Start a new topic and get direct answers from the Expert Advice Community.
CREATE NEW TOPIC +Search results
11269 results
Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
Access controlAlign IT services continuity with ISO 22301
ISO 24762:2008 is withdrawn (see here: https://www.iso.org/standard/41532.html so ISO 27031 is the most relevant standard now for technology aspect of business continuity. -
Vocalbulary
ESPAÑOL: evaluación de riesgos
What is the difference?
but we have another terms for : ENGLISH accountability, responsible
ESPAÑOL : responsabilidad
What is the difference? Please, can you help me explain how this use it?"
Answer:
I refer here to the ISO definitions (we gathered all risk related definitions from 31000, 27000 and old 27005 in the 2WD 27005).
1a risk evaluation
"process of comparing the results of risk analysis (3.10) with risk criteria (3.13) to determine whether the risk and/or its magnitude is acceptable or tolerable"
NOTE to entry 3.14 Risk evaluation assists in the decision about risk treatment.
[ISO Guide 73:2009, definition 3.7.1] »
1b risk assessment
"overall process of risk identification (3.15), risk analysis (3.10) and risk evaluation (3.14)"
[ISO Guide 73:2009, definition 3.4.1]
So, risk assessment is a meta-process and risk evaluation is an activity/process part of risk assessment.
2. The term Accountability isnt much liked and we find it scarcely in the WG1 documents. It has a much wider meaning than Responsibility.
Responsibility is a generic term associated with a role, like telling which objectives should be reached. Accountability has a financial and legal aspect; if the objectives are not met, the responsible person my be asked to pay in money or with a legal suite. -
Asset owner and risk owner - how exactly are the two differentiated?
I've received this question:
"Regarding the asset owner and risk owner when it comes to people. How exactly are the two differentiated? For example a Network Administrator. Would the asset owner be self and risk owner be department manager?
Answer: I assume you are asking a question related to people as assets in terms of ISO 27001. For Network Administrator, the asset owner would be his direct boss - e.g. the Head of IT department; risk owners should be people who can resolve particular risks - e.g.:
risk of performing wrong activities because of non-existing rules - risk owner could be Head of IT department risk of performing wrong activities because of lack of training - risk owner could be Head of HR department
This article can also help you: Risk owners vs. asset owners in ISO 27001:2013 https://advisera.com/27001academy/knowledgebase/risk-owners-vs-asset-owners-in-iso-270012013/ -
Involving the management in the BCP process
The main issue was involve all the management in the process. In addition, the turn over and the time management were challenges that need attention.
Can you tell me how you manage those issues?"
Answer: If you want the management to be involved in your process, they must see clear benefits - otherwise, they won't go along. This article can help you: ISO 22301 benefits: How to get your managements approval for a business continuity project https://advisera.com/27001academy/knowledgebase/iso-22301-benefits-how-to-get-your-managements-approval-for-a-business-continuity-project/
Regarding time management, it is crucial that you set your project properly - this article can help you (it is applicable to ISO 22301 as well): ISO 27001 project How to make it work https://advisera.com/27001academy/blog/2013/04/22/iso-27001-project-how-to-make-it-work/ -
ISO27001 Risk Register
We have received this Question : "Im preparing the risk register.Let take asset as "firewall" Threat as Hackers and there would be lot of vulnerabilities associated with this threat (Improper access rights, Misconfiguration, lack of rule base audit...etc) But i have seen risk registers with one threat and they write only one vulnerability. Please provide your inputs regarding this query." Answer: Risks are better expressed in terms of scenarios « this happens to that element under these circumstances and causes this level of damage ». Each asset can have several threats that in their turn have several vulnerabilities. So we recommand, for a comprehensive risk registry to have one line per vulnerability and one group of vulnerabilities per threat. If a register only shows one threat or vulnerability for each asset, its probably because the risk manager has, after analysis, only kept the worst case. An auditor should accept all what you included in your risk registry, but you will have to explain what you did to come to this registry and how you di dit. It s your security that counts, not the way how the auditor thinks it is. Note : The Asset-Threat-Vulnerability method is only one possible approach for risk analysis. -
Access control
Answer: The system owner, be it business or IT, has to define the access rights fo users and approve how this will be implemented. There is however no team needed for this task.
The person defining and assigning the access rights should make sure segregation of duties is achieved between 1) the person(s) who performs the activity and 2) the person who verifies if the rules were complied with. -
Question regarding the procedure for document and record control
I'll have to answer in 3 parts:
1) There are a couple of mandatory documents and records which must be controlled within your ISMS - you can see this list of documents in this article: List of mandatory documents required by ISO 27001 (2013 revision) https://advisera.com/27001academy/knowledgebase/list-of-mandatory-documents-required-by-iso-27001-2013-revision/
2) The documents from your customer projects do not have to be controlled as ISMS documents - you can define your own rules, which can be different from ISMS document control rules.
3) Classification and labeling is not a mandatory control (although in practice it is highly recommendable), you have to perform it only if you have contractual or regulatory requirements and/or if you have unacceptable risks. You can perform classification and labeling to both the documents that must be controlled, and to documents that are not controlled within your ISMS - the scope of classification and labeling is something you have to define on your own. This article can also help you: Information classification according to ISO 27001 https://advisera.com/27001academy/blog/2014/05/12/information-classification-according-to-iso-27001/ -
ISO 22301 and ISO 31000
Answer: ISO 22301 and ISO 31000 are not very similar. ISO 31000 gives you the guidelines to develop risk management system for any type of risk on a corporate level. ISO 22301 defines the requirements for developing business continuity, including Business continuity policy, business impact analysis, business continuity strategy, planning, and much more. However, these two standards are very compatible - ISO 31000 provides guidelines for risk assessment which is required in ISO 22301, but not covered into detail.
2. What are the pitfalls of developing a basic BCMP first (incl identifying the biggest risks and associated action plans & crisis recovery process & procedures), and then developing a full blown BCMS & pursue certification second? Background: our company is ISO9001 and RC14001 certified already.
Answer: I'm not sure what you mean by "BCMP", but I assume you refer to BCP (Business Continuity Plan). The pitfall of develop ing the BCP without the BCMS is that you won't have the management part of your business continuity: management support, defining requirements, setting the objectives, providing resources, controlling documents, measuring success, etc. In other words, you would have business continuity that would probably set completely out of context, with no understanding from the business part and no way to control it.
So if you develop your BCP first, and then the rest of the BCMS, chances are you would have to redo the whole BCP again. -
Question on clause 9
As far as I understand is we have to select few areas (of our choice and appropriate to bank's business) like BCP, Incident Management, Document review, etc. Then we need to assign some statistical parameters to evaluate the efficiency (in terms of success/failure %). Finally periodically analyze the results to get a trend or efficiency of implementation.
However, I wanted an expert's advice on all points of "Clause 9.1 Monitoring, measurement, analysis and evaluation" so that nothing is missed during external audit. If you can explain me in detail and help me with any working paper, I would be grateful to you.
Answer: If you are certified, all the ISMS processes should be monitored and measured (and continually improved), along with the most important controls (the ones that counters the highest risks) or that are required by your national bank) regulatory entity. The ones you propose are possible candidates, if they meet these conditions. If not, youre wasting your time and money.
Until now, ISO hasnt provided much usable input for this. It is expected that it will rapidly change. The objective of (future) ISO27004 will be to help organisations to a) monitor and measure information security, b) to monitor and measure the effectiveness of the management system and its processes, c) analysing and evaluating the results. Current draft could become CD in October and be published by end of 2015 or begin 2016.
You should find more input in this seminar: ISO 27001 and ISO 27004: How to measure the effectiveness of information security?
https://advisera.com/27001academy/webinar/iso-27001-iso-27004-measure-effectiveness-information-security-free-webinar/ -
Risks of external email service provider
I'm not sure what this external email service provider is doing for you, but I assume they are sending emails to certain email lists on your behalf.
The risks I see are the following:
1) They could sell your email list to someone else
2) They could send your emails to wrong people
3) They could delay sending emails or not send emails at all
I'm not sure what would be the impact of these risks for your company, this is something you would have to assess on your own.
This might also help you: A catalogue of threats and vulnerabilities: https://www.infosecpedia.in**************************