Start a new topic and get direct answers from the Expert Advice Community.
CREATE NEW TOPIC +Search results
11269 results
Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
Scope definition
Is it true that a company can be certified in ISO 27001 only in a part of the organization? That is, for example, only the Systems area?
Answer:
Your understanding is correct. The ISMS scope can cover all organization, or only specific locations, processes or information.
The main point when considering this approach is the effort required to keep the ISMS scope separated from the rest of the organization's elements (for small and mid-sized organizations many times the effort is not worthy, and it is better to include all the organization in the ISMS scope)
These articles will provide you further explanation about scope definition:
- How to define the ISMS scope https://advisera.com/27001academy/knowledgebase/how-to-define-the-isms-scope/
- Problems with defining the scope in ISO 27001 https://advisera.com/27001academy/blog/2010/06/29/problems-with-defining-the-scope-in-iso-27001/
- How to s et the ISMS scope according to ISO 27001 [free webinar on demand] https://advisera.com/27001academy/webinar/how-to-set-the-isms-scope-according-to-iso-27001-free-webinar-on-demand/ -
ISO 27001 systems audit
Answer:
For a better understanding of ISO 27001 controls and how to perform an ISO 27001 system audit, I suggest you to attend this free course:
- ISO 27001 Internal Auditor Course https://advisera.com/training/iso-27001-internal-auditor-course/ -
Implementing ISO 27001
Answer:
ISO 27001 is a standard focused on protection of information, so possible applications of ISO 27001 for this organization (if I understood correctly, it provides physical security services) are:
- protection of sensitive information known by physical security guards about facilities, processes or people from their clients (e.g. through which route will the money be delivered, how it will be protected, and who will be driving), by means of training and employment contract clauses.
- provision of proper physical protection of information of their clients (e.g., equipment and methods for protection of their premises, or during assets transportation, etc.).
These articles will provide you further explanation about potential controls:
- Physical security in ISO 27001: How to protect the secure areas https://advisera.com/27001academy/blog/2015/03/23/physical-security-in-iso-27001-how-to-protect-the-secure-areas/
- What to consider in security terms and conditions for employees according to ISO 27001 https://advisera.com/27001academy/blog/2018/05/23/what-to-consider-in-security-terms-and-conditions-for-employees-according-to-iso-27001/
For a overview about ISO 27001 Implementation, I suggest you these materials:
- ISO 27001 implementation checklist https://advisera.com/27001academy/knowledgebase/iso-27001-implementation-checklist/
- ISO 27001: An overview of the ISMS implementation process [free webinar] https://advisera.com/27001academy/webinar/iso-27001-overview-isms-implementation-process-free-webinar-demand/ -
Audit questions
1. Does the internal auditor has to have a FORMAL training (should be formally certified of some sort) in order to conduct the internal audits? I found no evidence for that in any of the 9.2 clause.
Answer:
According to ISO 27001 (clause 7.2) competence can be demonstrated by means of education, training or experience. Considering that, an internal auditor does not need to have a formal training if he can demonstrate his competence by other means (e.g., an degree which includes education on auditing topics, or previous experience on auditing ISO 27001 management systems).
For additional information, see:
- What to look for when hiring a security professional https://advisera.com/27001academy/blog/2016/02/15/what-to-look-for-when-hiring-a-security-professional/
2. Should the information security policy be signed by CEO? Again I found no evidence for that – only "Top Management".
Answer:
By top management you must consider the highest level of the organization related to the ISMS scope. If the organization is included in the ISMS scope this person would be the CEO, however if only part of the organization is included in the ISMS scope this person may be someone else. Please note that for small and mid-sized organizations, due to their size, the most common is that the CEO signs the information security policy, no matter if the scope of the ISMS is the whole" organization or not. -
Employee private devices
Answer:
By including private devices in your asset register would mean that all information on them (both company and private) would have to be treated according company security rules, and this will add unnecessary effort and complexity to your ISMS (because users' private data).
A better approach would be not include the private devices in your asset register and identify the risk that business data can be accessed by private devices. This way you can focus on protecting only the business data, and this can be done by means of implementing a BYOD policy.
This article will provide you further explanation about managing private devices:
- How to write an easy-to-use BYOD policy compliant with ISO 27001 https://advisera.com/27001academy/blog/2015/09/07/how-to-write-an-easy-to-use-byod-policy-compliant-with-iso-27001/ -
Career on information security
Answer:
First step is for you to decide which path you want to follow among these general fields: security management, security assurance (i.e., security audit), or technical security, and this last one has many sub fields (e.g., software development, security operation, etc.). Once you have decided this path there are many certifications available for each field (e.g., CISM for security management, CISA for security assurance, and CISSP for overall technical security).
Considering specifically ISO 27001 career you can follow:
- ISO 27001 Lead Implementer – this certification recognizes people who have competency on the ISO 27001 implementation process.
- ISO 27001 Lead Auditor – this certification recognizes people who have competency on auditing an ISMS against ISO 27001 requirements and want to become certification auditors (and with this provides more confidence to an organization for being certified).
These articles will provide you f urther explanation about ISO 27001 personnel certifications:
- What does ISO 27001 Lead Implementer training look like? https://advisera.com/27001academy/blog/2016/11/28/what-does-iso-27001-lead-implementer-training-look-like/
- What does ISO 27001 Lead Auditor training look like? https://advisera.com/27001academy/blog/2016/08/29/what-does-iso-27001-lead-auditor-training-look-like/
- Lead Auditor Course vs. Lead Implementer Course – Which one to go for? https://advisera.com/27001academy/blog/2014/06/16/lead-auditor-course-vs-lead-implementer-course-which-one-to-go-for/
This material will also help you regarding ISO 27001 personnel certifications:
- ISO 27001 Lead Auditor Course preparation training [free webinar on demand] https://advisera.com/training/iso-27001-lead-auditor-course/
For courses related to these certifications, please see:
- ISO 27001:2013 Lead auditor course https://advisera.com/training/iso-27001-lead-auditor-course/
- ISO 27001:2013 Lead implementer course https://advisera.com/training/iso-27001-lead-implementer-course/ -
Standard operating procedures
Yes and no. Everything depends on what you do in each case. Some organizations use that terminology interchangeably. Other organizations use the word procedure for a more general document stating: what to do, by whom and when, and then when they need to specify the “how” they use “Standard Operating Procedure” or “Work Instruction”. Please check this image -
and this article “How to structure quality management system documentation” - https://advisera.com/9001academy/knowledgebase/how-to-structure-quality-management-system-documentation/ -
Media and assets
Answer:
Media is the way information is stored or delivered (e.g. paper and electronic file), while asset is anything of value for the organization, not only information (e.g., an equipment, a facility, people, etc.). So, in a sense, a media is one type of asset.
These articles will provide you further explanation about assets:
- How to handle Asset register (Asset inventory) according to ISO 27001 https://advisera.com/27001academy/knowledgebase/how-to-handle-asset-register-asset-inventory-according-to-iso-27001/
- ISO 27001 risk assessment: How to match assets, threats and vulnerabilities https://advisera.com/27001academy/knowledgebase/iso-27001-risk-assessment-how-to-match-assets-threats-and-vulnerabilities/
- 5 practical tips for media disposal according to ISO 27001 5 practical tips for media disposal according to ISO 27001 -
Risk management
A consultant on risk issues whom I support with computer security issues (material of which I am your client) asks me to collaborate with contributions to include in his agenda on RISK MANAGEMENT IN THE DIGITAL ERA. I thank you if you have information that you can share with me.
Answer:
I'm assuming you need references about risk management. Considering that, I can suggest you to present him these materials:
- How to address opportunities in ISO 27001 risk management using ISO 31000 https://advisera.com/27001academy/blog/2018/04/13/how-to-address-opportunities-in-iso-27001-risk-management-using-iso-31000/
- ISO 27001 risk assessment & treatment – 6 basic steps https://advisera.com/27001academy/knowledgebase/iso-27001-risk-assessment-treatment-6-basic-steps/
- Step-by-step explanation of ISO 27001 risk management https://info.advisera.com/27001academy/free-download/step-by-step-explanation-of-iso-27001-risk-management -
Garment manufacturing and 8.5.1
Answer
Yes, your company need to comply with ISO 9001:2015 clause 8.5.1, independently of who designs the product.
Your company:
a) need product specifications that describe features and performance targets
b) need the necessary monitoring and measuring resources to confirm product quality according to specifications and performance targets
c) need a process control plan that defines for each manufacturing step what is relevant to control with what frequency and within which limits in the process. (For example, a temperature or pressure control). Need a process control plan that defines for each manufacturing step what kind of quality control should be done for raw-materials and work-in-progress materials with what frequency and within which limits
d) need suitable equipment (to avoid any abnormal rate of breakdowns or lost production time). Need a suitable environment (If relevant to protect product quality – moisture control, pest control, …)
e) need enough people in your production process and they need to be competent according to criteria
g) need to determine risks of human error, evaluate potential consequences and implement actions to prevent it.
The following material will provide you more information about production control:
ISO 9001 – Understanding Product & Service Provision in ISO 9001 – https://advisera.com/9001academy/blog/2014/10/07/understanding-product-service-provision-iso-9001/
- Enroll for free course - ISO 9001:2015 Foundations Course - https://advisera.com/training/iso-9001-foundations-course/
- book – Discover ISO 9001:2015 Through Practical Examples – https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/