Search results

Interested Parties

First is important to note that ISO 27001 does not prescribe how to document interested parties, so documenting them by name or by category are acceptable approaches.

But please note that, to fulfill clause 7.4 - Communication, you need to determine with whom to communicate, and depending on the information to be communicated, maybe it will be necessary to identify clients individually in certain circumstances.

This article will provide you a further explanation about interested parties:

• How to identify interested parties according to ISO 27001 and ISO 22301 https://advisera.com/27001academy/knowledgebase/how-to-identify-interested-parties-according-to-iso-27001-and-iso-22301//

These materials will also help you regarding interested parties:

• Book Secure & Simple: A Small-Business Guide to Implementing ISO 27001 On Your Own https://advisera.com/books/secure-and-simple-a-small-business-guide-to-implementing-iso-27001-on-your-own/
• ISO 27001 Foundations Course https://advisera.com/training/iso-27001-foundations-course/

Annex A.17.1/2/3

I'm assuming you are referring only to controls from section A.17.1

Considering that, controls from ISO 27001 Annex A section A.17 (Information security aspects of business continuity management) aims to minimize risks that, in case of an event that disrupts business operations, the information will be kept protected, and operations that rely on them will be resumed as quickly as possible.

To show compliance with controls of this section an organization needs to:

• identify and include information security requirements in its reparations for business continuity
• ensure processes, procedures and controls required for information security are documented, implemented, and maintained
• regularly review its information security continuity elements to ensure its effectiveness and relevance to business

This article will provide you a further explanation about business continuity for ISO 27001:

• How to use ISO 22301 for the implementation of business continuity in ISO 27001 https://advisera.com/27001academy/blog/2015/06/15/how-to-use-iso-22301-for-the-implementation-of-business-continuity-in-iso-27001/

These materials will also help you regarding business continuity for ISO 27001:

• ISO 27001 Annex A Controls in Plain English https://advisera.com/books/iso-27001-annex-controls-plain-english/

Data integrity

1. How can ISO 27001 ensure data integrity in a company that needs to create all its security policies from scratch

ISO 27001 Annex A has controls that can be applied to minimize risks that information is changed or destroyed without authorization (e.g., A.9.1.1 Access control policy, and A.12.1.2 Change management), and that changes performed can be tracked and undone if needed (e.g., A.12.4.1 Event logging, and A.12.3.1 Information backup), thus helping protect information integrity.

For further information, see:

• How to handle access control according to ISO 27001 https://advisera.com/27001academy/blog/2015/07/27/how-to-handle-access-control-according-to-iso-27001/
• How to manage changes in an ISMS according to ISO 27001 A.12.1.2 https://advisera.com/27001academy/blog/2015/09/14/how-to-manage-changes-in-an-isms-according-to-iso-27001-a-12-1-2/
• Logging and monitoring according to ISO 27001 A.12.4 https://advisera.com/27001academy/logging-according-to-iso-27001/
• Backup policy – How to determine backup frequency https://advisera.com/27001academy/documentation/backup-policy/

This material will also help you regarding ISO 27001 controls:

• ISO 27001 Annex A Controls in Plain English https://advisera.com/books/iso-27001-annex-controls-plain-english/

2. is the return on investment of an ISO 27001 project feasible?

ISO 27001 was designed to help organizations apply controls based on relevant requirements and in levels related to their risk tolerance.

Considering that, provided that the ISO 27001 project is aligned to the business' and interested parties' (e.g., customers, regulation bodies, suppliers, etc.) needs and objectives, its return on investment is feasible.

This article will provide you a further explanation about ISO 27001 implementation:

• How to make your investment in ISO 27001 profitable https://advisera.com/27001academy/blog/2015/07/13/how-to-make-your-investment-in-iso-27001-profitable/
• Four key benefits of ISO 27001 implementation https://advisera.com/27001academy/knowledgebase/four-key-benefits-of-iso-27001-implementation/
• Aligning information security with the strategic direction of a company according to ISO 27001 https://advisera.com/27001academy/blog/2017/02/20/strategic-direction-of-a-company-according-to-iso-27001/

IS responsive culture

To develop a security culture you must consider these points:

• definition of clear objectives and targets
• definition of roles and responsibilities
• providing awareness about the importance of information security and the consequences of incidents and non-compliances
• providing training about how to perform required activities
• measure and analyze performance and provide feedback

For further information, see:

• What are the benefits of security awareness training for organizations? https://advisera.com/27001academy/blog/2019/03/27/what-are-the-benefits-of-security-awareness-training-for-organizations/
• How to perform training & awareness for ISO 27001 and ISO 22301 https://advisera.com/27001academy/blog/2014/05/19/how-to-perform-training-awareness-for-iso-27001-and-iso-22301/

This material will also help you regarding awareness and training:

• Free Security Awareness Training: https://advisera.com/training/awareness-session/security-awareness-training/ - this is a series of 25 videos that cover various topics related to security.

ISO 9001 - Management Representative Audit

You are going to audit the Management Representative. An audit is about collecting evidence from the contrast between reality and audit criteria. You should start by collecting the audit criteria. Which documents, in your QMS, mention the Management Representative and its authorities and responsibilities? Then, read that documentation and look for situations that you think you want to check, that you want to confirm. For example, you may read that the Management Representative is responsible for conducting quarterly performance reviews about processes and action plans. You can ask to see evidence that the performance review took place, what its decisions were, and if it has a positive impact on the organizations’ performance. For example, you may read that the Management Representative is responsible for ensuring that corrective actions are implemented, effective, and closed. You can ask to see evidence that shows if corrective actions are defined, implemented, evaluated as effective, and closed.

You can find more information below:

• What will be the destiny of the management representative in the new ISO 9001:2015 - https://advisera.com/9001academy/knowledgebase/what-will-be-the-destiny-of-the-management-representative-in-the-new-iso-90012015/
• Choosing the best person for the job quality management representative: https://advisera.com/9001academy/blog/2014/06/03/choosing-best-person-job-quality-management-representative/
• Free online training ISO 9001:2015 Foundations Course – https://advisera.com/training/iso-9001-foundations-course/
• Book - Discover ISO 9001:2015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/

Are we allowed to change ISMS policies on our own

You can change ISMS policies anytime you identify the need to, but you need to evaluate who will be impacted by the changes, and what the impacts will be, to decide who needs to be informed, and what is the information to be communicated. For example:

• a change in the Information Security Policy needs to be communicated to all personnel
• a change in a Backup Policy, regarding the change in technology, may need to be communicated only to IT personnel
• a change in a Supplier Management Policy may need to be communicated to the organization's suppliers

Personal vs. Generic emails regarding B2B email marketing

A “generic” email address is an email address that does not incorporate personal information (i.e. info@company.com or marketing@company.com ) while a “personal” email address refers to a specific individual (i.e. name.surname@company.com, or n.surname@company.com, or surname@company.com, etc).

Germany and the UK are both ruled by the European Union General Data Protection Regulation 2016/679 which has direct application across all EU. 

In the UK the GDPR will be enforceable until the 31st December 2020 when the Brexit transition period will end and of course, it will continue even after for companies subjected to its application (companies processing personal data of individuals living in the EU). However, UK privacy law has many principles in common with GDPR which has been taken as a model for data protection law across the world.

You can find more information about GDPR and email marketing here:

• Email marketing in the era of GDPR – How to ensure compliance? https://advisera.com/eugdpracademy/blog/2019/05/27/gdpr-and-email-marketing-rules-for-compliant-campaigns/
• How does GDPR impact marketing activities? https://advisera.com/eugdpracademy/blog/2018/02/08/how-does-gdpr-impact-marketing-activities/

ISO IMPLEMENTATION For Start Up Companies

Unfortunately, I can not answer about CMMI. However, I can answer about ISO 9001. Startups, in reality, are not yet companies, they are still projects of companies in search of a successful business model and customer fit. So, a startup is like an experiment being done. The startup can be called a company only after finding the right business model, a customer fit, and when it starts scaling. Only then, the procedures and internal standards are ready to be documented.

You can find more information below:

• Six Key Benefits of ISO 9001 Implementation - https://advisera.com/9001academy/knowledgebase/six-key-benefits-of-iso-9001-implementation/
• What are the benefits of ISO 9001 for your employees? - https://advisera.com/9001academy/blog/2016/06/14/what-are-the-benefits-of-iso-9001-for-your-employees/
• Free online training ISO 9001:2015 Foundations Course – https://advisera.com/training/iso-9001-foundations-course/
• Book - Discover ISO 9001:2015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/
   

ISO 9001 Quality objectives

Check all the promises your organization makes in its quality policy and try to translate each one into a measurable challenge, a quality objective.

You can find more information below:

• How to Write a Good Quality Policy - https://advisera.com/9001academy/blog/2014/03/25/write-good-quality-policy/
• How to Write Good Quality Objectives - https://advisera.com/9001academy/knowledgebase/how-to-write-good-quality-objectives/
• Free online training ISO 9001:2015 Foundations Course – https://advisera.com/training/iso-9001-foundations-course/
• Book - Discover ISO 9001:2015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/