Search results

Home / Search

Category:
Select
Select

11271 results

Guest

Guest

Create New Topic As guest or Sign in

HTML tags are not allowed

Select

Assign topic to the user

  • SOA; CONTROL APPLICABLE vs. CONTROL IMPLEMENTED?

    1 - Can you help me explain the implementation of SoA?

    The implementation of SoA, i.e., of the controls identified as applicable, is made according to what is defined in the Risk Treatment Plan, which defines actions, responsible, and deadlines.

    For example, if control A.12.3.1 Information backup is defined as applicable in the SoA, in the Risk Treatment Plan you will define activities like elaboration, approval, and publication of a Backup Policy, and the acquisition and implementation of a software solution to be implemented in your environment.

    For further information, see:

    2 - Is SoA acceptable if not all applicable controls are implemented? (control applicable) are not (control implemented)?

    I’m assuming you are asking about SoA acceptance considering certification purposes.

    Considering that, during a certification audit it can accept that certain controls stated in the SoA as applicable are not implemented if:

  • all the major risks are resolved before the certification
  • in the Risk Treatment Plan it is clearly defined that those controls will be implemented at a later date
  • the risk owners have accepted the risks related to controls that will be implemented later.

    • These materials will also help you regarding Risk Assessment and Treatment:

  • ISO 27005:2018

    If I understood correctly, you want insight into the relevance of ISO 27005 to currently ISO 27001 based ISMS’s.

    Considering that, although the asset, threat, and vulnerability risk identification method are no longer mandatory for ISO 27001, it still continues to be one of the most used approaches, due to its simplicity, so you should keep the ISO 27005 standard in your read list. For other approaches for risk assessment, you should consider also reading ISO 31010, which covers other Risk assessment techniques.

    For further information, see:

  • Protection against abuse of rights

    Additional controls you can consider are access control (i.e., people only have access to what is needed for doing their job), and segregation of duties (i.e., any critical/sensitive task cannot be performed by a single person).

    For further information, see:

  • 04.1_Information_Security_Policy_Cloud_EN

    1. Actually, my concern is not about the cloud document.  the title of the 2 documents is different. In the toolkit it is "INFORMATION SECURITY POLICY" but in the video, it is "INFORMATION SECURITY MANAGEMENT SYSTEM POLICY". I would like to make sure that they are the same documents.

    The two documents are the same. Wherever you find a discrepancy between the videos and the toolkit templates, please consider the templates the most updated versions.

    Furthermore, I see other templates online that have additional content than your document. Should they not be included in this policy as well? 

    If you refer to the top-level Information Security Policy, please note it needs to be short and should not be confused with a more detailed IT Security Policy that is also part of the toolkit. The templates in Advisera's toolkit are designed for smaller and mid-size companies, are fully compliant with the standards, accepted by certification auditors, and are not too lengthy so as not to create an overhead. Of course, feel free to add any further text that you feel would fit well for your company.

  • ISO 27001 package question regarding risk assessment

    If you already have implemented controls you need to take them into account when analyzing the risks, so your understanding is correct. In the Risk Assessment Table, in the last column, you can describe which controls are already implemented.

    For further information, see:

    This material will also help you regarding risk assessment:

  • PESTEL analysis in ISO 14001

    Organizations are not closed systems. External issues are relevant topics that can influence the future of an organization. For example, governments can issue legislation that will affect the activity of an organization. Social trends can influence consumers' or clients’ priorities. You can use the PESTEL analysis to help in systematically determining external issues. After the PESTEL analysis, I recommend collecting positive external issues as opportunities and negative external issues as threats and organizing the information in a SWOT matrix that allows us to determine potential risks and opportunities. Please check these two free webinars where I demonstrate the use of the technique (they are about ISO 9001, but applicable also to ISO 14001):

    The following material will provide you with more information:

  • Conciliation between Iso 13485 and EU MDR

    I want to understand all the requirements of EU MDR and their conciliation with ISO 13485 and FDA 21 CFR

  • Cloud services auditability

    Thanks for this… quite timely too as I am in the middle of undertaking research for a professional doctorate degree in information security. My research is around the auditability - or lack of - of cloud service providers by cloud customers. As a 3rd party assurance consultant we are getting more and more resistance from suppliers/partners of cloud services to audit them. My research aims to review existing cloud audit frameworks and draw out any gaps – and propose a new framework that allows CSP auditability. The proposal is to develop an audit authority that can perform audits of cloud service providers using the proposed framework. The audit reports can then be made available to businesses so they do not have to audit the CSPs themselves. I have contacted the CSA for their input and hoping to get their feedback soon. 1 - Would you happen to have mapping of cloud audit frameworks that highlights common controls and differences? 2 - Also what is your opinion on the Cloud Audit Authority proposal?

  • Implantación SGC

    No, any mandatory documents and records from a clause not applicable to an organization are not relevant to that organization’s quality management system. For example, if clause 8.3 is not applicable, no records from that clause are required.

    Please check the following information:

     
Page 118-vs-13485 of 1128 pages

Didn’t find an answer?

Start a new topic and get direct answers from the Expert Advice Community.

CREATE NEW TOPIC +