Start a new topic and get direct answers from the Expert Advice Community.
CREATE NEW TOPIC +Search results
11272 results
Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
BIA scope
Answer: The most suitable people to answer what activities should be considered related or unrelated to your main services are the processes owners and the key users (people that have the best knowledge of the process).
In your example, you should ask the person who handles salaries which activities he relies on to deliver his results (e.g., salaries payment), or what would be the worst thing that could happen that would prevent the salaries to be paid. From the answers of these two questions you can identify activities you should consider related to your main process.
Regarding more examples, in the video tutorials that came with your toolkit, you will see how to make considerations for what is related or not to your main process while filling out all the data regarding BIA. -
Risks and opportunities in processes
I work for a company that applies coatings on certain surfaces, that is also the scope of the current ISO 9001:2008 certificate we have; applying coatings on certain surfaces and metalizing objects. I'm really not sure how to address risks and opportunities regarding those activities. For example, do I need to address the risk a wrong kind of coating can be applied or is that too specific? I'm a little lost in the terminology that's being used.
Answer:
The standard requires organization to determine the risks and opportunities that need to be addressed to:
a) give assurance that the quality management system can achieve its intended result(s);
b) enhance desirable effects;
c) prevent, or reduce, undesired effects;
d) achieve improvement.
This includes risks and opportunities within the processes and especially the risks regarding nonconforming products that you've mentioned. You can decide to use some methodology for identification and evaluation of risks and opportunities, such as FMEA or you can just talk with people involved in the processes and find out what are the risks they are facing on day-to-day basis. Once you determine the risks, you need to take actions to address them, the actions can include documenting procedure or work instruction, sending people to training, changing the process or activity to avoid the risk, etc.
The risk you've mentioned is not too specific, actually it is the kind of the risk that should be addressed. For more information about risks and opportunities, see:
- How to address risks and opportunities in ISO 900 https://advisera.com/9001academy/blog/2016/06/21/how-to-address-risks-and-opportunities-in-iso-9001/ -
IT assets
>Can asset value (single subjective value high, medium, low) can be assigned on the CIA value?
Answer: The asset value, in terms of business objectives, results and operations, is used to help define the CIA value, not to be directly assigned to them, since a same asset maybe have different impacts on CIA, depending upon its purpose. For example, a website intended to provide relevant public information should have an availability value greater than its confidentiality value.
>Which is best formula for evaluating the asset value
>Asset value = Max (CIA)
>OR
>Asset value = average of CIA
>Asset Value = C I A
Answer: The most practical formula to evaluate the asset value in terms of CIA is MAX (CIA), where with a single value you cover the worst case scenario for CIA. Attributing for the asset a value for each aspect of the CIA allows you to better allocate resources if there is a great difference between the values (e.g., C=3, I-1, and A=1), but it makes your asset management more complex, so you should use this method only if you can justify adding such complexity in return for better resources allocation.
You should not use average of CIA because an average value can hide a high value of one aspect of CIA, which can result in an asset with less protection than needed. For example, with C=3, I-1, and A=1, the average would be 1,67, a value well bellow the value 3 attributed to confidentiality.
This article will provide you further explanation about valuing assets:
- How to assess consequences and likelihood in ISO 27001 risk analysis https://advisera.com/27001academy/iso-27001-risk-assessment-treatment-management/#assessment
This materials will also help you regarding valuing assets:
- Book ISO 27001 Risk Management in Plain English https://advisera.com/books/iso-27001-annex-controls-plain-english/ -
Difference between internal and lead auditor courses
Answer: Yes. While the Internal Auditor course main purpose covers the planning and performing of single audits, the Lead Auditor course also covers planning and management of an entire audit program (multiple audits), and the coordination of a team of auditors before and during an audit. Additionally, passing an accredited Lead Auditor course also is a prerequisite for auditors who wants to work for certification bodies.
This article will provide you further explanation about the difference between internal and lead auditor:
- What does ISO 27001 Lead Auditor training look like? https://advisera.com/27001academy/blog/2016/08/29/what-does-iso-27001-lead-auditor-training-look-like/
- ISO 27001 Internal Auditor training – Is it good for my career? https://advisera.com/27001academy/blog/2016/03/29/iso-27001-internal-auditor-training-is-it-good-for-my-career/ -
BC strategy and plans
Answer: There is indeed similarity between BC strategy and BC plan because the BC plan is a detailing of BC strategy when specific situations are considered (you can see this difference in the section one of both documents - Purpose, scope and users). For example, in BC strategy you may identify the type of database to be available for all BC plans, and in each BC plan you will detail where this database is located (e.g., server, physical address, etc.) for each business unit or site that specific BC plan covers.
So, you will find this type of duplication in every situation where you need to define high level guidelines and these must be implemented in different ways for each interested party. For example, in the BC strategy you define the general RTO (Recovery Time Objective) and RPO (Recovery Point Objective) to be achieved by the organization, and each business plan define its own RTO and RPO considering its own scenario (e.g., IT systems, financial processes, etc.) and the strategic RTO and RPO to be achieved.
Regarding if you need to fill both documents, the main criteria to consider this is the number of different conditions and BC plans you have. If you have many plans and each one of them has different conditions, it is better you have a BC strategy document to define high level conditions.
This article will provide you further explanation about business continuity strategy and plans:
- Can business continuity strategy save your money? https://advisera.com/27001academy/blog/2010/03/15/can-business-continuity-strategy-save-your-money/
- Business continuity plan: How to structure it according to ISO 22301 https://advisera.com/27001academy/knowledgebase/business-continuity-plan-how-to-structure-it-according-to-iso-22301/
By the way, in the video tutorials that came with your toolkit, you will find information about BC strategy and how to fill out BC plans. -
Audit demanded by client
We own and license a web service that stores information and displays it to users, through a front end website. One of our existing clients has just licensed it and they have provided an extensive network and security questionnaire and one of the requirements is to provide a copy of the security audit. Since we never factored this in to our license, I need to understand what the best approach to this may be, what do I need, and who I can hire to perform the task.
Answer: The first thing you should identify is which level of independence is required by the client for this security audit, since there is three possible levels: first-party audit (when your organization audits itself), second-party audit (when the client, or another organization accepted by it, audits your organization), and third-party audit (when an organization independent from your organization and from the client audits your organization).
If a first-party audit is sufficient for the client, and you al ready have an internal audit process running, you should include in your internal audit program an audit covering this web service considering the network and security questionnaire sent by the client. If you do not have an internal audit process, please consider the answer for third-party audit, presented at the end of this answer. This is the cheapest audit process, but the low degree of independence may not be sufficient for some organizations.
If a second-party audit is required, you should contact the client to identify who will be responsible for the audit (the client itself or another accepted organization), and define with this responsible the arrangements for the audit. Depending upon who will pay for the audit, this kind of audit may become onerous for you or your client, specially for you if you have many clients demanding this type of audit and each one requires different organization to perform it. In such cases, aiming for a third-party audit may prove a better option.
If a third-party audit is required, the best course of action is to consider the certification of a management system, in this case certification on ISO 27001, related to information security, since certification bodies, those who issue a certification, are accepted as highly trusted independent parties to ensure security is being properly managed by an organization.
As complement for the first part of this answer, implementing internal audit process is mandatory for certification, so if you get certified, besides being capable to provide results of a third-party audit, you also ensure you are capable to perform a first-party audit if demanded by a client.
In cases where a second-party audit is required, you can offer your certification's, or maintenance's, audit report as an option for your client.
This article will provide you further explanation about certification (third-party audit):
- Should your company go for the ISO 27001 / ISO 22301 certification? https://advisera.com/27001academy/iso-27001-certification/
This material will also help you regarding types of audit:
- Book Secure & Simple: A Small-Business Guide to Implementing ISO 27001 On Your Own https://advisera.com/books/secure-and-simple-a-small-business-guide-to-implementing-iso-27001-on-your-own/ -
Risk acceptance criteria and acceptance level
Thank you very much for your help, really appreciate it. -
Filling asset inventory
But in the Inventory of Assets table we mention each Asset just once (as I understand). So, what level of Consequence to specify in such cases?
Answer: When an asset has different levels of consequence identified in the Risk Assessment table, you should consider for the entry in the Inventory of Assets the highest value identified as a consequence in the Risk Assessment table. Considering the "Laptop" asset example (with consequence values of 1, 1, and 2), you should en try the consequence value of 2 in the Inventory of assets. This way your Inventory of Assets will always present the highest consequence an asset have to your organization. -
Using Conformio for ISO 27002
You can use Conformio for any ISO standard, because the following Conformio features are designed to be compliant with any ISO system: document management, project management (through Tasks feature), corrective actions, and nonconformities. In addition to that, Conformio has module for incident management, which can be used specifically for ISO 27001/ISO 27002.
In other words, you'll find Conformio very useful for ISO 27002 implementation and maintenance.
By the way, here you'll find several help articles on how to use Conformio: https://advisera.com/support/knowledgebase_category/conformio/