Search results

Home / Search

Category:
Select
Select

11272 results

Guest

Guest

Create New Topic As guest or Sign in

HTML tags are not allowed

Select

Assign topic to the user

  • Controls in new ISO 27001

    I love how this blog celebrates diversity and inclusivity It's a reminder that we are all unique and should embrace our differences

  • ISO/IEC 27001 Implementation

    It’s not our policy to make recommendations about external tools.

    In terms of Advisera products for ISO 27001 implementation we can mention:
    - ISO 27001 documentation toolkit, a set of document templates you can use to implement the standard
    - Conformio, a cloud-based software solution that can help you implement and operate an Information Security Management System compliant with SIO 27001.

    For further information, see:

    • Toolkits vs. Conformio – Which is more applicable for my company? https://advisera.com/articles/toolkits-vs-conformio-which-is-more-applicable-for-my-company/
    • Conformio (online tool for ISO 27001) https://advisera.com/conformio/
    • ISO 27001 Documentation Toolkit https://advisera.com/27001academy/iso-27001-documentation-toolkit/

  • Change control document

    Please note that at beginning of section 3 Change management, you can adapt the following text:

    “Each change to operational or production systems must be made in the following way:” replacing “change to operational or production systems” to the scope of change you want to cover, like:

    “Each change to software, virtual machines, and technological and development environments must be made in the following way:”

    In case you need to write a more detailed document, e.g., for including specific activities for each type of change, you can schedule a meeting with one of our experts so he can help you develop the document. To schedule a meeting please access this link: https://advisera.com/contact/

    For further information, see:

  • Merging ISO 9001 & ISO 17025

    Whether you apply for the laboratory’s accreditation with Option B depends on your organizational structure and whether ISO 9001 applies to just the laboratory, or to other departments in the organization. Have a look at the Q&A at https://community.advisera.com/topic/implemention-of-iso-17025/ for more information and links.

    If you choose option B,  ensure that the laboratory activities and ISO 17025 requirements covered in the ISO 9001 processes and procedures are met sufficiently. You should identify this through a gap audit.  

  • Is ISO 27001 certification relevant for us?

    Please note that ISO 27001 can be used to help protect the information in any media, either electronic or physical format.

    Since your business is related to physical records storage, many controls suggested in ISO 27001 Annex A can help you increase the confidence of your customer in your business.

    For further information, see:

  • Some question about certification ISO 27001

    1. On which documents do we have to write the information like “User, Version, Change History etc.”.  In the document “00_Verfahren_zur_Lenkung_von_Dokumenten” is written that this procedure encompasses all documents and records, stored in any possible form – paper, audio, video – if the documents are related to the ISMS. But which documents does it concern exactly?  

    The easiest way to figure out what documents you need to apply control document information is to check which documents you mention in the policies and procedures included in your toolkit.

    For example, in the Secure Development Policy, section 3.3 Secure engineering principles it is mentioned that procedures for secure information system engineering will be issued, so these procedures must contain document control information.

    Please note that user/version / change history is applicable only for documents.

    For further information, see:

    2. Similar question: Which documents have to include the master list and which the incoming mail book?

    First is important to note that ISO 27001 does not require a master list to be created.

    Considering that, in a master list you include information about all documents related to the ISMS scope (e.g., policies, procedures, reports, etc.), while in the incoming mail book you include information about documents from the external origin, like customer and supplier documents, standards, laws, etc.

    3. And then we need to know, which information could be confidential? The entire certification process of the ISMS isn’t confidential but completely public for us.

    First is important to know that you only need to classify information in case you have risks, or legal requirements, demanding the implementation of control 5.12 Classification of information.

    Considering that, based on relevant risks and applicable legal requirements you can define necessary classification levels (and you can even have a single classification level) and criteria to apply then.

    Considering your statement, in case all information in your ISMS is accessible to your employees, but not to external parties, examples of classification levels to be used would be “internal” and “public”.

    For further information, see:

Page 47-vs-13485 of 1128 pages

Didn’t find an answer?

Start a new topic and get direct answers from the Expert Advice Community.

CREATE NEW TOPIC +