Start a new topic and get direct answers from the Expert Advice Community.
CREATE NEW TOPIC +Search results
11294 results
Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
Template content - awareness and training
„Job title or name“ - which department or employee is meant? The one who trains or the one which is being trained?
The comment beside doesn’t really help in that case.
Answer:
First of all thanks for this feedback. The column "Job title or name" refers to personnel who must be trained. -
Risks and ISO 22301
Answer:
First it is important to note that ISO 22301 does not focus on risk management, but on business continuity. The objective of this standard is to ensure continuity of processes and delivery of services after a disruptive event, and risk management is one approach to achieve this objective, by the identification and treatment of risks that can lead to a disruptive event, but the standard itself does not define which risks to be treated or how to identify and treat them, only that this activity must be performed.
For detailed information about risk management you should consider the ISO 31000 standard
These articles will provide you further explanation about ISO 22301 and ISO 31000:
- What is ISO 22301 https://advisera.com/27001academy/what-is-iso-22301/
- ISO 31000 and ISO 27001 – How are they related? https://advisera.com/27001academy/blog/2014/03/31/iso-31000-and-iso-27001-how-are-they-related/
Although the last article mentions ISO 27001, the concepts of ISO 31000 included in the article are also applicable to ISO 22301. -
BCM policy and a DR policy
Answer:
First it is important to note that both Business Continuity Management (BCM) policy and Disaster Recovery (DR) policy are top-level documents, covering management intentions. For operational purposes, i.e., detailed step-by-step activities and responsibilities, you also have to consider Business Continuity (BC) plans and Disaster Recover (DR) plans.
Considering that, the Business Continuity Management (BCM) policy is a more comprehensive document, covering management intentions regarding keeping processes and services running at minimum agreed levels after a disruptive event, and returning them to normal operation as quick as possible, while the Disaster Recovery (DR) policy focuses on management intentions regarding only the recovery of infrastructure (e.g., physical and IT infrastructure).
Reg arding documentation, you can have a single document to cover both issues, being the DR policy a section of the BCM policy.
These articles will provide you further explanation about BCM and DR in the context of ISO 22301, the ISO standard for business continuity management:
- What is ISO 22301 https://advisera.com/27001academy/what-is-iso-22301/
- The purpose of Business continuity policy according to ISO 22301 https://advisera.com/27001academy/blog/2013/06/04/the-purpose-of-business-continuity-policy-according-to-iso-22301/
- Disaster recovery vs Business continuity https://advisera.com/27001academy/blog/2010/11/04/disaster-recovery-vs-business-continuity/
- Business continuity plan: How to structure it according to ISO 22301 https://advisera.com/27001academy/knowledgebase/business-continuity-plan-how-to-structure-it-according-to-iso-22301/
This material will also help you regarding BCM and DR:
- Book Becoming Resilient: The Definitive Guide to ISO 22301 Implementation https://advisera.com/books/becoming-resilient-the-definitive-guide-to-iso-22301-implementation/ -
Controls to be implemented
Answer:
First it is important to understand that any control from ISO 27001 Annex A is mandatory only if at least one of the following occurs:
- There are unacceptable risks that justify the application of the control
- There are legal requirements (e.g., laws or contract clauses) to which the organization must comply with that demands the application of the control
- There is a Top Management decision to implement the control, by considering it as good practice.
If no one of the above conditions happen, there is no need to implement a control.
Considering that, by our experience a certified ISMS generally implements up to 80 from the 114 controls listed on ISO 27001 Annex A.
This article will provide you further explanation about selecting controls:
- The basic logic of ISO 27001: How does information security work? https://advisera.com/27001academy/knowledgebase/the-basic-logic-of-iso-27001-how-does-information-security-work/ -
Implementing ISO 27001 for outsourced SOC services
I would like to know the following:
1. What is the best practice (from ISO 27001 and Governance perspective) for ownership of processes. Should these be under the SOC team, Corporate IT or other role?
Answer: In this case there is no definitive answer on how to implement an ISO 27001 ISMS, because depending on the organizational context, legal requirements and business objectives, one approach can be better than the other.
The ownership of processes should be designated to the entity in the organization with the authority to make and enforce the changes and adjustments required to achieve the proper level of security. In some organizations the SOC team has this level of authority, but in others this authority remains with the head of IT department or even with the main executive (in small organizations) .
For further information, please read:
- Should information security focus on asset protection, compliance, or corporate governance? https://advisera.com/27001academy/blog/2017/03/13/information-security-focus-asset-protection-compliance-corporate-governance/
2 . Traditionally the SOC team has done whatever they want and purchased assets (systems, applications, etc). What is the recommendation for ownership of assets? Should this be under the SOC team, Corporate IT or other role?
Answer: About ownership of assets, it should be designated to roles that can be made accountable for the protection of the asset. Since this is an issue more operational, you can consider the SOC team as responsible for the assets.
For further information, please read:
- How to handle Asset register (Asset inventory) according to ISO 27001 https://advisera.com/27001academy/knowledgebase/how-to-handle-asset-register-asset-inventory-according-to-iso-27001/
- Risk owners vs. asset owners in ISO 27001:2013 https://advisera.com/27001academy/knowledgebase/risk-owners-vs-asset-owners-in-iso-270012013/
3 . Since the scope is the services provided by the SOC, how should the ISO 27001 documents be handled? Should they be written in the context of applying controls on the systems used by the SOC or in the context of systems the SOC supports for the customers?
Answer: The best approach would be integrating controls on existing documentation, since this way the security will be perceived as part of the process, and it will easier to be understood and used.
For further information, please read:
- 8 criteria to decide which ISO 27001 policies and procedures to write https://advisera.com/27001academy/blog/2014/07/28/8-criteria-to-decide-which-iso-27001-policies-and-procedures-to-write/ -
Incident and Recovery Plan
Many thanks, now everything is clear :-) -
Reviewing documentation
Answer:
Only if your organization make any changes. Please check the meaning of “review” in ISO 9000:2015, definition 3.11.2. The review is not necessarily about changes but also about evaluating the suitability, adequacy or effectiveness”
2. How many NC category-1 are allowed in ISO audit to avoid reaudit or audit failure?
Answer:
Organizations should avoid major nonconformities during audits. Normally, major nonconformities during certification audits can imply re-audit. Sometimes, if an organization can show evidence that the major nonconformity was corrected, and an acceptable corrective action was implemented and effective a re-audit can be avoided.
The following material will provide you information about audits:
- Major vs. minor nonconformities in the certification audit - https://advisera.com/27001academy/blog/2014/06/02/major-vs-minor-nonconformities-in-the-certification-audit/
- Free online ISO 9001:2015 Internal Auditor Course - https://advisera.com/training/iso-9001-internal-auditor-course/
- Book - Discover ISO 9001:2015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/ -
Risk assessment for ISO 22301
Answer:
Risk assessment for BCM must identify risks that can cause disruption of business operations and services, so together with Business Impact analysis you can more easily identify which risks to business you have to handle.
Considering you already have a function responsible for risk management and risk data, you should verify if the existing Risk Register can help you.
If at this moment the Risk Register can not help you, then you should talk to the responsible for risk management about ISO 22301 requirements and ask him for support to perform a risk assessment for the BCM. Since ISO 22301 does not prescribe any appro ach to perform risk management, you can adopt the current approach without compromising ISO 22301 requirements.
This article will provide you further explanation about risk management for business continuity:
- Risk assessment vs. business impact analysis https://advisera.com/27001academy/knowledgebase/risk-assessment-vs-business-impact-analysis/
This material will also help you regarding risk management for business continuity:
- Book Becoming Resilient: The Definitive Guide to ISO 22301 Implementation https://advisera.com/books/becoming-resilient-the-definitive-guide-to-iso-22301-implementation/ -
Drawing control
Answer:
Yes, drawings that describe parts to be manufactured are very important specifications used for production and control. Also, due to design changes, after sales services normally, have to use simultaneously several different versions of drawings because different customers bought different versions of the same product.
The following material will provide you information about documentation:
- Although it is not about ISO 9001 this article seems useful - Understanding configuration management in AS9100 Rev D - https://advisera.com/9100academy/blog/2017/05/08/understanding-configuration-management-in-as9100-rev-d/
- ISO 9001 – How to structure quality management system documentation - https://advisera.com/9001academy/knowledgebase/how-to-structure-quality-management-system-documentation/
- Free online ISO 9001:2015 Foundations Course - https://advisera.com/training/iso-14001-internal-auditor-course/ urse/
- Book - Discover ISO 9001:2015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/