Search results

Home / Search

Category:
Select
Select

11294 results

Guest

Guest

Create New Topic As guest or Sign in

HTML tags are not allowed

Select

Assign topic to the user

  • Risk analysis process

    ISO 27001 does not prescribe how long an organization should take to implement the risk management process, so this time is defined by each organization to fit their needs, but from our experience 3 years is far too much for the risk assessment to be performed. For small companies of up to 50 employees it should be finished within a week or two, and for a company of ca 200 employees this generally takes a couple of weeks, and for a company of 500 employees, this is ca 4 weeks' time.

    This is generally achieved by implementing a risk management process with a simple approach. In case you need something more complex, you should consider this more complex implementation later in the process, so people can become used to the concept of risk management, and you can have identified risks faster.

    For example, you can start risk analysis with a qualitative approach (most based in perceptions, easier to understand, quicker to perform, but less accurate), and after that go for your more complex approach.

     These articles will provide you a further explanation about risk identification:

  • Process diagram

    1. I would like to know if there is an excel template to register a new change.

    ISO 27001 does not prescribe the contents of a change register, but to see an example, I suggest you take a look at the free demo of our Request for Change and Change Record at this link: https://advisera.com/20000academy/documentation/request-for-change-and-change-record/

    For further information see:

    2. And the other thing is about the process diagram. I believe it is essential for that document.

    ISO 27001 does not require the documentation of the change process, but these are the general main steps you should consider:

    • Request change: describe what needs to be changed and purpose
    • Analise change: identify the impacts (positives and negatives) related to the change, and potential risks
    • Approve / Deny change: Authorize, or not, the change.
    • Implement change: Plan the details and implement the change
    • Review / Report change: Verify if the change achieved expected results and communicate the change to relevant parts

  • ISMS scope - Networks and IT infrastructure

    Generally, networks are defined in terms of segments (e.g., administrative network, development network, internal network, etc.), and infrastructures are defined in terms of the most relevant assets (e.g., database server, border firewall, etc.).

    These articles will provide you a further explanation about the scope definition:

  • 5.1 Leadership and commitment

    1. What Template in our Toolkit contains this Clause?

    Please note that leadership and commitment requirements are systemic, not limited to a single document, so they are embedded in several documents in the toolkit such as:

    • Information security policy
    • Training and awareness plan
    • Management review

    For further information see:

    2. Can we be compliant with this clause maintaining our Information Security Policy? If yes, what shall we give emphasis on apart from company Policies and guidelines?

    As mentioned in the previous answer, the Information Security Policy is only one of the documents you need to implement to be compliant with ISO 27001 leadership and commitment requirements.

    Other issues you have to consider are:

    • Determine information security objectives
    • Determine the main responsibilities related to ISMS
    • Communicate the ISMS importance
    • Provide all the necessary resources
    • Perform management review

  • A.18.1.3 Protection of Records

    First is important to note that "ISMS documents" do not refer only to documents required by the standard (such as the Information security policy), but also to any other documents and records your organization sees as relevant to the ISMS defined purpose and objectives, like project specifications, contracts, etc.

    Considering that, in case you identify relevant risks or legal requirements (e.g., laws, regulations, or contracts) demanding the implementation of control A.18.1.3 for these other documents, then you must apply the control to them also.

    In case the documents and records are not related to the ISMS, you still can apply the control, as a good practice, but they will not have an impact on any certification process.

    As for ways of protection of such documentation, some examples are:

    • physical cabinets
    • backup copies
    • digital signatures

    The choice of protection will depend on the risks identified during the risk assessment.

  • Implementation of ISO 27001

    Hello Rhand Leal

    Thank you for your reply. I just wrote one policy. But thanks for your advise and further comments on the subject. Our problem is that the auditor already raised the nonconformity and I don't want to argue with him about this particular policy.

  • Preventive action

    Yes, you can say so.

    For example, risk-based thinking is seen as replacing preventive action in ISO 9001:2015. How does the risk-based approach work? Bearing in mind the objectives to be achieved, we ask: What can go wrong? What can prevent us from meeting them? So, we are not answering to a specific problem, we are answering to a potential non-conformity.

    You can get much more information in the following links:

  • Pricing a consultancy

    To do costing as a project you need to have as much information about the business processes as possible, to avoid an undetailed project that may cause you to underprice your service. The main problem here is not the tasks to be performed and documents to be created, but the effort required to perform them, since as greater the number of processes involved, the greater the effort and the number of documents.

    My suggestion is for you to make a mixed approach:

    • Elaborate a project with the information you have
    • In the tasks you are not sure about the total effort, state an assumption about the effort you expect to have (e.g., elaborate BC plans for 3 business process, interview 2 employees, etc.)
    • Define an hourly rate for additional hours considering all the hours you have for the planned project (normally this will be greater than the project's hourly rate)

    This way, if your assumptions are right, your project is well priced. In case you do not have all the needed information, the higher hourly rate will compensate for your additional effort, and as a bonus, your customers will have more incentive to help you detail the project because additional hours will cost them more than if they are executed as part of the project.

    To help you in your consulting career, I suggest you take a look at our ISO 27001 & ISO 22301 Consultant Toolkit at this link: https://advisera.com/27001academy/consultants/

    These materials will provide you a further explanation about elaborating a project:

  • Equipment Sitting and Protection A.11.2.1

    I am implementing this as we required by our customer, who are Banks. They advise we must adhere to the policies they do as we process their data. Yes we are a small business, only doing small home insurance repairs, however if fulfilling all their requirements means we become one of their preferred suppliers we will do it.

  • Backup policies

    ISO 27001 has a control specific for Information backup (control A.12.3.1 ), but it does not provide details about its implementation. For that, you should consider ISO 27002, a supporting standard that defines guidelines for information backup, such as definitions o backup periodicity, backup test, etc.

    To see how a backup policy compliant with ISO 27001 looks like, I suggest you see the free demo of our Backup Policy at this link: https://advisera.com/27001academy/documentation/backup-policy/

    This article will provide you a further explanation about backup:
Page 406 of 1130 pages

Didn’t find an answer?

Start a new topic and get direct answers from the Expert Advice Community.

CREATE NEW TOPIC +