Start a new topic and get direct answers from the Expert Advice Community.
CREATE NEW TOPIC +Search results
11268 results
Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
Using the results from BIA Questionnaire for calculating MTPD
I've received this question: In the following example on BIA, MTPD 2 hrs 4 hrs 24 hrs 48 hrs 1 week 2 weeks a. Impact on people, health & safety 1 1 1 1 2 3 b. Impact on environment 1 1 2 3 3 3 c. Impact on reputation 1 1 1 2 2 3 d. Impact on service performance delivery 1 1 2 2 3 4 e. Business impact 1 1 2 2 3 4 1= marginal impact, 2=acceptable impact, 3=high impact, 4=catastrophic impact MTPD = 36 hours (?) this will be used to work on RTO with consideration also on dependencies. What about the rest of the MTPD under the other items, a, c, d, e? Are they taken into consideration with the overall MTPD? Answer: Yes, judging from this BIA Questionnaire, MTPD for this activity will be between 24 hours and 48 hours because in question b. this is where the assessment "3" has appeared for the first time. Whether it will be closer to 24 hours or closer to 48 hours is a matter of discussion with the responsible person from this activity. The rest of the answers (a, c, d and e) are not relevant because they are not so time critical - you always have to take the answers that are the most time critical. -
Is ISO 27001 risk assessment good enough for BCM?
Answer: If the information security risk assessment took into account all the risks related to confidentiality, integrity and availability of information, then the chances are adjustments won't be necessary because the purpose of business continuity risk assessment is to find out potential risks related to continuity of operations, which is in most cases nothing else but availability of information. You can read more about this topic here: Can ISO 27001 risk assessment be used for ISO 22301?
I admit there are some exceptions to this rule - e.g. if you have certain equipment which does not contain information (e.g. in the manufacturing process) - this is where additional risk assessment should be made. -
Do I have to purchase ISO standard for the certification?
Answer: I'm not sure to which ISO Code of Practice do you refer to, but if you are implementing e.g. ISO 27001, it will be difficult to explain to the certification auditor that you don't have a (legal) copy of the standard that you just implemented. -
Which documentation to show to certification auditor
Answer: You should show all your documents related to your ISMS/ISO 27001.
Our Documentation Toolkit contains both mandatory documents required by ISO 27001 and non-mandatory documents - you have to produce all the mandatory documents, and choose whether or not to produce non-mandatory documents. In the Toolkit you have a file called "List of Documents" which specifies which documents are mandatory and which are not. -
risk assessment and controls
May,
You have to identify all the risks, even though you have implemented a control for some of them - it is true that in such cases the likelihood will be low, but the risk still exists.
If the value of such risk turns out to be acceptable, then of course you won't have to treat the risk; it some cases it might happen that such risk is still unacceptable (because the existing control is not enough), so you will have to apply some additional controls. -
Business countinuity plan
The easiest way is to use one recovery plan per department - e.g. your IT department will have one recovery plan (this plan will include all your IT systems), your marketing department should have its own recovery plan, your human resources department should have their recovery plan, etc.
The point is, you should recover not only your IT department and IT systems, you should recover also your business activities. -
Making mistakes in documents because of an auditor
Answer: My opinion is that you shouldn't make intentional mistakes because of the following reason: you should implement information security/ISO 27001 because you want to increase the level of your security; you shouldn't implement it to satisfy your auditor.
Besides, the auditor will find enough nonconformities anyway. -
Procedure for document and Record control
Todd,
This needs to be in the procedure because ISO 27001 explicitly requires to control the external documents.
Examples of such external documents may be technical documentation, confidential client documents, contracts, etc. - it is very important to control all such documents. -
Records of Management Decisions
Todd,
Management decisions can be documented in several forms - from ordinary email all the way to written document called "Decision xyz". We do not have a template for such decisions because their form varies greatly from company to company, and really for a smaller company no particular form is needed - as I mentioned, if your CEO sends an email saying he has decided something, this is a management decision documented in a perfectly acceptable form.
The only template we do have are the Management Review minutes - you can find them in the folder #10 of our Toolkit. -
Risk register vs. risk treatment table
Answer: The term "Risk register" does not exist in ISO 27001, however this term is commonly used in some countries for the results of the risk assessment - basically, this is a list of your risks - in our Toolkit this would be the Risk assessment table.
Risk register is usually not the same thing as Risk treatment table, however since Risk register is not an official term, some companies are using it for risk treatment as well.