Search results

Contractual obligations

1 - I hope you are well and don’t mind me reaching out. I am in the process of drafting legal and contractual obligations for the company ISMS and wanted to ask if you would kindly be able to share an example of each?

I’m struggling to find examples online, particularly for contractual requirements and how this should be documented.

I’m assuming that the question is about legal and contractual obligations for suppliers.

Considering that, we are not legal experts, so what we can provide you are statements about what needs to be considered for the drafting of legal and contractual obligations. You should consult a legal expert for him to draft the legal clauses properly.

Here are some examples related to suppliers:

• Right to audit: the organization has the right to audit and test the security controls periodically, or upon significant changes to the relationship.
• Response time to vulnerabilities: provide, in a timely manner, proper treatment for known vulnerabilities that may impact the organization’s business.

Here are some examples related to contracts with employees:

• responsibilities regarding the classification and handling of information and information-related assets
• actions to be taken if security requirements are violated by the involved parties

For further information, see:

• Which security clauses to use for supplier agreements? https://advisera.com/27001academy/blog/2017/06/19/which-security-clauses-to-use-for-supplier-agreements/
• What to consider in security terms and conditions for employees according to ISO 27001 https://advisera.com/27001academy/blog/2018/05/23/what-to-consider-in-security-terms-and-conditions-for-employees-according-to-iso-27001/

This material can also help you:

• Security Clauses for Suppliers and Partners https://advisera.com/27001academy/documentation/security-clauses-for-suppliers-and-partners/

2 - It would also be good to know in your experience, the average number of legal and contractual obligations a medium sized organisation would usually need to have.

Any help would be greatly appreciated.

Please note that there is no number or range to be considered as a reference. The number of legal and contractual obligations to be considered by an organization will depend on the results of risk assessment and applicable legal requirements (i.e., the laws, regulations, and contracts an organization must fulfill).

ISO 27001 applicable legislation

The list in the article:

Laws and regulations on information security and business continuity by country https://advisera.com/27001academy/knowledgebase/laws-regulations-information-security-business-continuity/

will show you laws and regulations related to information security and business continuity in the UK, as well as in other countries, but it does not cover all laws and regulations nor is fully up-to-date because it depends on voluntary contributions from our readers.

To make sure you have the latest list of laws and regulations related to these issues,  it would be best to hire a local legal adviser.

Change Management in Conformio

Rules to manage documents within Confomio are defined in the Procedure for Document and Record Control, section 3.4 Document Updates.

Information about performed changes is recorded in the Change History table included in each document.

Residual risk

1 - In your experience what would you say about multiple risk assessments for in-scope Business units as opposed to one asset-based risk assessment for the company? I ask because I work for a large company with over 3000 employees and it’s hard to do one risk assessment for the entire company as different assets are owned and managed by different teams/Business units, and these even overlap sometimes, e.g. an asset may have multiple owners.

ISO 27001 requires that the risk assessment results are comparable, which means that you need to use the same risk assessment methodology in your whole company (no matter if the company is large or small). Of course, a larger company could perform the risk assessment in several iterations (or sub-projects), but it is important that this is done using a company-wide risk assessment methodology.

2 - How would you determine the residual risk scores after you have implemented the controls to manage risks identified? Do you create another 2 columns for impact and likelihood after the initial impact and likelihood assessment that resulted in the inherent risk scores?

Your assumption is correct. The residual risk must be recorded in different columns, so it can be possible to compare the values before and after control implementation.

For further information, see:

• Why is residual risk so important? https://advisera.com/27001academy/knowledgebase/why-is-residual-risk-so-important/

3 - In terms of scoping the risk assessment you mentioned using our ISMS scope statement, but our scope isn't based on assets but on processes?

Please note that while the proposed risk assessment is based on assets, these assets need to be related to the processes included in the ISMS scope statement, so the risk assessment makes sense to the ISMS.

Non-conforming products

1. who make the "UAI" ?

Is it always necessary to contact the Customer to approve the out-of-spec "dimensions"?

CISO role vs ISO 27001 implementer

In general, a CISO is a seasoned professional that has already been involved in information security management systems implementation (as a team member or project manager). For small companies (up to 50 employees) you can expect a CISO to manage the ISMS implementation. For bigger companies, you should consider designating additional personnel (e.g., other employees or an external consultant) due to the volume of work to be performed.  

About questions for the candidate, you can ask about his previous experience with implementation projects and his suggestion about how to implement it in your organization.  

For further information, see:

• What is the job of Chief Information Security Officer (CISO) in ISO 27001? https://advisera.com/27001academy/knowledgebase/what-is-the-job-of-chief-information-security-officer-ciso-in-iso-27001/
• What to look for when hiring a security professional https://advisera.com/27001academy/blog/2016/02/15/what-to-look-for-when-hiring-a-security-professional/

Implement ISO 27001 & ISO 22301- ISMS and BCMS Manual

Please note that neither ISO 27001 nor ISO 22301 require the development of a Manual, and for good reasons. If you put all the policies and procedures into a single document, this will make their reading very difficult and maintenance more complex.  

Since this is a requirement for a specific market need, we suggest:

• For ISO 27001 you can use the Information Security Policy and the Statement of Applicability as a single document to describe briefly how your company will implement its information security.
• For ISO 22301 you can use the Business Continuity Policy and the Business Continuity Strategy as a single document to describe briefly how your company will implement its business continuity.

This article will provide you with further explanation about ISMS Manual (the same concept applies to BCMS):

• Is the ISO 27001 Manual really necessary? https://advisera.com/27001academy/blog/2014/02/03/is-the-iso-27001-manual-really-necessary/

This material will also help you regarding ISMS documentation:

• Managing ISO Documentation: A Plain English Guide https://advisera.com/books/managing-iso-documentation-plain-english-guide/

Can the same person prepare and review document?

Yes, the person that prepares a document can be the one who reviews it. Please check ISO 9001:2015 clause 7.5.2 c). Can you see any limitation imposing the separation between who prepares and who reviews? There is no such limitation.