Start a new topic and get direct answers from the Expert Advice Community.
CREATE NEW TOPIC +Search results
11295 results
Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
Information asset in ISO 27001:2013
Yes, with the ISO 27001:2013 you can continue doing the risk assessment based on hardware, software, documents, infrastructure and people.
If you choose to continue using the asset-based risk assessment, then you cannot exclude hardware, infrastructure and people from the risk assessment because those are very important assets.
My recommendation: maintain these types of assets, but please keep in mind that the important here is the identification of threats/vulnerabilities that can affect to the organization (and the risk), and you can define the types that you need in your business. In the ISO 27005 you can see an example of type of assets.
This article will also help you: What has changed in risk assessment in ISO 27001:2013 https://advisera.com/27001academy/knowledgebase/what-has-changed-in-risk-assessment-in-iso-270012013/ -
ISMS Feasibility
Before you start implementing ISO 27001, you have to make sure your project will succeed - get the support of the top management, introduce project structure, etc. - this article will help you: ISO 27001 project How to make it work https://advisera.com/27001academy/blog/2013/04/22/iso-27001-project-how-to-make-it-work/
Once you start implementing ISO 27001, you have to make sure you implement all the elements in the right sequence - read this article for details: ISO 27001 implementation checklist https://advisera.com/27001academy/knowledgebase/iso-27001-implementation-checklist/ -
Asset Identification for Contact Centers
The key question here is who is in charge of this Client's database - are you controlling the database (i.e. setting the rules, administering it, etc.), or is the client controlling it and you simply have the access to it?
If you are controlling the database, then it should be included in your ISMS scope, and you should perform the risk assessment (and treatment).
See also this article: How to define the ISMS scope https://advisera.com/27001academy/knowledgebase/how-to-define-the-isms-scope/ -
ISMS Scope Document
Each company has to define for itself which organizational units to include in its ISMS scope - the recommendation is to include the whole company in the scope, or if this is not possible, then the departments that handle the most sensitive data (e.g. IT department, Sales department, HR department, R&D, etc.). This way it is ensured that the information security rules are applied to the most important information.
See also this article: How to define the ISMS scope https://advisera.com/27001academy/knowledgebase/how-to-define-the-isms-scope/ -
Monitoring of third parties
In my view, you can perform the monitoring of third parties in the following ways:
Receiving regular reports from the third party - these reports are prepared by this third party, and they are the least reliable.
Using some kind of automated reporting system or software - this way you can get more detailed and more precise info about what and when is done by the third party.
Second party-audit - you can send your auditors to the third party so that they could check if they comply with the agreement.
Generally, you can manage your suppliers and other third parties like explained in this article: 6-step process for hand ling supplier security according to ISO 27001 https://advisera.com/27001academy/blog/2014/06/30/6-step-process-for-handling-supplier-security-according-to-iso-27001/ -
ISO 27001 clauses applicable for Cloud Security
This article will give you the answers: Cloud computing and ISO 27001 https://advisera.com/27001academy/blog/2011/05/30/cloud-computing-and-iso-27001-bs-25999/
Please keep in mind this article was written before the 2013 revision of ISO 27001 was published, so the numbering of controls has changed - here you'll find a mapping of old and new controls: https://www.bsigroup.com/Documents/iso-27001/r********************************************* -
Recording changes when making a transition to ISO 27001:2013
In my view, when you make the transition to a new revision of the standard, these are not improvements - therefore, you should simply record all the changes in Change history of each document you updated.
See also this article: How to make a transition from ISO 27001 2005 revision to 2013 revision https://advisera.com/27001academy/knowledgebase/how-to-make-a-transition-from-iso-27001-2005-revision-to-2013-revision/ -
SOA Related
In Statement of Applicability you could simply add columns "Applicability" and "Status" for each location - this way you would show which controls are applicable for each location, and whether they are implemented or not in a particular location. -
Difference between contingency, recovery and response plans?
ISO 22301 nor ISO 27001 do not prescribe the structure of business continuity plan, but usually the plans are structured as follows:
- Business Continuity Plan is only a top-level document describing some general activities
- Incident Response Plans are the plans where responses to particular incidents is described
- Recovery Plans (for each activity) describe how each activity is to be recovered from a disruption
And yes, the format for these 3 types of plans is often different. This article will also help you: Activation procedures for the business continuity plan https://advisera.com/27001academy/blog/2011/09/26/activation-procedures-for-business-continuity-plan/
As I described above, response plan is used for directly responding to an incident; regarding contingency and recovery plans, the ISO standards do not make a difference between them. -
ISO27001:2013 - 6.1.3 c) - verifying that no controls have been left out
I understand that the policy must dictate that there is a procedure for this, and I have created an entry in the Risk Assessment and Treatment Methodology around this process, however I was wondering if this needed to be evidenced? Would I be required to, for each risk, identify that each control was considered and where it was not selected, why?
Answer:
I have a small correction to your statement - clause 6.1.3 c) of ISO 27001 says "... verify that no necessary controls have been omitted." - therefore you don't have to verify this for each and every risk.
The answer to your question lies in writing the Statement of Applicability - it will enable you:
To decide for each control from the Annex A whether it is applicable or not, and
To declare why you didn't select part icular controls.
Statement of Applicability is a mandatory document, so you'll have everything documented - learn more here: The importance of Statement of Applicability for ISO 27001 https://advisera.com/27001academy/knowledgebase/the-importance-of-statement-of-applicability-for-iso-27001/