Start a new topic and get direct answers from the Expert Advice Community.
CREATE NEW TOPIC +Search results
11294 results
Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
ISMS Feasibility
Before you start implementing ISO 27001, you have to make sure your project will succeed - get the support of the top management, introduce project structure, etc. - this article will help you: ISO 27001 project How to make it work https://advisera.com/27001academy/blog/2013/04/22/iso-27001-project-how-to-make-it-work/
Once you start implementing ISO 27001, you have to make sure you implement all the elements in the right sequence - read this article for details: ISO 27001 implementation checklist https://advisera.com/27001academy/knowledgebase/iso-27001-implementation-checklist/ -
Asset Identification for Contact Centers
The key question here is who is in charge of this Client's database - are you controlling the database (i.e. setting the rules, administering it, etc.), or is the client controlling it and you simply have the access to it?
If you are controlling the database, then it should be included in your ISMS scope, and you should perform the risk assessment (and treatment).
See also this article: How to define the ISMS scope https://advisera.com/27001academy/knowledgebase/how-to-define-the-isms-scope/ -
ISMS Scope Document
Each company has to define for itself which organizational units to include in its ISMS scope - the recommendation is to include the whole company in the scope, or if this is not possible, then the departments that handle the most sensitive data (e.g. IT department, Sales department, HR department, R&D, etc.). This way it is ensured that the information security rules are applied to the most important information.
See also this article: How to define the ISMS scope https://advisera.com/27001academy/knowledgebase/how-to-define-the-isms-scope/ -
Monitoring of third parties
In my view, you can perform the monitoring of third parties in the following ways:
Receiving regular reports from the third party - these reports are prepared by this third party, and they are the least reliable.
Using some kind of automated reporting system or software - this way you can get more detailed and more precise info about what and when is done by the third party.
Second party-audit - you can send your auditors to the third party so that they could check if they comply with the agreement.
Generally, you can manage your suppliers and other third parties like explained in this article: 6-step process for hand ling supplier security according to ISO 27001 https://advisera.com/27001academy/blog/2014/06/30/6-step-process-for-handling-supplier-security-according-to-iso-27001/ -
ISO 27001 clauses applicable for Cloud Security
This article will give you the answers: Cloud computing and ISO 27001 https://advisera.com/27001academy/blog/2011/05/30/cloud-computing-and-iso-27001-bs-25999/
Please keep in mind this article was written before the 2013 revision of ISO 27001 was published, so the numbering of controls has changed - here you'll find a mapping of old and new controls: https://www.bsigroup.com/Documents/iso-27001/r********************************************* -
Recording changes when making a transition to ISO 27001:2013
In my view, when you make the transition to a new revision of the standard, these are not improvements - therefore, you should simply record all the changes in Change history of each document you updated.
See also this article: How to make a transition from ISO 27001 2005 revision to 2013 revision https://advisera.com/27001academy/knowledgebase/how-to-make-a-transition-from-iso-27001-2005-revision-to-2013-revision/ -
SOA Related
In Statement of Applicability you could simply add columns "Applicability" and "Status" for each location - this way you would show which controls are applicable for each location, and whether they are implemented or not in a particular location. -
Difference between contingency, recovery and response plans?
ISO 22301 nor ISO 27001 do not prescribe the structure of business continuity plan, but usually the plans are structured as follows:
- Business Continuity Plan is only a top-level document describing some general activities
- Incident Response Plans are the plans where responses to particular incidents is described
- Recovery Plans (for each activity) describe how each activity is to be recovered from a disruption
And yes, the format for these 3 types of plans is often different. This article will also help you: Activation procedures for the business continuity plan https://advisera.com/27001academy/blog/2011/09/26/activation-procedures-for-business-continuity-plan/
As I described above, response plan is used for directly responding to an incident; regarding contingency and recovery plans, the ISO standards do not make a difference between them. -
ISO27001:2013 - 6.1.3 c) - verifying that no controls have been left out
I understand that the policy must dictate that there is a procedure for this, and I have created an entry in the Risk Assessment and Treatment Methodology around this process, however I was wondering if this needed to be evidenced? Would I be required to, for each risk, identify that each control was considered and where it was not selected, why?
Answer:
I have a small correction to your statement - clause 6.1.3 c) of ISO 27001 says "... verify that no necessary controls have been omitted." - therefore you don't have to verify this for each and every risk.
The answer to your question lies in writing the Statement of Applicability - it will enable you:
To decide for each control from the Annex A whether it is applicable or not, and
To declare why you didn't select part icular controls.
Statement of Applicability is a mandatory document, so you'll have everything documented - learn more here: The importance of Statement of Applicability for ISO 27001 https://advisera.com/27001academy/knowledgebase/the-importance-of-statement-of-applicability-for-iso-27001/ -
Implementation guidance ISO 27002
Let me put an example: Based on our risk evaluation we have determined that control 9.4.2 Secure log-on procedures, applies. In our Control Access Policy we have try to follow the implementation guidance for control 9.4.2, as indicated in ISO/IEC 27002:2013, but we can not comply with some requisites. Taking into account that the standard says that a good log-on procedure should, not a good log-on procedure must, we think we are right.
Can we have some problem with certification audit?
Answer:
You are right, ISO 27002 is not mandatory, this is only the guideline. You do not have to apply everything that is written in ISO 27002; you have to apply only what ISO 27001 requires of you.
Unfortunately, sometimes the certification auditors look towards ISO 27002, but you can clear this out very easily with them - simply ask them whether th ey think ISO 27002 is mandatory or not.
This article will help you: ISO 27001 vs. ISO 27002: https://advisera.com/27001academy/knowledgebase/iso-27001-vs-iso-27002/