Start a new topic and get direct answers from the Expert Advice Community.
CREATE NEW TOPIC +Search results
11294 results
Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
ISO 27001 implementation
It was mentioned, however, that he just wanted me to go straight in and start writing out the polices, my questions are as follows which hopefully you can give me some guidance on:
1 - Firstly, is this even possible or the right way? I’ve gone through a few training and webcasts you’ve provided, I was under the impression that you had to complete this, stage by stage, rather than jumping straight into the polices
Answer: It is possible to start writing out the polices, but it is not the right way, and not recommended, because the chances are that the policies will not cover all the aspects where you need to protect information, conflicting rules will impair processes performance, and you will have a lot of rework to do to correct things (and this rework will certainly take more time then following the implementation step by step).
2- Is this even possible to write the polices without any real scope, apart from wanting to implement these into the IT dept, which again, I was under the impression that this wasn’t supposed to just be an IT project
I did try and explain about the different steps involved but I wanted to get your guidance on what I have mentioned above.
Answer: Without an stated scope you will have to consider at least that all the organization is covered by the ISMS, and depending on the size of the organization and your real needs for security, the difference may mean a lot of unnecessary effort spent to write policies involving people and business units that will not use them, again resulting in losses that can be prevented by following the implementation step by step.
Regarding designating the IT as responsible for information security, you should try to argument that information can exist outside information systems (e.g., in paper reports, whiteboards, on people talking), and in these situations the IT will not have the resources or authority to protect information, so the best course of action is to designate information security responsibilities considering where the information can be (e.g., HR can be responsible for information security related on hoe employees handle with information).
These articles will provide you further explanation about implementing ISO 27001:
- The 3 key challenges of ISO 27001 implementation for SMEs https://advisera.com/27001academy/blog/2017/04/17/the-3-key-challenges-of-iso-27001-implementation-for-smes/
- 4 crucial techniques for convincing your top management about ISO 27001 implementation https://advisera.com/27001academy/blog/2016/09/12/4-crucial-techniques-for-convincing-your-top-management-about-iso27001-implementation/
- ISO 27001 implementation checklist https://advisera.com/27001academy/knowledgebase/iso-27001-implementation-checklist/
These materials will also help you regarding implementing ISO 27001 (you may present them to your boss):
- Seven key problems to avoid in ISO 27001 implementation [free webinar on demand] https://advisera.com/27001academy/webinar/seven-key-problems-to-avoid-in-iso-27001-implementation-free-webinar-on-demand/
- ISO 27001: An overview of the ISMS implementation process [free webinar on demand] https://advisera.com/27001academy/webinar/iso-27001-overview-isms-implementation-process-free-webinar-demand/ -
Cloud toolkit
"Cloud Toolkit is suitable for smaller companies that do not have the need for complex business continuity process, but require the establishment of more strict security controls to protect information on cloud environments and have privacy related requirements to comply with."
So do I understand correct that it is designed for companies who keep their data in the cloud (cloud customers), but not for companies who provide cloud services?
Answer: Cloud Toolkit is designed to support both cloud customers (about how to define security and privacy requirements and make sure their suppliers are compliant with them) and cloud service providers (about how to define security and privacy requirements, implement them and ensure they are working properly). -
Summary of changes in AS9100 Rev D
Please give me the highlights on what the Rev D invokes.
Example:
1) Risk Assessment
2) Leadership Context
3) Process Capability
Answer:
The main changes in the new standard are the additions of requirements for understanding the context of your company, the interested parties of the QMS and their requirements, risk assessment for the QMS, leadership commitment, product safety and the prevention of counterfeit parts. Most other sections have few changes with the exception that they talk about the products and services that a company provides.
In the near future there will be a whitepaper matrix of the changes from Rev C to Rev D being released on 9100Academy, but in the mean time the best place to look is the whitepaper on understanding the standard (https://info.advisera.com/9100academy/free-download/clause-by-clause-explanation-of-as9100-rev-d ) and the infographic on the changes (https://advisera.com/9100academy/knowledgebase/as9100-rev-d-vs-rev-c-what-has-changed/ ) -
Risk Register vs Incident Log
Risk register and incident log are complementary documents. The first records what may happen, and the second what really happened.
Identified risks are required by ISO 27001, as part of the risk assessment and treatment process. Incident log is only required if there are unacceptable risks that justify controls that require its implementation (e.g., A.16.1.2 Reporting information security events).
These articles will provide you further explanation about risk register and incident log:
- ISO 27001 risk assessment & treatment – 6 basic steps https://advisera.com/27001academy/knowledgebase/iso-27001-risk-assessment-treatment-6-basic-steps/
- How to handle incidents according to ISO 27001 A.16 https://advisera.com/27001academy/blog/2015/10/26/how-to-handle-incidents-according-to-iso-27001-a-16/
These materials will also help you regarding risk register and incident log:
- Book ISO 27001 Risk Management in Plain English https://advisera.com/books/iso-27001-risk-management-in-plain-english/
- ISO 27001 Annex A Controls in Plain English https://advisera.com/books/iso-27001-annex-controls-plain-english/
- The basics of risk assessment and treatment according to ISO 27001 [free webinar on demand] https://advisera.com/27001academy/webinar/basics-risk-assessment-treatment-according-iso-27001-free-webinar-demand/ -
Medical data
Answer:
As the doctors are sharing patient data with you, they should both obtain consent and present the patient with a privacy notice that is GDPR compliant. -
Minimum standard
Answer:
The information you need to provide to the data subject is the same as for written/online notices. So there is not difference in term of content. However, make sure you keep the recordings of you presenting the notice. -
DPO
Indeed as mentioned before no formal certifications are required at least for the time being. However, keep in mind that a strong knowledge about the EU GDPR as well as other relevant privacy laws is needed since most likely the DPO will be the one running the whole EU GDPR framework within the company. -
¿Apéndices en la ISO 22301?
Respuesta: Disculpa, pero ISO 22301 no tiene apéndices, por tanto, este estándar no habla sobre apéndices. Donde puedes ver apéndices es en nuestro paquete de documentos de la ISO 22301, por ejemplo, el documento “Procedimiento para identificación de requisitos” tiene el apéndice “Lista de requisitos legales, normativos, contractuales y de otra índole” que simplemente es un documento adicional que se utiliza como soporte al procedimiento. Puedes ver aquí nuestra lista de documentos con sus apéndices, y también puedes ver qué documentos son obligatorios : https://advisera.com/wp-content/uploads//sites/5/2015/06/Lista_de_documentos_Paquete_de_documentos_sobre_ISO_22301_BS-25999_ES.pdf -
Inventory of processing activities
Answer:
Inventory of processing activities need to be filled in by the companies themselves, there are no “most used processing activities” since these are closely linked to the business. For example a call center processing activities will be different than the ones form a recruitment company. This is why we provided in the EU GDPR toolkit https://advisera.com/eugdpracademy/eu-gdpr-documentation-toolkit/ the ”Guidelines of Processing Activities Inventory” that will explain how you could tackle this task.
As for the Retention Schedule it is somehow the same story especially for certain types of records for which retent ion period is established by local legal requirements for example the retention period for CCTV footage is different between various Member States the same goes for payroll related documents as well. -
ISO 27017 and ISO 27018 certification
Answer: Although there are some certification bodies issuing certificates for ISO 27017 and ISO 27018, these are unofficial (to ISO these standards are not certifiable), and cannot be issued without a formal ISO 27001 certification.
ISO27017 and ISO 27018 are support standards to ISO 27001, providing specific guidance and orientation on security controls form ISO 27001 Annex A that are applicable to cloud environments and Personally Identifiable Information.
These articles will provide you further explanation about ISO 27001, ISO 27017 and ISO 27018:
- WHAT IS ISO 27001 https://advisera.com/27001academy/what-is-iso-27001/
- ISO 27001 vs. ISO 27017 – Information security controls for cloud services https://advisera.com/27001academy/blog/2015/11/30/iso-27001-vs-iso-27017-information-security-controls-for-cloud-services/
- ISO 27001 vs. I SO 27018 – Standard for protecting privacy in the cloud https://advisera.com/27001academy/blog/2015/11/16/iso-27001-vs-iso-27018-standard-for-protecting-privacy-in-the-cloud/