Search results

Home / Search

Category:
Select
Select

11292 results

Guest

Guest

Create New Topic As guest or Sign in

HTML tags are not allowed

Select

Assign topic to the user

  • Establishment of the scope of the ISMS ISO 27001:2013

    First is important to note that an ISMS scope can be defined in terms of processes, location, or information to be protected.

    Considering that, and your stated scenario, you should define your ISMS scope either in terms of processes (development process, sales process, account process, etc.) or information to be protected (e.g., customer information, financial information, etc.).

    By the way, included with your toolkit you have access to a video tutorial that can help you define your ISMS scope. This video contains examples.

    For further information, see:
    - Tool for defining the ISO 27001 ISMS scope https://advisera.com/insight/chatbot-tool-iso-27001-scope/
    - How to define the ISMS scope https://advisera.com/27001academy/knowledgebase/how-to-define-the-isms-scope/
    - Defining the ISMS scope if the servers are in the cloud https://advisera.com/27001academy/blog/2017/05/22/defining-the-isms-scope-if-the-servers-are-in-the-cloud/
    - Problems with defining the scope in ISO 27001 https://advisera.com/27001academy/blog/2010/06/29/problems-with-defining-the-scope-in-iso-27001/

  • Management of change

    Requirements for change management in an ISO 22301 BCMS can be found in the Business Continuity Policy template, section 3.8 – Changes in the BCMS, located in folder 03 Business Continuity Policy.

    ISO 22301 does not prescribe a change management procedure to be written, but in case you decide you need one, please take a look at this Change Management Policy template for ISO 27001. Even though it is an ISO 27001 document, it can be adapted to be used with ISO 22301:

    - https://advisera.com/27001academy/documentation/change-management-policy/ 


    For further information, see:
    - How to manage changes in an ISMS according to ISO 27001 A.12.1.2 https://advisera.com/27001academy/blog/2015/09/14/how-to-manage-changes-in-an-isms-according-to-iso-27001-a-12-1-2/

  • Risk Register question

    Since you are considering the weak password vulnerability to be related to people's behavior, then it makes sense to consider it for Human-related assets in this case, but please note that you can also have situations where this vulnerability can also be defined for IT equipment.

    For example, some equipment only allows pin numbers as passwords, or it is not possible to enforce password rules o them, then in this case you can also define weak passwords as a vulnerability for IT equipment. You can use only one of these two vulnerabilities, or you can use both if they are all applicable.

  • CE Marking

    1 - Bewtween the end of June and when they get the renewal, can I sell the products I hold that were manufactured under a valid CE, even though they will be out of date?
    For all medical devices that are produced until the expiry date of the MDD certificate, you can sell until the expiry date of the device.

    2 - If I purchase new products that have been produced without a valid CE, they will not be compliant will they?
    The manufacturer is not allowed to produce the device anymore after the expired certificate.

  • Inquiry about the following ISO27001 controls

    Тут ресурсе можно отыскать нужную информацию. https://brunet-ka.ru/style/2026-06-02-istoriya-sozdaniya-onlayn-kazino-sweet-ot-idei-do-mezhdunarodnogo-brenda.html

  • how close treatments

    You need to gather information to evidence that actions taken to treat the risk were performed according to the decision made, and that expected results were achieved.

    For example, in case you have a data loss risk and the decision is to treat the risk by including that data in a backup routine, then you need to evidence the backup schedule covering the related data, and the results of performed backup to show that the data as indeed backed up.

    This article will provide you with further explanation about risk treatment:

  • Internal audit of management systems and GDPR

    In general this is not a breach of GDPR because there are no significant risks to the freedoms and rights of the data subjects, but you need to take a few things into consideration to make sure that the processing is fully compliant with the GDPR requirements. Since the name and position of employees are personal data per article 4 GDPR – Definitions, listing these categories of personal data in different reports and attachments is considered to be the processing of personal data. Whenever you are assessing whether the processing of personal data is GDPR-compliant, you must make sure that the processing is necessary (and the same objective cannot be obtained without processing personal data) and that it respects all GDPR principles described in Article 5 GDPR - Principles relating to the processing of personal data:

    • Lawfulness, fairness, and transparency (employees understand that their data is published in these reports).
    • Purpose limitation (there is a clear scope of processing).
    • Data minimization (only data necessary for the purpose is being processed).
    • Accuracy.
    • Storage limitation (define clear retention timelines after which the data should be anonymized).
    • Security
       

    The legal ground for this processing could be the legitimate interest of the organization to create meaningful reports that can be used internally and that allows other employees to contact people who worked for these reports/audits. In this case, you should also perform a Legitimate Interest Assessment and allow employees to exercise their right to objection, according to article 21 GDPR – Right to object.

     

    Please also consult these links:

  • A.7.9 Clause

    Control A.7.9 - Security of assets off-premises, refers to practices such as:

    • protecting assets when not attended in public or off-premises insecure areas (e.g., hotel lobbies)
    • keep track of users to which assets are transferred when they are off-premises
    • ensure proper authorization is granted before assets are taken off-premises  

    Control A.7.9 is the new identification of control A.11.2.6, and for further information, see:

  • Non conformities - entering corrective actions

    Through the Nonconformity Register, you need first to open a Nonconformity.

    Only after the nonconformity is open is that you can start assigning tasks and defining deadlines.

    For further information, see:

  • New implementation: ISO 27001:2013 + ISO 27002:2022

    First of all, sorry for this confusion.

    Regarding your justification, the best course of action is to ask your certification body if it is acceptable to it because you are talking about using a 2022 set of controls for an ISO 27001:2013 certification (in theory this is acceptable, but your certification body will have the final decision).

    Our previous answer took into consideration you stated that you are finishing section 9, and unless it is imperative you implement the new controls before March 2023 (e.g., there is a legal requirement, or it will bring you a greater competitive advantage), a smoother transition would be more recommendable, and it is possible.
Page 89 of 1130 pages

Didn’t find an answer?

Start a new topic and get direct answers from the Expert Advice Community.

CREATE NEW TOPIC +