Start a new topic and get direct answers from the Expert Advice Community.
CREATE NEW TOPIC +Search results
11294 results
Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
Scope definition
Answer: You can limit the scope only to the IT department, but considering the size of your organization it is better to include all organization in the ISMS scope, because the effort that will be required to keep the separation may be greater than the effort to implement and maintain the ISMS for the whole organization.
These articles will provide you further explanation about scope definition:
- How to define the ISMS scope https://advisera.com/27001academy/knowledgebase/how-to-define-the-isms-scope/
- Problems with defining the scope in ISO 27001 https://advisera.com/27001academy/blog/2010/06/29/problems-with-defining-the-scope-in-iso-27001/
These materials will also help you regarding scope definition:
- Book Secure & Simple: A Small- Business Guide to Implementing ISO 27001 On Your Own https://advisera.com/books/secure-and-simple-a-small-business-guide-to-implementing-iso-27001-on-your-own/
- Free online training ISO 27001 Foundations Course https://advisera.com/training/iso-27001-foundations-course/ -
Asset register
The application has many components which I assume we would classify as underlying assets. In your Excel worksheet, you have Category of asset, Tool for delivery of service, Underlying assets, Category of underlying asset, Asset name, Asset owner, Risk owner etc.
If I was to classify the application in the worksheet, would I do the following:
Category of asset: Applications and databases
Tool for delivery of service: XXXX
Included features within tool: Here I would list the various modules of the application, e.g. Online access, User Interface, Reports etc
Infrastructure /Server(s) name: Here I would list the names of servers that are used to host the application
Underlying assets: If the application consists of server databases sitting on XX X servers, plus XXX servers would these be classed as underlying assets.
Category of underlying asset: For category of underlying asset, I assume that I would class the XXX Servers as Operating Systems and the XXXX Servers as Database Applications. In the same way, I would classify XXXX as an Operating System and XXXX as a development tool.
Asset Owner and Risk Owner: I assume that I allocate risk owners here based on the technology involved. The Asset Owner in all cases may be the Operations Manager but the risk owners may be the Server Team and the DBA respectively.
So, in summary, if I classify “XXXX” as the tool for delivery of the service and allocate the many underlying components as underlying assets, is this the best approach.
Answer: An approach with this level of detail is not common for small companies in general, but it is not wrong (big companies may see it as adequate). The main question you should consider here is if this level of detail is really necessary for you to manage the risks efficiently.
This article will provide you further explanation about asset register:
- How to handle Asset register (Asset inventory) according to ISO 27001 https://advisera.com/27001academy/knowledgebase/how-to-handle-asset-register-asset-inventory-according-to-iso-27001/ -
Product safety training
Answer:
The standard requires the organization to identify needs for training regarding the product safety and to perform the training. Needs for training can be determined based on the new activities introduced regarding the product safety or based on the FMEA results or customer requirements. Once you identify the training need, you need to plan and perform the training and produce records about the training, e.g. training report.
The training plan that contains training about the product safety and the training report on the training conducted is sufficient evidence to demonstrate compliance with this requirement of the standard.
For more information, see: Ensuring product safety according to IATF 16949 https://advisera.com/16949academy/blog/2017/09/20/ensuring-product-safety-according-to-iatf-16949/ -
Company data
As long as we are talking about personal data the EU GDPR comes into play, so it doesn't matter whose data are concerned, could be employees, customers, customers employees, suppliers employees. -
Integrated ISO 27001 & GDPR toolkit content
I was looking for a policy regarding Security in the HR & recruitment process.
Does that exist?
Answer: Unfortunately we do not have a security policy for HR and recruitment processes - this is because such document is not mandatory, and for smaller companies (our target market) it is not very common. I'm not sure about the size of your company, but if you are smaller than 100 employees, such document would probably be an overkill for you.
Of course, you can always schedule a meeting with our expert who will explain you how to write such a policy if you feel it is needed. -
Alcance SGSI
Respuesta: Si quieres integrar tu ISO 9001 con la ISO 27001, comunmente la mayoría de las empresas que conozco tienen el mismo alcance para ambos estándares, por tanto, si has definido un alcance para ISO 9001, puedes definir el mismo alcance para ISO 27001. En cualquier caso, nuestra recomendación es que el alcance de la ISO 27001 sea toda la organización.
Este artículo te puede interesar “How to integrate ISO 9001 and ISO 27001” : https://advisera.com/9001academy/blog/2016/09/27/how-to-integrate-iso-9001-and-iso-27001/
Y también este otro “How to define the ISMS scope” : https://advisera.com/27001academy/knowledgebase/how-to-define-the-isms-scope/
Y este webinar gratuito sobre la implementación de ISO 27001 usando ISO 9001 “Implementación de ISO 27001: ¿Cómo hacerla más sencilla utilizando ISO 9 001?” : https://advisera.com/27001academy/es/webinar/iso-27001-implementation-how-to-make-it-easier-using-iso-9001-free-webinar-on-demand/ -
ISO 20000 and ISO 27001
Answer: Although ITIL/ISO 20000 and ISO 27001 cover different domains, they have a considerable overlap that requires that any organizational unit working with them work together. For example, ITIL/ISO 20000 must integrate information security requirements in its implementation. Regarding ISO 27001, when defining which and how to protect information the characteristics of the IT environment should be considered to define the best approach.
These articles will provide you further explanation about integration between information technology and information security:
- ISO 27001 vs. ITIL: Similarities and differences https://advisera.com/27001academy/blog/2016/03/07/iso-27001-vs-itil-similarities-and-differences/
- Incidents in ISO 22301 vs. ISO 27001 vs. ISO 20000 vs. ISO 28003 https://advisera.com/27001academy/blog/2016/09/05/incidents
This material will also help you regarding integration between information technology and information security:
- How to integrate ISO 27001 and IS O 20000 [free webinar on demand] https://advisera.com/27001academy/webinar/how-to-integrate-iso-27001-and-iso-20000-free-webinar-on-demand/ -
Exercising and Testing Plan
All is well but I feel I have misinterpreted the Exercising and Testing Plan. Now this document has a specific drill for a specific date in it. Should it be more like an annual schedule of different exercises and their periods instead?
Answer: Your assumption is correct. The purpose of this template is to determine the annual schedule of multiple exercises, so you can have a general overview of all exercises you have to perform in the period, but nothing prevents you to use this document for a single test to be performed in a single period.
This article will provide you further explanation about testing business continuity:
- How to perform business continuity exercising and testing according to ISO 22301 https://advisera.com/27001academy/blog/2015/02/02/how-to-perform-business-continuity-exercising- and-testing-according-to-iso-22301/
This material will also help you regarding testing business continuity:
- Book Becoming Resilient: The Definitive Guide to ISO 22301 Implementation https://advisera.com/books/becoming-resilient-the-definitive-guide-to-iso-22301-implementation/ -
Components of ISO 14001
thank you so much for your explanation. it really help me to understand more about ISO