Search results

Home / Search

Category:
Select
Select

11270 results

Guest

Guest

Create New Topic As guest or Sign in

HTML tags are not allowed

Select

Assign topic to the user

  • Different companies in scope ISO 27001

    1 - I have some questions regarding ISO 27001- ISMS scope and organizational units. We are implementing the documentation in two of our companies (same corporate group). The whole Company X is within the scope but only the compliance office in Company Y. We include them both in the scope. Is this correct or do we have two sets of documentation? We are using the same equipment and facility at the moment.

    If I understood correctly, you have two legally separated companies using the same equipment and facility at this moment.

    Considering that, first you need to align with your certification body the possibility to have a single scope for two legally separated companies.

    In case this is acceptable by the certification body, you can have a single set of documents, but please note that when you start using different equipment and facility you will need to review the documents.

    2 - I also have a question regarding Risk assessment table. To be compliant with the ISO standard- should we change the risks in the risk assessment after the risk treatment? For example, if risk X has been reduced due to implementation of a policy, should we change the risk from e.g., 3 to 2 in the risk assessment? Or should we not change the risks after treatment at all?

     Risks identified during risk assessment must not be changed after risk treatment. What happens is that, after risk treatment, you need to assess the residual risk, i.e., the risk value after the applied treatment.


    This article will provide you with further explanation about residual risks:

  • Internal Audit Report Review

    Although it is acceptable, it is highly unusual that the results of an internal audit point out that everything was implemented correctly AND there are no opportunities for improvement (a certification auditor would certainly check a such report in more detail).

    If everything is consistently being performed as planned, then the next step in maturity could be an opportunity to be considered. For example:

    • Efficiency could be increased
    • Productivity could be increased
    • Rework could be decreased
    • Costs could be decreased

    This article will provide you with further explanation about improving processes maturity:

  • Certification process of sister company

    If I understood correctly, the scenario involves a parent company X, at least two sister companies Y and A, and company A has a branch company B.

     

                                                                X (parent)

                                   Y(sister)                                               A(sister)

                                                                                                   B(branch)

     

    In this situation you should consider only Site A as the scope for the certification process, leaving the departments from the parent company, and the branch in site B, as third parties which interact with your certification scope.  

    This way your certification process will be restricted to Site A, and required security controls related to departments from the parent company, and related to the branch company, will be handled through security clauses in contracts and/or service agreements you will establish with them.

    This article will provide you with further explanation about the certification process:

    This material will also help you regarding the Information Security Management System scope definition:

  • Business Continuity Plan Testing Exercise

    1 - Can we include Risk assessment and BIA in the test exercise and ask questions on that? or in other words should we do both analyses during this testing exercise?

    Please note that the purpose of a BC Plan tabletop exercise is to assess the effectiveness of the devised plan (e.g., if people know what to do, if all required activities are included and well described, etc.), not to evaluate it against BIA and risks, so both analyses should not be performed together (this would only make the test unnecessarily complex).

    Considering that, the best course of action would be to ask for the information about BIA and risk assessment, and evaluate the BC Plan before the test, and if this information is not available you could explain that without a clear understanding of business impacts and associated risks, even though the BC Plan test is considered successful, it may not be fully aligned with the relevant impacts and risks related to the considered scenario.

    For further information about BC Plan tests, see:

    2 - Secondly, what are the most relevant questions we should be asking?

    A tabletop exercise means testing a plan by means of team interaction, so examples of relevant questions to be asked to people involved in the BC Plan would be related to:

    • the sequence of activities to be performed by each person in case of a Data Centre Power Outage
    • the means of communication to be used, who to communicate to, and what to communicate
    • the knowledge of each person about the activities other members will be performing

    Based on these questions, and the speed and confidence of response, you can evaluate if the involved personnel are familiar with the plan and can perform it in a satisfactory way.

  • 27001 Certification for Multiple Companies / Geographic locations

    1 - I'm struggling to get my head around how we can justify scoping out the IT Management side of the Company. The IT Management side will have complete control of our IT systems and potentially uncontrolled access to our servers. If we establish contracts or service agreements, won't the security requirements be the majority (if not all) of Site A's ISMS? If so, what's the benefit of scoping them out?

    Please note that security requirements defined for Site A can be also enforced on Site B by means of contracts/service agreements. The benefits of scoping out the IT management are related to decreasing the complexity of the scope and certification maintenance costs since you will have a smaller scope to manage.  

    Regarding control of the IT infrastructure by Site B, it can be legally defined (through contract/service agreement) that any decision it makes needs approval from Headquarters to be implemented, so even though it has operational control, it will not have the decision power to implement changes without HQ consent.

    Regarding the risk of uncontrolled access to your servers, controls such as encryption, logging, and monitoring of the user administrator’s activities can be used to decrease such risks.  

    For further information, see:

    • Which security clauses to use for supplier agreements? https://advisera.com/27001academy/blog/2017/06/19/which-security-clauses-to-use-for-supplier-agreements/

    2 - Would considering Site A and Site B as one Company but Site B (still providing IT Management and Design services) scoped out of ISMS be an easier way to implement the ISMS? Site B will still implement the relevant ISMS policies but only Site A will be certified? I'm thinking this might save a somewhat complicated contract/service agreement and less controls to be audited.

    The scenarios considering Site A and Site B as different companies, and both as the same company but with Site B scoped out of ISMS would be the same for an ISO 27001 certification, i.e., you would still need to develop an agreement between them, since they will have the same client-supplier relation.

    In fact, this situation would be a bit more complex, because you would need to align first with the certification body the situation of having two legally different organizations considered as a single company.

    3 - Lastly, I understand that the Chief of Information Security type role is not mandatory under 27001 but it is beneficial to the process. Is it possible for someone from Site B to take this position for Site A despite being scoped as a third party?

    ISO 27001 does not prescribe that information security roles need to be fulfilled by an organization’s employee, so provided you can evidence that the related roles are defined and being fulfilled, you can “outsource” this position to someone from Site B.

  • Auditor definition

    As long as Jack does not audit his own work, there is no conflict of interest in this scenario, even if John and Jack have the same boss.

    This article will provide you with further explanation about internal audit:

    These materials will also help you regarding internal audit:

  • Certifications merge

    This situation needs to be evaluated by the certification bodies that issued the certifications, so you should contact them to receive proper clarification.

    Technically speaking, the “merge” would mean an update in the scope of the certification that would receive the merged certification, and all sequential steps after a scope update (e.g., review of risks, implemented controls, etc.).

    This article will provide you with further explanation about integrated management systems:

  • BCMS | ISO 22301:2019

    The duration of the implementation project varies according to many variables (e.g., available resources, experience with standard requirements, top management involvement, etc.), but for companies of up to 200 employees the implementation time is up to 8 months.

    To get an insight into the time duration for your organization, please read (although the material is about ISO 27001, the same concepts apply to ISO 22301):

    • Time, effort and roles for the implementation https://advisera.com/27001academy/knowledgebase/iso-27001-implementation-checklist/#effort

    • Entry into the IT department

      1 - I will like to know if iso 27001 standard talks about a single point of entry into the IT department. I will like to know if ISO27001 talks about multiple entries into the IT department and best practices.

      I’m assuming that by “single point of entry into the IT department” you mean physical access to the department.

      Considering that, ISO 27001 does not provide specifics about the implementation of security controls. It only provides a general description of the controls.

      In general terms, physical single and multiple points of entry into the IT department fall into Annex A control A.11.1.2 (Physical entry controls), as ways to implement this control.  

      For further information, see:

      2 - if not, what standard should I look out for

      For guidance on the implementation of ISO 27001 security controls, you should look for ISO 27002, which provides guidance on the implementation of ISO 27001 Annex A controls.

      This article will provide you with further explanation about ISO 27002:

    • Supplier Security Policy Question

      The Supplier Security Policy applies to all companies that provide or will provide services to your company, but not to your customers (customer requirements are handled through the List of Legal, Statutory, and Contractual requirements template, located in folder 2 Identification of Requirements).

      This article will provide you with further explanation about suppliers’ security:

Page 64-vs-13485 of 1127 pages

Didn’t find an answer?

Start a new topic and get direct answers from the Expert Advice Community.

CREATE NEW TOPIC +