seguro" : https://advisera.com/27001academy/es/documentation/politica-de-desarrollo-seguro/ puedes implementar todos los controles que necesitas y más: A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.7, A .14.3.1, etc.
Puedes ver una versión gratuita del documento clickeando en "Demo gratis", y si estás interesado en adquirirla, en la página anterior puedes ver el precio.
Finalmente, recuerda que puedes preguntarnos cualquier duda que tengas. -
iso 27001 lead auditor
Sure, you are welcome. And sorry but we do not have other specifics examples related to your question, but if you need more information about nonconformities, I think that this article can be interesting for you "Major vs. Minor nonconformities in the certification audit" :
https://advisera.com/27001academy/blog/2014/06/02/major-vs-minor-nonconformities-in-the-certification-audit/
And in this webinar we also talk about the definition of nonconformities, how you write corrective action request and more issues related to an audit, I hope that this webinar help you "Internal audit: How to conduct it according to ISO 27001 and ISO 22301/BS 25999-2" : https://advisera.com/27001academy/webinars/ -
ISO 31000
I just want to know that is your new RISK assessment toolkit is based on ISO 31000
Answer:
Our methodology is based on ISO 27005, which has the same structure that ISO 31000 (they are fully compatible), but while ISO 31000 is focused on any type of risk (environmental, financial, information security, etc), ISO 27005 is focused specifically to information security. So, if you want to work only with information security, the best, or our recommendation, is a methodology based on ISO 27005. If you want, you can see a free version of our template clicking on Free Demo tab here Risk Assessment and Risk Treatment Methodology : https://advisera.com/27001academy/documentation/Risk-Assessment-and-Risk-Treatment-Methodology/
Finally, if you need more information about ISO 27001, ISO 27005 and ISO 31000, you can read this article ISO 31000 and ISO 27001 How are they related? : https://advisera.com/27001academy/blog/2014/03/31/iso-31000-and-iso-27001-how-are-they-related/ -
Questions about ISO 27001
I need some ISMS question for prepare interview.
The interviewer will probably focus on the following:
1.- Which safeguards (controls) are listed in ISO 27001
2.- What is the role of risk management in ISO 27001
3.- Which are general steps in the implementation of this standard
4.- How to setup an ISO 27001 project
Answer:
Point 1: There are 114 controls, here you can see an overview of them Overview of ISO 27001:2013 Annex A : https://advisera.com/27001academy/iso-27001-controls/ And also you can see all controls in detail in our template Statement of Applicability here (you can see a free version clicking on Free Demo tab) : https://advisera.com/27001academy/documentation/statement-of-applicability/
Point 2: The role of the risk management in the ISO 27001 is very simple (and it is the core of the standard): Identify risks and reduce them applying security controls, which are listed in the Annex A of the ISO 27001. And the risk management is composed on an assessment and on a treatment. To know more information about this, please read this article ISO 27001 risk assessment & treatment 6 basic steps : https://advisera.com/27001academy/knowledgebase/iso-27001-risk-assessment-treatment-6-basic-steps/
Point 3: Here you can find a brief guide to implement the standard in your organization ISO 27001 implementation checklist : https://advisera.com/27001academy/knowledgebase/iso-27001-implementation-checklist/ And also this free webinar can be interesting for you ISO 27001: An overview of ISMS implementation process : https://advisera.com/27001academy/webinar/iso-27001-overview-isms-implementation-process-free-webinar-demand/
Point 4: It is very important, I mean, you need to define a plan project to implement the ISO 27001 in your organization, so this article will be interesting for you ISO 27001 project How to make it work : https://advisera.com/27001academy/blog/2013/04/22/iso-27001-project-how-to-make-it-work/ -
Information Security Aspects of Business Continuity
Hi. I am currently working on a project - Implementing Iso27001 for the IT department (Support function- No. of employees is 6) of an organisation. I need clarification regarding the control " Information Security Aspects of Business Continuity". would this be applicable to them ? they are just in the planning phase of DRP and they do not have BCP in Place as of now.
Answer:
Information Security Aspects of Business Continuity is not a control, is a domain (domain A.17) composed by the controls A.17.1.1, A.17.1.2, A.17.1.3, and A.17.2.1. These controls are basically for implement a Business Continuity Plan or a Disaster Recovery Plan in your business. We recommend you to develop a Disaster Recovery Plan because it is related to the Infrastructure IT, so you can find a template for this here (you can see a free version clicking on Free Demo tab) Disaster Recovery Plan : https://advisera.com/27001academy/documentation/disaster-recovery-plan/
Regarding to the applicability, these controls are applicable to your employees if the Di saster Recovery Plan or the Business Continuity Plan can affect their job, and also if they are in the scope of the ISMS. Here is very important the awareness, because each one need to know what to do in case of activation of the plan (DRP or BCP). -
Applicability of ISO 27001 procedures in scope with multiple departments
This questions stems from the fact that many of our existing documentation such as standards and procedures have been written up that gives the reader the impression that the controls mentioned in these documents are minimum requirements that are to be applied to all in-scope-units; whereas, in the first instance the control would have been chosen as an answer to one unit's risk.
Answer:
You should decide on your own whether your documents (e.g. policies, procedures, etc.) will apply to your whole organ ization, to your whole ISMS scope, or only to a particular organizational unit. However, when writing your documents, then you have to specify clearly to which organizational units they apply to; you can also specify this information in the Statement of Applicability.
This article can also help you: How to define the ISMS scope https://advisera.com/27001academy/blog/2014/10/13/how-to-define-the-isms-scope/
2. Can or should the scope document be reviewed periodically?
Answer:
ISMS scope document should be definitely reviewed periodically, typically this is once a year, before you start doing the risk assessment. -
ISO 9001 and ISO 27001Requerimientos ISO 27001
Our customer currently has ISO 9001 implemented. Which documents should we ask for so we can revise and use for ISO 27001?
Answer:
There are some some common points in both standards, but keep in mind that the ISO 9001 is being updated, and the final version is expected by the end of 2015. The structure of the new ISO 9001:2015 is more similar to the ISO 27001:2013, so it will be more easy the ISO 9001:2015 take place.
Anyway, with the current version of ISO 9001 there are many similar things, to know more about this, please read this article Using ISO 9001 for implementing ISO 27001 : https://advisera.com/27001academy/blog/2010/03/08/using-iso-9001-for-implementing-iso-27001/
Maybe this webinar can be also interesting for you ISO 27001 implementation: How to make it easier using ISO 9001 : https://advisera.com/27001academy/webinar/iso-27001-implementation-make-easier-using-iso-9001-free-webinar-demand/
Finally, if you are interesting in the changes of the new ISO 9001:2015, this article can be interesting for you 5 Main C hanges Expected in ISO 9001:2015 from the 2014 Draft International Standard (DIS) : https://advisera.com/9001academy/knowledgebase/5-main-changes-expected-in-iso-90012015-from-the-2014-draft-international-standard-dis/ Hemosrecibido la siguiente pregunta:
Tengo una duda?, los dominios son como los requisitos o requerimientos?, es el deber ser de la norma ISo 27001?, o los requiesitos son los que usted expone en una pagina donde habla de lo siguiente:
1.Diagnostico y formulacion
1.1. Apoyo de la dirección
1.2. Tomarlo como un proyecto
1.3. Definir el alcance del SGSI
1.4. Política del SGSI
1.5. Definir la metodología de la evaluación de riesgos
1.6. Realizar la evaluación y el tratamiento de riesgos
1.7. Redactar la declaración de aplicabilidad
1.8. Redactar el plan de tratamiento del riesgo
1.9. Determinar como medir la eficacia de los controles
1.10. Implementación de controles y procedimientos obligatorios
1.10.1. Procedimiento para el control de la documentación
1.10.2. Procedimiento para auditorias internas
1.10.3. Procedimiento para medidas correctivas
1.11. Implementar programas de capacitación y concienciación
1.12. Hacer funcionar el SGSI
1.13. Supervisión del SGSI
1.14. Auditoria interna
1.15. Revisión por parte de la dirección
1.16. Medidas preventivas y correctivas
Respuesta:
Esta lista es sólo una guía para implementar la ISO 27001 en su organización, pero cada punto está relacionado con un requisito de la norma. Por tanto, necesitas implementar todos los requisitos de ISO 27001, y para hacer esto, puedes utilizar nuestra lista de 16 pasos.
Por otra parte, recuerda que en la implementación necesitarás desarrollar políticas y procedimientos, y creo que este artículo puede ser interesante para ti Siete pasos para implementar políticas y procedimientos : https://advisera.com/27001academy/es/knowledgebase/siete-pasos-para-implementar-politicas-y-procedimientos/
Y este artículo relacionado con los documentos obligatorios que necesitas para implementar la ISO 27001, también te puede resultar interesante: Lista de documentos obligatorios exigidos por la norma ISO 27001 (revision 2013) : https://advisera.com/27001academy/es/blog/2015/05/04/lista-de-documentos-obligatorios-exigidos-por-la-norma-iso-27001-revision-2013/
Por último, ten en cuenta que después del análisis y tratamiento de riesgos tendrás que implementar controles de seguridad, los cuales puedes encontrar en el Anexo A del estándar. Si necesitas más información al respecto, por favor lee este artículo (en inglés) "Overview of ISO 27001:2013 Annex A" : https://advisera.com/27001academy/iso-27001-controls/
Y también te puede resultar interesante este artículo (también en inglés) "The basic logic of ISO 27001: How does information security work?" : https://advisera.com/27001academy/knowledgebase/the-basic-logic-of-iso-27001-how-does-information-security-work/