Search results

Home / Search

Category:
Select
Select

11294 results

Guest

Guest

Create New Topic As guest or Sign in

HTML tags are not allowed

Select

Assign topic to the user

  • ISO 27001 single templates

    I’m assuming that by SABS you mean the South African Bureau of Standards, and you are referring to SANS 27001:2015, which requirements are exactly the same as ISO 27001:2013.  

    Considering that, the standard clause 4.1 does not require external and internal issues to be documented, so a template regarding this clause is not necessary.

    For further information about context and external and internal issues, see:

    Regarding clause 4.3, you can use the ISMS Scope Document template: https://advisera.com/27001academy/documentation/isms-scope-document/

    For further information about ISMS scope definition, see:

    • How to define the ISMS scope https://advisera.com/27001academy/knowledgebase/how-to-define-the-isms-scope/
    • Problems with defining the scope in ISO 27001 https://advisera.com/27001academy/blog/2010/06/29/problems-with-defining-the-scope-in-iso-27001/
    • Defining the ISMS scope if the servers are in the cloud https://advisera.com/27001academy/blog/2017/05/22/defining-the-isms-scope-if-the-servers-are-in-the-cloud/
    • How To Set ISMS Scope According to ISO 27001 [free webinar on demand] https://advisera.com/27001academy/webinar/how-to-set-the-isms-scope-according-to-iso-27001-free-webinar-on-demand/

    • Documentation request

      Please note that only some of these documents are mandatory for an ISO 27001 certified organization (e.g., ISMS scope, and the Information Security Policy), while others will depend if you have implemented some specific controls (e.g., control A.9.1.1 – Access Control Policy requires an Access Control Policy to be documented), and others are not needed at all (e.g., Context of organization, ISMG Governance and Training Matrix).

      For a list of mandatory documents for ISO 27001-certified companies, please see:

      Considering that, unless this request from the customer is based on a contract or service agreement you have with that company, you do not need to have the documents not required by the main clauses of the standard, or by specific controls you implemented.

      You have to consider how important this customer is to you and based on this, decide if you will write these documents.

      Regarding the mandatory documents, you should sign an NDA with the customer before providing the documents.

    • Clause 4.1 in Conformio

      Please note that external and internal issues relevant to the ISMS can be evidenced in Conformio through:

    • The 'Register of legal, contractual and other requirements' module, which generates a document called "List of Legal, Regulatory and Contractual Requirements".
    • The 'Risk register' modules which cover the processes of risk assessment, treatment, and management and generate a document: "Risk Assessment and Risk Treatment Report".

      • Both modules take into account external and internal issues for the definition of the mentioned documents.

      For further information, see:

    • How to implement ISO 45001 in developing countries and small medium scale industries?

      Hi, Implementing ISO 45001 can be both rewarding and challenging due to limited resources, practical approach.. 

    • Question on risk assessment

      Please note that the purpose of the Risk Treatment Plan is to determine precisely who is responsible for the implementation of controls, in which time frame, with what budget, etc., so you do not need to present any risks in the Risk Treatment Plan

      For further information, see:

    • ISO 45001 Future Changes

      Although I am not on the technical committee, and cannot say for certain what will happen, I can predict a bit from what I know. In general, the Iso technical committees will look at the standards about every 5 years to see what changes are needed. If we look at the oldest management system standard (ISO 9001), this followed the cycle of a major release (1987), minor changes (1994), a major change (2000), minor changes (2008), and then a major change in 2015 to align with other management system standards. So, following this I would expect minor changes in the net revision of ISO 45001, but nothing major. This will also be delayed a bit due to the delayed transition from OHSAS 18001 for the pandemic, and future major changes will likely be harder to do where they affect the alignment with other ISO management system standards or to change how any management system utilizes the management principles (such as the process approach).

      In short, I don’t see any revolutionary changes to being ISO compliant in the next 5 years.

      For a bit more on the crucial management principle of the process approach, see the article:

Page 61 of 1130 pages

Didn’t find an answer?

Start a new topic and get direct answers from the Expert Advice Community.

CREATE NEW TOPIC +