Start a new topic and get direct answers from the Expert Advice Community.
CREATE NEW TOPIC +Search results
11275 results
Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
ISO 27001 / Planned intervals
Management review must be performed at least once a year.
By the way, if your top management doesn't care at all about your information security, then you have a serious problem - therefore, a management review shouldn't be just another compliance job, but a serious consideration from the management point of view on how your security is performing.
This article can also help you: Why is management review important for ISO 27001 and ISO 22301? https://advisera.com/27001academy/blog/2014/03/03/why-is-management-review-important-for-iso-27001-and-iso-22301/ -
Context and scope of the ISMS / ISO 27001 v 2013
So we would suggest you avoid the risk analysis or any deep consideration of what if at this stage and concentrate on identifying the issues. Personal data, sensitive customer ideas and IPR, financial information, brand, codebases etc? Therefore consider any existing issues of: recruitment e.g. -
On-line transactions
Answer:
1. Transactions (e.g. financial) are one of the types of services, but the standards does not focus on them. One may of course only think about that, but why narrowing the scope of application services and forgetting issues? I dont think any list will be exhaustive.
Other transactions can be any direct exchange of data, such as credentials for requesting access to a distant system, answers to an line o a poll or survey, uploading files to a cloud server, etc.
2. However, ISO27001:2013 (and ISO 27002:2013 that provides the details of Annex A) doesnt speak about this anymore and widens largely the scope of this control. It relates with all kinds of applications and services that pass over the public service.
Please remember that the title of the clause is System acquisition, development and maintenance.
Some examples of application services: Games, Streaming videos, E-learning, On- line registration and acquisitions, Telephony services, Establishing and managing a radio communication between a control tower and an aircraft.
Best regards
Jean-Luc -
Managing records
Answer: I'm not sure what exactly would you like to specify in this procedure, but ISO 27001 requires you to specify how the records are stored and protected, how the changes are controlled, how long they are kept, how are they disposed of, etc. - our Procedure for Document and Record Control suggests that all these requirements are described in other policies and procedures which require the creation of certain records. -
ISO 27001 Controls Effectivenes Measurement
Hi Kaoutar
You only have to implement the controls that are required by the risk assessment/treatment. (ISO27001:2013 only list 114 controls).
However, ISO 27001 doesnt require to measure and monitor all controls. You have to decide which are important to you to achieve your business objectives and control your risks (your security objectives).
2. The selected controls should
- be activated
- reach the objective they are aiming to (perform and action, reduce a risk, etc.)
- the objectives you set should always be measurable otherwise you never know they are effective.
The metrics depend on the control. Would you provide us with a pair of examples we can give a closer answer.
Refer to our post: https://advisera.com/27001academy/blog/2012/04/10/iso-27001-control-objectives-why-are-they-important/
Best regards -
Physical security Policy
Hi Vijay
- CCTV is not a requirement in ISO 27001. You should implement this cotnrol when the risk assessment pushes you to it.
- The two issues you present is not an incident, but a non conformity. An incident is 'en event that prevents you from reaching your objectives'.
- I do not really understand what you mean by 'compensating controls' in this case. if you provide more details I'll be able to answer.
Regards
Jaan-Luc -
Access controlAlign IT services continuity with ISO 22301
ISO 24762:2008 is withdrawn (see here: https://www.iso.org/standard/41532.html so ISO 27031 is the most relevant standard now for technology aspect of business continuity. -
Vocalbulary
ESPAÑOL: evaluación de riesgos
What is the difference?
but we have another terms for : ENGLISH accountability, responsible
ESPAÑOL : responsabilidad
What is the difference? Please, can you help me explain how this use it?"
Answer:
I refer here to the ISO definitions (we gathered all risk related definitions from 31000, 27000 and old 27005 in the 2WD 27005).
1a risk evaluation
"process of comparing the results of risk analysis (3.10) with risk criteria (3.13) to determine whether the risk and/or its magnitude is acceptable or tolerable"
NOTE to entry 3.14 Risk evaluation assists in the decision about risk treatment.
[ISO Guide 73:2009, definition 3.7.1] »
1b risk assessment
"overall process of risk identification (3.15), risk analysis (3.10) and risk evaluation (3.14)"
[ISO Guide 73:2009, definition 3.4.1]
So, risk assessment is a meta-process and risk evaluation is an activity/process part of risk assessment.
2. The term Accountability isnt much liked and we find it scarcely in the WG1 documents. It has a much wider meaning than Responsibility.
Responsibility is a generic term associated with a role, like telling which objectives should be reached. Accountability has a financial and legal aspect; if the objectives are not met, the responsible person my be asked to pay in money or with a legal suite. -
Asset owner and risk owner - how exactly are the two differentiated?
I've received this question:
"Regarding the asset owner and risk owner when it comes to people. How exactly are the two differentiated? For example a Network Administrator. Would the asset owner be self and risk owner be department manager?
Answer: I assume you are asking a question related to people as assets in terms of ISO 27001. For Network Administrator, the asset owner would be his direct boss - e.g. the Head of IT department; risk owners should be people who can resolve particular risks - e.g.:
risk of performing wrong activities because of non-existing rules - risk owner could be Head of IT department risk of performing wrong activities because of lack of training - risk owner could be Head of HR department
This article can also help you: Risk owners vs. asset owners in ISO 27001:2013 https://advisera.com/27001academy/knowledgebase/risk-owners-vs-asset-owners-in-iso-270012013/ -
Involving the management in the BCP process
The main issue was involve all the management in the process. In addition, the turn over and the time management were challenges that need attention.
Can you tell me how you manage those issues?"
Answer: If you want the management to be involved in your process, they must see clear benefits - otherwise, they won't go along. This article can help you: ISO 22301 benefits: How to get your managements approval for a business continuity project https://advisera.com/27001academy/knowledgebase/iso-22301-benefits-how-to-get-your-managements-approval-for-a-business-continuity-project/
Regarding time management, it is crucial that you set your project properly - this article can help you (it is applicable to ISO 22301 as well): ISO 27001 project How to make it work https://advisera.com/27001academy/blog/2013/04/22/iso-27001-project-how-to-make-it-work/