Search results

ISO 27001 Risk Assessment

1. What would you say counts as existing control and how "secure" does it need to be to lower the risk level? (documented, implemented as a process, etc.?)

“Existing controls” refers to controls that are currently implemented (i.e., documented, implemented as a process, as a technology, etc.), so it is not about “how secure does it need to be”, but “how secure it is” at the moment of the assessment.

For example, for a data loss risk, you can mention that you already have a backup solution implemented (e.g., a software solution).

2. If the already existing controls lower the risk level, which we suppose it does according to your video lessons, then the risk level might be so low that the risk doesn't need to be included in the risk treatment. And if it doesn't need to be included in the risk treatment, then we don't need to implement a control from Annex A to cover this risk? 

Have we understood this correctly? It seems a bit wrong to exclude Annex A controls that actually should be applicable.

If you already have a control implemented, identified during risk assessment, you need to identify this information in the SoA, reporting the associated control as implemented.

Considering the previous example, you need to report in the SoA that control A.12.3.1 Information Backup is applicable and its status is implemented.

For further information, see:

• ISO 27001/ISO 27005 risk assessment & treatment – 6 basic steps https://advisera.com/27001academy/knowledgebase/iso-27001-risk-assessment-treatment-6-basic-steps/

ISO 27001 query

I’m assuming that by DaaS you mean Device as a Service.

Normally, control A.12.4.4 applies only to on-premise servers because these are the servers you fully control. If your risk assessment or requirements ask that both on-premise and cloud servers need to be synchronized, then regardless of the environment or cloud model, to be compliant with control 12.4.4 all servers in the same security domain (i.e., under the influence of the same controls) need to be synchronized to a single reference time source.

Toolkit content

Please note that identification of which activities need to be restored first are done through the business impact analysis (this template can be found in folder 08 Annex A Security Controls >> A.17 Business Continuity >> 02_Business_Impact_Analysis_Methodology)

For a summary of which server or service or process has to be restored first, and related dependencies, you can use the Recovery Time Objectives for Activities template, located in folder 08 Annex A Security Controls >> A.17 Business Continuity >> 03 Business Continuity Strategy.

Security asset inventory

For a smaller company it is much quicker if the assets are listed during the risk assessment process - first the assets are listed, then relate threats and vulnerabilities to those assets. Essentially, the same effect is achieved as you suggested.

For further information, see:
- ISO 27001 risk assessment: How to match assets, threats and vulnerabilities https://advisera.com/27001academy/knowledgebase/iso-27001-risk-assessment-how-to-match-assets-threats-and-vulnerabilities/
- How to handle Asset register (Asset inventory) according to ISO 27001 https://advisera.com/27001academy/knowledgebase/how-to-handle-asset-register-asset-inventory-according-to-iso-27001/

Query on SOC 2 certification

Considering the 45 templates in the ISO 27001 Documentation Toolkit, roughly 80% of the documents can be used to support a SOC 2 certification.

This article will provide you a further explanation about ISO 27001 and SOC2:

• Comparison of SOC 2 and ISO 27001 certification https://advisera.com/27001academy/blog/2021/02/02/iso-27001-vs-soc-2/

Privacy by design and privacy by default

Data Protection By Default and By Design is one of the key principles in GDPR, as stated by Article 25 and recital 78 (Appropriate Technical and Organisational Measures). Article 25 GDPR actually focuses on the implementation of the data protection principles stated in Article 5 GDPR through a proactive approach. It mentions that “the controller shall, both at the time of the determination of the means for processing and at the time of the processing itself, implement appropriate technical and organizational measures, such as pseudonymization, which are designed to implement data-protection principles, such as data minimization, in an effective manner and to integrate the necessary safeguards into the processing in order to meet the requirements of this Regulation and protect the rights of data subjects”. Thus, according to Article 25 GDPR, data protection must be thought of as ex-ante.

Privacy by design is a concept first mentioned in 1995 by Ann Cavoukian, former Information & Privacy Commissioner, Ontario, Canada, and it encompasses 7 principles:

Conformio - acceptance of residual risk in reports

The residual risk is accepted in the Risk Register module, in the risk treatment step. After the definition of the risk treatment option and selection of applicable controls, the residual risk is automatically calculated and approved by the risk owner.

Additionally, in the Risk Assessment and Treatment Report, the accepted residual risks are listed, and in the Statement of Acceptance of Residual Risks, there is a summary of the accepted residual risks and their respective risk owners. These documents can be found in the Documents module, ISO 27001 folder, Lists Reports Statements, and Plans sub-folder.

MVP

According to the MDR, Article 8 - Use of harmonized standards, it is the manufacturer's obligation to prepare and manufacture their medical device according to the harmonized standards published in the Official Journal of the European Union. On that list is more than 300 different standards considering how the certain medical device must be prepared, The only standard that is on that list considering the quality management system is ISO 13485:2016. Therefore, ISO 13485 is necessary to be implemented.   

For more information, see: 
EU MDR Article 8 – Use of harmonised standards - https://advisera.com/13485academy/mdr/use-of-harmonised-standa

Query on Classification of ISMS

First is important to note that the term “audit point” does not exist in the ISO audit context, and assuming that by “audit point” you mean a list of deficiencies, not nonconformities, the closest term for an ISO audit would be observation.

In this case, it is possible to take advantage of a QMS internal audit to check the status of observations raised in the last ISMS audit.

You can do that when reviewing the status of previous QMS nonconformities. You only need to take care in planning the audit to consider this as a separate activity of the QMS internal audit, so you can plan the necessary time for the QMS internal audit.

An additional reminder is that you cannot include any information about the ISMS observations in the QMS report. The best approach would be for you to perform a QMS and ISMS integrated audit (this is possible because ISO 27001 and ISO 9001 share compatible internal audit requirements.)

5 Core Tools in IATF

As you know, these 5 core tools are APQP-PPAP-FMEA-SPC and MSA.

I am stating the item numbers of the IATF 16949:2016 standard and the relevant core tools below.

• PPAP: 7.1.3.1-7.5.3.2.2-8.3.4.4-8.3.6.1-8.5.6.1-8.6.1
• MSA: 7.1.5.1.1-9.1.1.2-9.1.1.3
• All Core tolls: 7.2.3-7.2.4-9.2.2.2
• APQP: 7.5.3.2.2- 8.1.1-8.2.3.1.3-8.3.2.1-8.3.4.1-8.3.4.2-8.3.6.1-8.5.6.1-9.1.1.2-10.2.4
• FMEA: 7.5.3.2.2-8.3.2.2-8.3.3.3-8.3.5.1-8.3.5.2-8.5.1.1-8.5.6.1-8.7.1.4-8.7.1.5-9.1.1.1-9.1.1.2-9.2.2.3-10.2.3-10.2.4-10.2.6-10.3.1
• SPC: 8.2.3.1.3-8.3.5.2-9.1.1.1-9.1.1.2-9.1.1.3