Search results

Home / Search

Category:
Select
Select

11295 results

Guest

Guest

Create New Topic As guest or Sign in

HTML tags are not allowed

Select

Assign topic to the user

  • ISO 27001 Risk Register

    You should include in your ISMS scope only the assets that you control - e.g., physical servers, software, and data; you should keep out of the scope assets you cannot control - data center building, telecom links, UPS, air conditioning, etc. 

    You will assess the risks in the following way: 

    • For the assets within the scope - by listing the assets, and their related vulnerabilities and threats. 
    • Since assets of your suppliers (data center) are outside of your scope, you will perform a risk assessment on the level of a particular supplier - by listing vulnerabilities and threats to their service. 

    You should perform all those assessments using the Risk Register in Conformio.

  • Training Register

    So we use the training module in Conformio as a repository for records of all training done for employees of the company. There is no other feature in it other than for record keeping. 

  • Did ISO 27002 have any update between v2013 and v2022?

    Between 2013 and 2022 no updates were published, only some minor corrections.

    For details about these corrections, please, see:

    • Corrigendum 2014 https://www.iso.org/standard/66806.html
    • Corrigendum 2015 https://www.iso.org/standard/69379.html

    • Queries on Risk register

      1 - Another question I have is regarding the server portion of the risk register, which is found, for instance, in IT and communication equipment. How should this part be defined from a general standpoint? We have added several assets that were relevant to our organization; for example, we have added AWS Infrastructure, Google Infrastructure, Office IT Infrastructure, and Microsoft Infrastructure. Would you kindly help us with this? Therefore, do we need to define this as an infrastructure as a whole or do we need to add different assets that are applicable to the organization? 

      Please note that additional assets would be required only if you need more detailed information to manage risks related to specific assets. 

      For smaller companies we suggest not adding additional assets, to keep things simple. 

      If you need more detailed information, please see the examples below. 

      If your Google Infrastructure is used by two different business units, Sales and R&D, then maybe you should add specific assets like “Google Infrastructure – Sales Servers” and “Google Infrastructure – R&D Servers” so you can handle related risks in different ways.

      Laptops are another example. If laptops from Sales and R&D have different risks, then you should consider creating assets like “Sales laptops” and R&D laptops”, so you can handle specific risks for each asset.

      For further information, see:

      2 - Another issue is that third-party off-the-shelf applications are available for software and databases in a Risk Register. Since we use third-party programs like Phabricator, Microsoft Office 365, container hosts, virtual machines, containers, Jenkins, and virtual machines (Windows), we must decide whether to define each one specifically or to categorize them in general terms with a single category as Infrastructure. Could you please explain to me how we should define? 

      Could you kindly let me know if we need to define different categorized products with Assets and then specify with the vulnerabilities associated to that specific asset in the Risk register for internally developed software?

      Please note that the use of one or more categories will depend on the assessed risks. In case the assets are related to the same risks, then they can be combined in a single category. In case there are assets with specific risks, then you should consider grouping them in different categories, so you can treat the different risks as the best fit.

    • Documents monitoring KPIs regarding applicable controls

      In Conformio, performance indicators can be found in the “Reporting Dashboard” link, accessible through the left-side panel on the main screen. The bottom section of the dashboard is “ISO 27001 Performance Dashboard”, and through the button “View more stats”, you can find details about the Fulfillment of objectives. A report with the objectives is exported automatically when you fulfill the tasks “Enter the measurement related to the objective… ”. The pdf file that will be available in the “Documents” >> “ISO 27001” >> “Lists Reports Statements and Plans” link, accessible through the left-side panel on the main screen.

      In our ISO 27001 toolkits, performance indicators can be recorded in the Measurement report, which can be found in folder 12 Management review.

    • Ransomware recovery plan

      You can develop a business continuity plan for a ransomware event by using the Business Continuity Plan template, and related appendices. These templates are included in folder 10 ISO 22301 Core Business Continuity Documents.

      The ransomware recovery plan is basically the same as a recovery plan for some other scenarios and you should use the Disaster Recovery Plan for that purpose.

      Common practices to be considered for a business continuity plan for ransomware are:

      • format and reinstall of affected servers
      • recovering data from backups

      Additionally, some preventive actions should be considered:

      • Training and awareness sessions about ransomware, to be included in the Training and awareness plan, located in folder 10 Training and awareness
      • Event monitoring, to be included in the Secure procedures for IT department, located in folder 9 Annex A Security controls
      • Patch management, to be included in the Secure procedures for IT department, located in folder 9 Annex A Security controls

      For further information, see:

Page 41 of 1130 pages

Didn’t find an answer?

Start a new topic and get direct answers from the Expert Advice Community.

CREATE NEW TOPIC +