Search results for "iso17025 vs gmp"

Home / Search

Category:
Select
Select

1223 results

Guest

Guest

Create New Topic As guest or Sign in

HTML tags are not allowed

Select

Assign topic to the user

  • Access controlAlign IT services continuity with ISO 22301

    We have received this question: "Access control - user vs technical? How do I distinguish the difference in ISO27002? This is regarding ISO27002 - section 9 Access control 9.2 vs 9.4" Answer : The rights are given to users (people) to access information (e.g. physical documents), applications, hardware and locations (buildings and rooms). The correct management of this aspect is covered by clause 9.2. Clause 9.4 covers ‘how’ the access rights should be implemented in the technology to make sure the data on the computer systems (including mobile devices and telephony) are accessed according to the rules fixed by clause 9.2.Is ISO 27031 a good option to align IT services continuity (aka DRP) with ISO 22301 (BCMS)?

  • Asset owner and risk owner - how exactly are the two differentiated?

    ... his direct boss - e.g. the Head of IT department; risk owners should be people who can resolve particular risks - e.g.:
    risk of performing wrong activities because of non-existing rules - risk owner could be Head of IT department risk of performing wrong activities because of lack of training - risk owner could be Head of HR department
    This article can also help you: Risk owners vs. asset owners in ISO 27001:2013 https://advisera.com/27001academy/knowledgebase/risk-owners-vs-asset-owners-in-iso-270012013/

  • Question about ISO 27002


    You don't have to use ISO 27002. ISO 27002 are only the guidelines that are not mandatory; you only have to comply with what is written in ISO 27001. You'll find a more detailed explanation here: ISO 27001 vs. ISO 27002 https://advisera.com/27001academy/knowledgebase/iso-27001-vs-iso-27002/

  • Which assets to assess during the risk assessment


    If all of these 500 applications are within the ISMS scope, they have to assess all of them. However, if you have similar applications then you do not have to perform risk assessment for each of them separately - you can treat all similar applications as a single asset during the risk assessment process.

    See also these articles:
    - ISO 27001 gap analysis vs. risk assessment https://advisera.com/27001academy/knowledgebase/iso-27001-gap-analysis-vs-risk-assessment/
    - How to organize initial risk assessment according to ISO 27001 and ISO 22301 https://advisera.com/27001academy/blog/2014/04/29/how-to-organize-initial-risk-assessment-according-to-iso-27001-and-iso-22301/

  • How to learn about infosec?

    ... 7001.

    2. I am due to go on a foundation course and then the Lead Implementer course and then next year do my Lead Auditors course do you think this is the right way to go?

    Perhaps foundation course would not be needed if you already have some experience in IT - in such case you can go straight to Lead Implementer course. Read also this article: Lead Auditor Course vs. Lead Implementer Course – Which one to go for? https://advisera.com/27001academy/blog/2014/06/16/lead-auditor-course-vs-lead-implementer-course-which-one-to-go-for/

  • Using risks instead of threats

    ... ... otential cause of an unwanted incident, which may result in harm to a system or organization". So for instance, the threat is a computer virus, and the risk is the loss of all the information on your computer.

    It is true that ISO 27001:2013 does not require the identification of threats any more, but this is in my opinion still the best methodology - read more here: Risk owners vs. asset owners in ISO 27001:2013 https://advisera.com/27001academy/knowledgebase/risk-owners-vs-asset-owners-in-iso-270012013/

  • Use old ISO 27001:2005 format for assessing the risks

    ... ... vision of ISO 27001 gives you a greater freedom in performing the risk assessment, but you can certainly use the principle from 27001:2005 where risks were identified based on assets, threats and vulnerabilities. The only thing you have to do extra because of 2013 revision is that you need to identify the risk owner for each risk.

    You can learn more in this article: Risk owners vs. asset owners in ISO 27001:2013 https://advisera.com/27001academy/knowledgebase/risk-owners-vs-asset-owners-in-iso-270012013/

  • ISO 27031 vs ISO 22301

    I am starting a BCP/DR effort here. I have not seen the ISO 27031. Our implementation would be mostly around a SaaS cloud services environment. We just passed our ISO 27K Stage 2 audit. Should I use ISO 22301 or ISO 27031 for BCP/DR guidance? Is there much difference in the two docs?

  • To have or not have a Disaster Recovery Plan

    ... urn to normal operation and this should be planned and documented.
    5) You need to implement a regular test approach in order to evaluate the effectiveness of the solution.
    6) Disaster Recovery Plan would help in case of failure of HA technology.

    You can find a more detailed information on: https://advisera.com/27001academy/blog/2010/11/04/disaster-recovery-vs-business-continuity/

    Hope this helps

  • Certification - RABQSA

    Again, I'm not sure which ISO 27001 certification you are speaking about - are you speaking about the certification of an individual or a certification of a company?

    Here are some articles that can help you:
    - ISO 27001 certification for persons vs. organizations https://advisera.com/27001academy/iso-27001-certification/
    - How to learn about ISO 27001 (this article lists different possible trainings) https://advisera.com/27001academy/blog/2010/11/30/how-to-learn-about-iso-27001-and-bs-25999-2/
Page 121 of 123 pages

Didn’t find an answer?

Start a new topic and get direct answers from the Expert Advice Community.

CREATE NEW TOPIC +