Start a new topic and get direct answers from the Expert Advice Community.
CREATE NEW TOPIC +Search results
11294 results
Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
Can ISO 27001 and ISO 22301 be used together in a document?
Answer: It is not clear about which document you are talking about, but some documents in the ISO 27001 & ISO 22301 Premium Documentation Toolkit are common for both ISMS and BCMS (e.g., Document control procedure and Internal audit Procedure), or can be used to support both systems, so it is possible to use them for both systems.
Included in your toolkit there is a List of Documents file which shows which clauses of both standards are covered by each document. Another way to identify this common use is by the commentaries included in each template. Some comments specifically identifies which text can be adjusted so the document can cover both standards.
For further information about integrating ISO management systems, please read:
- How to implement integrated management systems https://advisera.com/27001academy/blog/2015/10/05/how-to-implement-integrated-management-systems/
- ISO 27001 & ISO 22301: Why is it better to implement them together? [free webinar on demand] https://advisera.com/27001academy/webinar/iso-27001-iso-22301-better-implement-together-free-webinar-on-demand/ -
Questions about documents
Answer: I'm assuming you are referring to the Website Privacy Policy.
Considering that, this template is part of the following toolkits:
- EU GDPR & ISO 27001 Integrated Documentation Toolkit
- GDPR Mini Toolkit for Websites
- EU GDPR Premium Documentation Toolkit
The document in the EU GDPR Premium Documentation Toolkit can be customized by you to fulfill your needs related to ISMS/BCMS. The document included in the EU GDPR & ISO 27001 Integrated Documentation Toolkit already has the adjustments to be compliant with ISO 27001.
Second question: Can I use ISO 27001/22301 documents for BOTH ISMS and BCMS, referencing both ISMS and BCMS in the same document?....or must I use the documents for one or the other, but not both?
Answer: Some documents in the ISO 27001 & ISO 22301 Premium Documentation Toolkit are common for both ISMS and BCMS (e.g., Document control procedure and Internal audit Procedure), or can be used to support both systems, so it is possible to use these documents for both systems.
Included in your toolkit there is a List of Documents file which shows which clauses of both standards are covered by each document. Another way to identify this common use is by the commentaries included in each template. Some comments specifically identify which text can be adjusted so the document can cover both standards.
For further information about integrating ISO management systems, please read:
- How to implement integrated management systems https://advisera.com/blog/2015/10/05/how-to-implement-integrated-management-systems/
- ISO 27001 & ISO 22301: Why is it better to implement them together? [free webinar on demand] https://advisera.com/27001academy/webinar/iso-27001-iso-22301-better-implement-together-free-webinar-on-demand/ -
Sizing information security and cyber security team
We've received additional question:
>Gracias por su información, lo que me lleva a la siguiente interrogante: Se aplica igual para entidades bancarias?
>(Thank you for your information, which leads me to the following question: Does the same apply to banks?)
Answer:
The general idea also applies to financial industries, but since it is a highly regulated industry, you should verify if there are any regulations about specific roles to be fulfilled (e.g., for EU GDPR you have to designate a Data Protection Office - DPO). -
Risk assessment approach
Per this article ISO does not recommend asset based risk assessment, so why are you selling documentation based on old format.
Do you have any documentation based on new format?
Answer: Sorry, but I think there is a misunderstanding here
ISO 27001:2013 in fact does not require the use of an asset-threat-vulnerability approach for risk assessment anymore, but this does not mean that it is not recommended, only that organizations can adopt other approaches they consider are better suitable for them. They still can use the asset-threat-vulnerability approach if they want, and since this is still the most popular and the most optimal way to implement risk assessment we decided to keep it in our documentation. -
Quality control responsibilities
Answer
You may not manufacture anything, but you buy relevant inputs and you provide some kind of service. So, your quality control responsibilities should include incoming materials or services and service provision.
The following material will provide you more information about quality control:
ISO 9001: Requirements for the release of the product or servisse - https://advisera.com/9001academy/blog/2017/03/28/iso-9001-requirements-for-the-release-of-the-product-or-service/
How to control outsourced processes using ISO 9001 - https://advisera.com/9001academy/blog/2015/05/05/how-to-control-outsourced-processes-using-iso-9001/
Making the best out of ISO 9001 Quality Plan - https://advisera.com/9001academy/blog/2015/12/08/making-the-best-out-of-iso-9001-quality-plan/
ISO 9001 document template: Quality Plan - https://advisera.com/9001academy/documentation/quality-plan/
- Enroll for free course - ISO 9001:2015 Foundations Course - https://advisera.com/training/iso-9001-foundations-course/
- book – Discover ISO 9001:2015 Through Practical Examples – https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/ -
Developing and implementing standards
Answer
Perhaps she is interested in you to search for the process used by ISO to develop or update standards, and about how an ISO management system can be implemented.
The following material will provide you more information about implementing an ISO management system:
ISO 9001 Requirements and Structure - https://advisera.com/9001academy/knowledgebase/iso-9001-requirements-and-structure/
Free webinar on demand - Free webinar – Overview of ISO 9001 implementation steps - https://advisera.com/9001academy/webinar/overview-of-iso-9001-implementation-steps-free-webinar-on-demand/
- Enroll for free course - ISO 9001:2015 Foundations Course - https://advisera.com/training/iso-9001-foundations-course/
- book – Discover ISO 9001:2015 Through Practical Examples – https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/ -
ISO 27001 ISMS objectives
Thank you! I will review and, if I may, ask more questions. We are building a board-level decision support system based on a combination of a bespoke DBMS and Bayesian Networks to help board members/trustees sleep at night knowing that they meet global fiduciary standards. While the application is not as complicated as managing the details of conformance home like to ISO 27001, it's use of AI puts us out on the new horizons territory! -
ISO 27001 implementation challenge
Answer:
The challenge for each organization varies according these variables:
- Knowledge about the standard
- Lack of know how for implementing the standard
- Level of top management support and commitment to the implementation project
- Available resources (e.g., equipment, money, etc.) for the implementation
- Time to implement the project
- Time the project team can dedicate to the project tasks
In our experience the most challenging variables are the top management support and commitment, and the knowledge about the standard, and these are the main reasons we developed materials and that we provide expert support to organizations which want to implement ISO 27001.
These articles will provide you further explanation about ISO 27001 implementation:
- ISO 27001 implementation checklist https://advisera.com/27001academy/knowledgebase/iso-27001-implementation-checklist/
- 4 crucial techniques for convincing your top management about ISO 27001 implementation https: //advisera.com/27001academy/blog/2016/09/12/4-crucial-techniques-for-convincing-your-top-management-about-iso27001-implementation/
These materials will also help you regarding ISO 27001 implementation:
- Book Secure & Simple: A Small-Business Guide to Implementing ISO 27001 On Your Own https://advisera.com/books/secure-and-simple-a-small-business-guide-to-implementing-iso-27001-on-your-own/
- Free online training ISO 27001 Foundations Course https://advisera.com/training/iso-27001-foundations-course/
- ISO 27001 Documentation Toolkit https://advisera.com/27001academy/iso-27001-documentation-toolkit/ -
Plans and procedures for teleworking
Answer:
For small organizations normally there is no need to develop plans and procedures. It should suffice to identify rules on the Mobile Device and Teleworking Policy itself.
As for large organizations, or if small organizations decide to use plans and procedures, examples would be backup procedure, software installation procedure (including anti-virus software), procedure for data exchange, etc.
Please note that these plans and procedures do not need to be documents specifically for teleworking. You can make reference to documents already used inside your organization. For example, the Security Procedures for IT Department included in your toolkit, in folder 08 Annex A Security Controls A.12 Operations Security covers most of the activities required by the Mobile Device and Teleworking Policy. -
Toolkits and PCI-DSS certification
Answer:
We're not experts in PCI DSS, but generally we recommend ISO 27001 documentation toolkit as a way to contribute to achieve PCI compliance, because PCI-DSS has some requirements that can be fulfilled by ISO 27001 controls from Annex A, such as access control policy.
These articles will provide you further explanation about PCI DSS and ISO 27001:
- PCI-DSS vs. ISO 27001 Part 1 – Similarities and Differences https://advisera.com/27001academy/knowledgebase/pci-dss/
- PCI-DSS vs. ISO 27001 Part 2 – Implementation and Certification https://advisera.com/27001academy/knowledgebase/pci-dss/
These materials will also help you regarding ISO 27001 implementation:
- Book Secure & Simple: A Small-Business Guide to Implementing ISO 27001 On Your Own https://advisera.com/books/secure-and-simple-a-small-business-guide-to-implementing-iso-27001-on-your-own/ d-simple-a-small-business-guide-to-implementing-iso-27001-on-your-own/
- Free online training ISO 27001 Foundations Course https://advisera.com/training/iso-27001-foundations-course/