Start a new topic and get direct answers from the Expert Advice Community.
CREATE NEW TOPIC +Search results
11272 results
Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
Advantages/Disadvantages of Asset Based Risk Assessment
Itommy,
It is true that many companies are still using asset-based risk assessment, although 2013 revision of ISO 27001 allows also other methods of risk identification.
If you want to avoid missing generic risks when doing the asset-based risk assessment, you should develop a list of generic threats and then make sure you check them against each asset.
Generally speaking, asset-based risk assessment is more precise than others because it focuses on each element that contains information (or could endanger the information), while on the other hand it is rather complex and lengthy. Other methodologies have still not proved themselves, so it will take couple of years more to show which will prove better in practice. -
User profiles in Access Control Policy
For instance, software engineers get access to production servers and related services as needed to perform their work.
Answer:
For very small companies it might be enough to define who has to access what based on their job titles, but if you have more than 20 employees it would become too difficult to define access rights by job title only - there will be too many different functions.
Therefore, if you're not a very small company I think it would make sense to develop at least one user profile that would be applicable to every employee (e.g. access to internal file server, email system, core application, etc.) and then you can define some privileges for particular employees as needed. -
ISO 17799/27001/27002?
ISO 17799 has changed it's name to ISO 27002 couple of years ago - therefore, these standards were the same.
Here you'll find an explanation of differences between ISO 27001 and ISO 27002: https://advisera.com/27001academy/knowledgebase/iso-27001-vs-iso-27002/
COBIT is a framework (not a standard) that is aimed at IT governance, therefore it is more IT related than ISO 27001. -
mandatory backup policy?
https://community.advisera.com/topic/do-we-need-to-document-each-control/
What is your list of mandatory documents based on? Why do you thing some documents are not required to implement? Referring to your example, that no policy / procedure for backup is necessary, 27001 Annex A.12.3.1 clearly states: Backup copies ... shall be taken ... in accordance with an agree backup policy."
This is only an example - generally speaking I am interested in the basis for your decision on whether documents are necessary in order to fulfill Annex A control objectives.
Answer:
Word "policy" in ISO standards does not mean that it has to be documented, i.e. written down. For example, policy can we also verbal, but it could also be a policy that is included in an information system.
A document must be written only if you see a word "documented" in ISO standard - for example, ISMS scope must be documented, whereas Backup policy does not have to be documented.
See here a list of mandatory document required by ISO 27001: https://advisera.com/27001academy/knowledgebase/list-of-mandatory-documents-required-by-iso-27001-2013-revision/ -
Who can access the Business continuity plan?
* All employees?
* Only those involved ? This document contains procedures, phone numbers, sensible info...
* Third parties: For contract for instance, they need to know all content? or only that we have a system in charge.
Answer:
You should follow the Need-to-know basis rule - only those people (internal or external) that need to see a document should have the access to it.
Further, if you already don't have the Classification policy you should develop it and then classify your Business continuity plan accordingly. Here's an article that will help you: Information classification according to ISO 27001 https://advisera.com/27001academy/blog/2014/05/12/information-classification-according-to-iso-27001/ -
Which comes first in risk assessment: threat or asset?
ISO 27001 does not prescribe any method for risk assessment, which means your method is acceptable and you should use it if you feel comfortable with it.
However, with such approach you might miss some very specific threats related to some "smaller" assets, which could bring higher risks - for example, smart phones.
Therefore, you could perhaps choose this method: first list all the threats you can think of and include them in the catalog in the Risk assessment table; once this is finished you can start listing all the assets and connect related threats and vulnerabilities with those assets.
This article can also help you: ISO 27001 risk assessment: How to match as sets, threats and vulnerabilities https://advisera.com/27001academy/knowledgebase/iso-27001-risk-assessment-how-to-match-assets-threats-and-vulnerabilities/ -
Regarding ISO 27001
I'm not sure if I understood your situation correctly, but here are the answers:
If a location has changed, this means you have to change your ISMS scope.
For any significant change a risk assessment has to be performed/reviewed, which will most probably result with new required controls.
The fact that the third party service provider is ISO 27001 certified doesn't change much - still a risk assessment must be performed, and risks related with a third party must be addressed in the agreement.
These articles will help you:
ISO 27001 risk assessment: How to match assets, threats and vulnerabilities ISO 27001 risk assessment: https://advisera.com/27001academy/knowledgebase/iso-27001-risk-assessment-how-to-match-assets-threats-and-vulnerabilities/
6-step process for handling supplier security according to ISO 27001 https://advisera.com/27001academy/blog/2014/06/30/6-step-process-for-handling-supplier-security-according-to-iso-27001/ -
Security Policy Information
Yes, you are correct - if you reviewed the policy and no changes were needed, then there is no need to republish such a document. This is basically true for any of your policies and procedures.
However:
1) I find it quite difficult to believe there would be nothing to change in a document after a one-year period.
2) Even if there is absolutely nothing to change, you should have some kind of a record that particular person has reviewed the policy and that the conclusion is there were no changes needed - this could also be done through email.
By the way, 2005 revision of ISO 27001 is not valid any more - currently 2013 revision of ISO 27001 is published, but basically the requirements about reviewing the policies and procedures remained the same. See also: A first look at the new ISO 27001 (2013 draft version) https://advisera.com/27001academy/blog/2013/01/28/a-first-look-at-the-new-iso-27001-2013-draft-version/ -
Business Continuity Question
I'm not really sure what is required by SOC 2, but in ISO 22301 the Business continuity policy has a very different function from the Business continuity plan, and therefore these two documents are normally separated.
However, merging those two documents is not forbidden in ISO 22301 - therefore you could theoretically do it although it would be a bit strange and impractical.
See also this article: The purpose of Business continuity policy according to ISO 22301 https://advisera.com/27001academy/blog/2013/06/04/the-purpose-of-business-continuity-policy-according-to-iso-22301/ -
Need guidence on IT Sec
These articles can help you:
How to learn about ISO 27001 https://advisera.com/27001academy/blog/2010/11/30/how-to-learn-about-iso-27001-and-bs-25999-2/
What is the job of Chief Information Security Officer (CISO) in ISO 27001? https://advisera.com/27001academy/knowledgebase/what-is-the-job-of-chief-information-security-officer-ciso-in-iso-27001/
Chief Information Security Officer (CISO) - where does he belong in an org chart? https://advisera.com/27001academy/blog/2012/09/11/chief-information-security-officer-ciso-where-does-he-belong-in-an-org-chart/
Regarding online classes, you can take a look at our live online trainings via webinar: https://advisera.com/27001academy/webinars/