Start a new topic and get direct answers from the Expert Advice Community.
CREATE NEW TOPIC +Search results
11294 results
Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
How often the risk review needs to be done?
SOA controls are implemented due to various reasons like Best Practices, Legal, Contractual, or out of risk assessments.
Answer: You should review your current risk assessment at least once a year, or if any bigger change happens - e.g. change of technology, change of location, change in your products or services, change in legislation, etc.
Is it good to categorize the controls implementation like this and do assess all controls every quarter or only during any technology or regulatory changes?
Answer: I didn't see in practice this kind of categorization, and it seems to me it won't be useful - as mentioned above, the review needs to be triggered by any significant changes. -
Minimum roles for ISO 27001 certification
This is correct - smaller companies very often hire outsourced security officers. -
BIA input for risk assessment
Answer: ISO 27001 does not prescribe which inputs you should use when performing the risk assessment, only that you have to take into account the impact on confidentiality, integrity and availability of your information.
Therefore, you can take Business Impact Analysis as an input for your risk assessment, however this could prove to be very costly if you start doing this for each of your assets; to avoid these costs you can do the BIA only for the most valuable assets.
Read also this article: Risk assessment vs business impact analysis: https://advisera.com/27001academy/knowledgebase/risk-assessment-vs-business-impact-analysis/ -
Non disclosure agreement and auditors
Answer:
Normally, organizations don’t require that certification bodies auditors sign non-disclosure agreements, since they have to keep professional confidentiality. However, if they will contact proprietary specifications, or proprietary processes, or information not intended for public knowledge, your organization can previously contact the certification body and request them to arrange things accordingly
The following material will provide you information about the classification of information:
- ISO 27001 – Information classification according to ISO 27001 - https://advisera.com/27001academy/blog/2014/05/12/information-classification-according-to-iso-27001/
- free online training ISO 9001:2015 Foundations Course – https://advisera.com/training/iso-9001-foundations-course/
- book - Discover ISO 9001:2015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/ -
Requirements for a third-party consultant/training provider
Answer:
ISO has no requirements for a third-party consultant/training provider to possess before he can provide the required EMS internal auditor training to a client's ISO 14001 champion. That will depend on each client own requirements.
The following material will provide you information about consultant/training requirements:
– How to become an ISO 14001 consultant - https://advisera.com/14001academy/blog/2016/08/29/how-to-become-an-iso-14001-consultant/
- free online training ISO 14001:2015 Lead Implementer Course - https://advisera.com/training/iso-14001-lead-implementer-course/
- book - THE ISO 14 001:2015 COMPANION – A A Straightforward Guide to Implementing an EMS in a Small Business - https://advisera.com/books/the-iso-14001-2015-companion/ -
Developing Key Performance Indicators
Answer:
There is no standard procedure. Each organization, according to its own tradition, and according to each set of persons with their personal experiences, decide who is responsible for developing Key Performance Indicators. Don’t forget that Key Performance Indicators should be aligned with the strategic orientation.
The following material will provide you information about Key Performance Indicators:
- ISO 9001 – How to define Key Performance Indicators for a QMS based on ISO 9001 - https://advisera.com/9001academy/24/define-key-performance-indicators-qms-based-iso-9001/-iso-9001/
- ISO 9001 document template: Matrix of Key Performance Indicators - https://advisera.com/9001academy/documentation/matrix-key-performance-indicators/
- free online training ISO 9001:2015 Foundations Course – h ttps://advisera.com/training/iso-90012015-foundations-course/
- book - Discover ISO 9001:2015 Through Practical Examples - https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/ -
Consolidating policies
Answer:
Although ISO 27001 allows merging documents, the ISMS Policy is a high level document (to be used for all organization), while the remaining policies you mentioned are considered operational policies (to be used by specific areas or processes), so in this case we advise not to integrate them in a single document, because this document would become unnecessarily big and difficult to read and manage.
These articles will provide you further explanation about developing policies:
- What should you write in your Information Security Policy according to ISO 27001? https://advisera.com/27001academy/blog/2016/05/30/what-should-you-write-in-your-information-security-policy-according-to-iso-27001/
- One Information Security Policy, or several policies? https://advisera.com/27001academy/blog/2013/06/18/one-information-security-policy-or-several-policies/ -
Punto 7.1.4
Respuesta:
La cláusula 7.1.4 está dirigida a garantizar que las condiciones en las que se llevan a cabo los procesos sean idóneas para el servicio que se presta y cumpla con los requisitos correspondientes.
Entre los factores que hay que controlar se encuentran:
- Factores sociales: como un ambiente tranquilo, no discriminatorio
- Factores psicológicos: por ejemplo encaminados a la reducción del estrés en la oficina
- Factores físicos, como la temperatura, la iluminación, el ruido.
Ciertamente estos factores están muy relacionados con la seguridad y salud laboral, aunque en este caso hay que enfocarlo a la calidad del servicio que ofrece la compañía.
Estos materiales pueden ayudarle a entender el punto 7.1.4:
- Informe gratuito - Clause by clause explanation of ISO 9001:2015: https://info.advisera.com/9001academy/free-download/clause-by-clause-explanation-of-iso-90012015
- Libro - Discover ISO 9001:015 through practical examples: https://advisera.com/books/discover-iso-9001-2015-through-practical-examples/
- Curso gratuito en línea - Fundamentos ISO 9001:2015: https://advisera.com/es/formacion/curso-fundamentos-iso-9001/ -
GRC and ISO 27001
Answer:
ISO 27001 can support part of the Governance, Risk, and Compliance process, so to enhance your skills you also have to consider competences related to COSO and COBIT.
Regarding interviews, the most important thing are not the questions itself, but how you can demonstrate that you are capable to identify business needs (e.g., by interviewing C-level personnel, analyzing documentation, etc.) , translate them on objectives to be implemented and controlled (e.g. by means of strategic and operational plans), and how to ensure such objectives are being fulfilled (e.g., by means of audits, management reviews, etc.). Providing examples of related activities you performed are a good way to show that, and this answer your third question (you need to have hands on experience on this field, because the most valuable GRC personnel brings a lot of experience together with their formal knowledge.
These articles will provide you further explanation about COSO, COBIT and Governance:
- How to integrate COSO, COBIT, and ISO 27001 frameworks https://advisera.com/27001academy/blog/2016/10/10/how-to-integrate-coso-cobit-and-iso-27001-frameworks/
- Should information security focus on asset protection, compliance, or corporate governance? https://advisera.com/27001academy/blog/2017/03/13/information-security-focus-asset-protection-compliance-corporate-governance/
This material will also help you regarding ISO 27001:
- Free online training ISO 27001 Foundations Course https://advisera.com/training/iso-27001-foundations-course/ -
Non-Conformance vs Opportunity for Improvement
Hm
I would lean to say that a non-conformance of any type is a good input for improvement. As improvement is to make something better you can use a N-C as one of the inputs that give you a continuous improvment. Not all N-C may be improvements as some may turn out to be quick fixes. If we take the backup process mentioned above I think a real improvement here would be to analyze, plan, do then check that your actions have improved and secured the process to a working state.
This is just saying that N-Cs can be one input to your comtinuous improvement. Others could be obtained from brainstorming, needs from internal or external interests.
Be good and get even better
Richard Lehtonen