Start a new topic and get direct answers from the Expert Advice Community.
CREATE NEW TOPIC +Search results
11294 results
Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
Do we need to implement all the controls from SoA for the certification?
Answer: You can leave some of the controls for the implementation for after the certification under the following conditions:
1) That you have implemented before the certification the controls that mitigate the biggest risks - in other words, you can leave only less important controls for after the certification.
2) That you have specified the deadlines for the controls that you will be implementing after the certification in your Risk Treatment Plan - of course, those deadlines must be after the certification date.
3) That your risk owners or top management accept all the risks for which controls have not been implemented before the certification.
This means that the most important controls must have "implemented" status at the certification, while the less important controls can have status "planned" or "partially i mplemented" at the moment of the certification.
See also these articles:
- The importance of Statement of Applicability for ISO 27001 https://advisera.com/27001academy/knowledgebase/the-importance-of-statement-of-applicability-for-iso-27001/
- Risk Treatment Plan and risk treatment process – What’s the difference? Risk Treatment Plan and risk treatment process – What’s the difference?
These materials will also help you regarding Statement of Applicability and the risk management process:
- Book ISO 27001 Risk Management in Plain English https://advisera.com/books/iso-27001-annex-controls-plain-english/
- Free online training ISO 27001 Foundations Course
https://advisera.com/training/iso-27001-foundations-course/ -
How is the ISO 27001 Internal Auditor Course structured
Answer: For this specific topic you should watch module 6 from the ISO 27001 Internal Auditor Course, which covers a general explanation of Annex A and goes through all Annex sections, from A.5 to A.18. -
ISO 27001 Gap Analysis Tool
Answer: Yes, our ISO 27001 Gap Analysis Tool (https://advisera.com/27001academy/free-iso-27001-gap-analysis-tool/) covers all 14 sections of ISO 27001 Annex A.
On each section you will find objective questions that will help you verify if you can consider a control as implemented or what you still need to consider for implementation.
This article will provide you further explanation about gap analysis:
- ISO 27001 gap analysis vs. risk assessment https://advisera.com/27001academy/knowledgebase/iso-27001-gap-analysis-vs-risk-assessment/ -
Information as an asset
Answer: ISO 27005 (Information security risk management) considers two types of assets:
- Primary assets: business process and activities, and information itself
- Support and infrastructure assets: hardware, software and other elements on which primary assets rely on
Considering this, you should treat both, customer information and the database storing the customer information as the assets. This makes sense because the same information can exist in many different formats (e.g., in paper reports and in people's minds), that will require completely different practices to be implemented to ensure information protection.
This article will provide you further explanation about information assets:
- How to handle Asset register (Asset inventory) according to ISO 27001 https://advisera.com/27001academy/knowledgebase/how-to-handle-asset-register-asset-inventory-according-to-iso-27001/
These materials will also help you regarding information assets:
- Book Secure & Simple: A Small-Business Guide to Implementing ISO 27001 On Your Own https://advisera.com/books/secure-and-simple-a-small-business-guide-to-implementing-iso-27001-on-your-own/
- Free online training ISO 27001 Foundations Course https://advisera.com/training/iso-27001-foundations-course/ -
Vulnerabilities identification
Answer: In fact, the best approach is to consider every information source you can access (Nessus's reports, manual reviews, market trends, etc.), because each one of them better fits for different situations. For example, Nessus is perfect to find vulnerabilities that are known and which evaluation procedures can be automated, but it is not good for scenario and context evaluation, something we humans still are best doing it. Market trends can help you figure out vulnerabilities that in principle may be out of your day to day activities. -
Standard for Disaster Recovery
What is the best Iso norme for Drp ( Disaster recovery plan)
Answer: For information and communication technology readiness, the main ISO standard for disaster recovery is ISO 27031 (Information technology -- Security techniques -- Guidelines for information and communication technology readiness for business continuity). For a more systemic view you may consider ISO 22301 (Societal security -- Business continuity management systems --- Requirements), which provides you a basis for the business continuity management, which also includes disaster recovery planning, and the practices of ISO 22313 (Societal security -- Business continuity management systems -- Guidance).
These articles will provide you further explanation about ISO 27031, ISO 22301 and ISO 22313:
- Understanding IT disaster recovery according to ISO 27031 https://advisera.com/27001academy/blog/2015/09/21/understanding-it-disaster-recovery-according-to-iso-27031/
- What is ISO 22301? | 27001Academy - Advisera https://advisera.com/27001academy/what-is-iso-22301/
- ISO 22301 vs. ISO 22313 https://advisera.com/27001academy/blog/2013/05/21/iso-22301-vs-iso-22313/
This material will also help you regarding Business continuity management:
- Book Becoming Resilient: The Definitive Guide to ISO 22301 Implementation https://advisera.com/books/becoming-resilient-the-definitive-guide-to-iso-22301-implementation/ -
ISO 27001 Annex A
"Answer: The Annex A is at the end if the ISO 27001 standard. The controls objectives can be found right below the title of the sub-section of the control you want to apply."
But we cannot find Annex A.
Answer: Unfortunately Annex A is not a part of the toolkit, because it is a part of ISO 27001 standard, published by ISO (https://www.iso.org), and we cannot make it available as part of our toolkit because that would be a violation of ISO's intellectual property rights..
You can buy ISO 27001:2013 standard at this link: https://www.iso.org/standard/54534.html
In our template for Statement of Applicability you'll find a list of all the controls from the Annex A, and in the folder "08 Annex A" you will find all the templates you need to become compliant with the Annex A.
For getting an overview of Annex A, I suggest you to attend our free online ISO 27001:2013 Foundations Course (https://advisera.com/training/iso-27001-foundations-course/) -
Keeping records for certification audit
Answer:
If the organization has implemented the standard for the first time, the records should be kept from the moment when the standard was implemented and documents and records are approved. It wouldn't be reasonable to expect from organizations to keep documents required by the standard or be compliant with the standard before the implementation. -
Uncontrolled Copy and New Issues in ISO 9001 2015
So, there will be no more unreasonable & conflicting finding on each assessment..regards : sfroel -
Mejora continua
La mejora continua se lleva a cabo mediante los objetivos que establece la alta dirección. Como mínimo los objetivos de calidad deben de abordar:
- La mejora de la eficiencia interna
- Los requisitos de los clientes individuales
- El nivel de desempeño que espera tu sector del mercado .
Cada mejora requiere del compromiso de los recursos, los cuales estarán priorizados por la alta dirección, especialmente si es necesaria una inversión.
Las oportunidades de mejora se obtienen de las siguientes fuentes:
- Satisfacción del cliente
- Reclamaciones y opiniones de los clientes
- Investigación y análisis de mercado
- Aportaciones de los empleados, proveedores y otras partes interesadas
- Auditorias internas y externas del sistema de calidad
- Registros de no conformidades de producto o proceso
- Datos y características de procesos y productos, así como sus tendencias
El procesos de mejora continua e trata de un requerimiento que no es obligatorio documentar. Sin emba rgo la implementación de un procedimiento para la mejora continua es apropiado para la mayoría de los negocios.