Search results

ISO 22301 templates update

Good morning, as you know, buy the package of documents for 27001 and 22301.

Since October, version 22301 2019 is already available, can you please confirm if you plan to update the documents that have changed or if, on the contrary, it will remain in the purchased version?

We are working on the updates of ISO 22301 templates, and as soon as we finish the updated versions they will be sent to all customers who purchased the toolkit within last 12 months, without charge.

Access control policy

Great answer by referring to exactly where the topic document can be found with content. 👍

Supplier compliance

First is important to note that being compliant is different than being certified.

If an organization fulfills ISO 27001 requirements then it is ISO 27001 compliant.

If an organization is ISO 27001 certified, it means that an accredited certification body has independently verified that the organization fulfills ISO 27001 requirements.

Considering that, since the UK office is not included in the certification, you should audit this office, by using your own auditors or a third-party auditor in your behalf, to verify if the UK office is ISO 27001 compliant.  

Frame time for non conformity closing

Please, can you elaborate a little bit more?

Thank you.

Environmental action, hazards and risks for oil and gas company

Any meaningful environmental action should start with a complete environmental survey to determine and assess environmental aspects and impacts. Impact assessment will allow an organization to define priorities for environmental action. Each organization, based on location, based on interested parties, based on each country or economic zone regulation, based on its own experience and history will have its own environmental hazards and risks.

The following material will provide you more information about aspects and impacts:

- 4 steps in identification and evaluation of environmental aspects - https://advisera.com/14001academy/knowledgebase/4-steps-in-identification-and-evaluation-of-environmental-aspects/
- Environmental aspect identification and classification - https://advisera.com/14001academy/blog/2019/08/27/key-iso-14001-benefits-to-customers/nowledgebase/environmental-aspect-identification-and-classification/
- Free webinar - Free webinar - ISO 14001: Identification and evaluation of environmental aspects - https://advisera.com/14001academy/webinar/iso-14001-identification-and-evaluation-of-environmental-aspects-free-webinar-on-demand/
- Enroll for free in this course – ISO 14001:2015 Foundations Course - https://advisera.com/training/iso-14001-internal-auditor-course/
- Book – The ISO 14001:2015 Companion - https://advisera.com/books/the-iso-14001-2015-companion/

Signature in the Advisera's Documentation

Please note that ISO 27001 requires that documents must be approved, and the organizational information presented in the templates only identifies who was involved in the creation and approval process.

Signing the document, either physical or electronic, is one way to ensure it was approved by authorized person, but if you can provide another way to ensure this proper approval you can delete the parts of the text about signature.

For example, for electronic documents, if you use a document management system (DMS), most probably it has an approval feature that can be used to evidence proper approval.

For physical documents, the use of personalized stamps or seals can substitute the signature.

This article will provide you further explanation about managing documents:
- Document management in ISO 27001 & BS 25999-2 https://advisera.com/27001academy/blog/2010/03/30/document-management-within-iso-27001-bs-25999-2/

These materials will also help you regarding managing documents:
- Managing ISO Documentation: A Plain English Guide https://advisera.com/books/managing-iso-documentation-plain-english-guide/

ISMS risk calculation

The main standard for information security risk management is the ISO 27005, which you can see a preview at this link: https://www.iso.org/standard/75281.html

These articles will provide you further explanation about risk identification and calculation:
- ISO 27001 risk assessment & treatment – 6 basic steps https://advisera.com/27001academy/knowledgebase/iso-27001-risk-assessment-treatment-6-basic-steps/
- ISO 27001 risk assessment: How to match assets, threats, and vulnerabilities https://advisera.com/27001academy/knowledgebase/iso-27001-risk-assessment-how-to-match-assets-threats-and-vulnerabilities/
- How to assess consequences and likelihood in ISO 27001 risk analysis https://advisera.com/27001academy/iso-27001-risk-assessment-treatment-management/#assessment

These materials will also help you regarding risk identification and calculation:
- The basics of risk assessment and treatment according to ISO 27001 [free webinar] https://advisera.com/27001academy/webinar/basics-risk-assessment-treatment-according-iso-27001-free-webinar-demand/
- Book ISO 27001 Risk Management in Plain English https://advisera.com/books/iso-27001-annex-controls-plain-english/

Policy for secure development

Both adjustments can be made in your document, i.e., including reference to control A.14.1.1 in section 2 (reference documents), and add the Secure Development Policy as an implementation method for control A.14.1.1 in the SoA.

Procedure for measurement

ISO 27001 does not require a procedure for measurement, only evidence of the monitoring and measurement results. For this purpose, you can use the template Measurement Result, located in folder 11 - Management Result.

This article will provide you further explanation about monitoring and measurement:
- How to perform monitoring and measurement in ISO 27001 https://advisera.com/27001academy/blog/2015/06/08/how-to-perform-monitoring-and-measurement-in-iso-27001/

RACI Matrix

Please note that the user's roles in a RACI Matrix must be defined according to specified activities (i.e., the same user may have different roles for different activities).

For example, if the activity is "communicate policy publication" users will have the role "informed", while the security officer, for example, will have the role "responsible" (he is the one to communicate the new policy).

If the activity is "follow policy", then programmers and system administrators will have the role "responsible", while the policy owner will have the role "accountable".

This article will provide you further explanation about RACI matrix:
- RACI matrix for ISO 27001 implementation project https://advisera.com/27001academy/blog/2018/11/05/raci-matrix-for-iso-27001-implementation-project/