Search results

Home / Search

Category:
Select
Select

11272 results

Guest

Guest

Create New Topic As guest or Sign in

HTML tags are not allowed

Select

Assign topic to the user

  • Operational Security Objectives

    I’m assuming you are referring to the Information Security Policy document.

    Considering that, ISO 27001 is pretty flexible when it comes to defining your security objectives. In this case, when you didn’t have incidents in the year, you can set as an objective 0 incidents, or focus on other objectives.

    This absence of incidents can in fact help to acquire new customers and increase revenue (potential customers will have more confidence to work with you), but please note that keep an objective of 0 incidents is a pretty hard one. 

    Normally 3 to 4 objectives allow an ISMS to support properly the business, for example:

    • one operational objective: system uptime
    • one financial objective: increased revenue
    • one business objective: entering a new market
    • one compliance objective: fulfillment of GDPR

    This article will provide you a further explanation about information security objectives:

    In this free online training, you'll find detailed guidance on setting the objectives:

  • Advisory

    My personal advice, to begin with, you can get a 2-day quality management system and ISO 9001:2015 standard training. If you are going to implement the IATF 16949:2016 system, this training can be 3-4 days. After that, you can review your work with the help of a consultant, and I think this will help you improve. You can get an online consultancy service, like 2 days a month.

    Advisera tool kit helps you with reference documents in the documentation structure, but in my personal opinion, consultant assistance may be needed for a while.

    For more information, see:

  • Register of Legal, Contractual, and Other Requirements

    The content of this register is defined by the interested parties (e.g., top management, customers, suppliers, employees, government agencies, etc.) which are relevant to your information security management system (ISMS), and are usually documented as laws, regulations, contracts, agreements, and other similar documents, which are identified in this document.

    For example, you can have a service contract with your main customers where they require backup to be performed in a certain way and use a defined technology. In this template, you will identify the requirements (backup method and technology to be used), where they can be found (service contract ***), who defined them (customer), and who is responsible for it (e.g., IT manager), and the implementation deadline (e.g., end of October 2021).

    Regarding contracts, you need to consider not only contracts with customers but also with employees and suppliers, i.e., with all parts that are relevant to information security.

    You do not need to list all your customers. You can list only the more relevant ones (e.g., those with the highest values, the strategic ones, etc.), which can be identified by codes to protect privacy.

    If you have signed the same agreements with e.g. customers, you do not need to list each party separately - you can only list them together, e.g. "customers" and specify the security requirements from those standardized agreements.

    This article will provide you a further explanation about requirements identification:
    - How to identify ISMS requirements of interested parties in ISO 27001 https://advisera.com/27001academy/blog/2017/02/06/how-to-identify-isms-requirements-of-interested-parties-in-iso-27001/

  • Basic question on GDPR

    No, there is no international standard that certifies GDPR requirements, although some standards can help you to implement GDPR principles and design correctly policies. I.e,  ISO27001 on information security or ISO17000 on conformity. Therefore, there is no expiration date and you will apply GDPR as soon as it will be enforceable. The previous EU directive had been enforceable for more than 10 years, so the time frame is long.

    In order to verify the requirements to pass the CIPM certification, you should consult the IAPP website.

    Here you can find more information about ISO standards:

    If you want to know how to implement ISO 27001 standards or the EU GDPR, you may consider enrolling in our free online foundations courses:

Page 156-vs-13485 of 1128 pages

Didn’t find an answer?

Start a new topic and get direct answers from the Expert Advice Community.

CREATE NEW TOPIC +