Start a new topic and get direct answers from the Expert Advice Community.
CREATE NEW TOPIC +Search results
11294 results
Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
Evidences of control implementation and training and awareness program
Answer: In general, the information you have to gather to evidence a control implementation that is compliant with ISO 27001 is:
1. Risk treatment plan (clauses 6.1.3 e and 6.2), to evidence what was planned for the control implementation (e.g., policies, procedures, trainings, etc.). If the control being implemented is part of ISO 27001 Annex A, you have to be sure the mandatory documents defined there are included as deliverable of the plan
2. Records of training, skills, experience and qualifications (clause 7.2), to evidence that people performing the control are competent to do so
3. Logs of user activities, exceptions, and security events (clauses A.12.4.1 and A.12.4.3), to provide information to be evaluated and trigger other related controls (e.g., incident response)
4. Monitoring and measurement results (clause 9.1), to evidence the control is actually working
5. Results of internal audits (clause 9.2), to evidence independent evaluati on of the implemented control
6. Results of the management review (clause 9.3), to evidence management follow-up of the risk treatment plan and the control results
7. Results of corrective actions (clause 10.1), to evidence improvement
Additionally, you should need to have all the records prescribed by your own documentation as well.
2 - For the training and awareness program, can people outside the organization or the unit for which ISMS is being undertaken attend?
Answer: Yes, they can - as long the awareness or training activities do not include confidential information or any other information the organization considers that cannot be shared with external people.
This article will provide you further explanation about ISO 27001 mandatory documentation and training:
- List of mandatory documents required by ISO 27001 (2013 revision) https://advisera.com/27001academy/knowledgebase/list-of-mandatory-documents-required-by-iso-27001-2013-revision/
- How to perform training & awareness for ISO 27001 and ISO 22301 https://advisera.com/27001academy/blog/2014/05/19/how-to-perform-training-awareness-for-iso-27001-and-iso-22301/
These materials will also help you regarding ISO 27001 documentation ans training:
- Book Secure & Simple: A Small-Business Guide to Implementing ISO 27001 On Your
Own https://advisera.com/books/secure-and-simple-a-small-business-guide-to-implementing-iso-27001-on-your-own/
- Free online training ISO 27001 Foundations Course
https://advisera.com/training/iso-27001-foundations-course/ -
OHSAS objectives
Answer:
Objectives related to occupational health and safety should be in line with the OH&S Policy. For example, the objective can be to decrease number of injuries or near misses for 10% compared to the previous year or you can relate the objectives to operational controls that you established for your Occupational Health and Safety Management System.
For more information about OH&S objectives, see: How to define OHSAS 18001 objectives and programs https://advisera.com/18001academy/blog/2015/11/11/how-to-define-ohsas-18001-objectives-and-programs/ -
IT Code of Conduct and ISO 27001:2013
Answer: Generally, an organizational Code of Conduct covers rules, norms, practices and responsibilities to be followed by individuals or other organizations, aiming to protect the business and inform these parties of the organization's expectations. The content of a Code of Conduct should be aligned with an organization expects and considers proper behaviour.
Considering this, in the context of ISO 27001:2013, I would recommend you to take a look at our Acceptable Use Policy, which can be accessed here https://advisera.com/27001academy/documentation/it-security-policy/ .
This article will provide you further explanation about what to consider to implement an IT Code of Conduct and other policies:
- Seven steps for implementing policies and procedures https://advisera.com/27001academy/knowledgebase/seven-steps-for-implementing-policies-and-procedures//
These materials will also help you regarding IT Code of Conduct and other policies:
- Book Secure & Simple: A Small-Business Guide to Implementing ISO 27001 On Your
Own https://advisera.com/books/secure-and-simple-a-small-business-guide-to-implementing-iso-27001-on-your-own/
- Free online training ISO 27001 Foundations Course
https://advisera.com/training/iso-27001-foundations-course/ -
Scope definition
Answer: I assume you are referring to choosing the organization's scope first. In this case my answer is yes. The scope definition, after getting management buy-in, is one of the most important things for your ISMS implementation, because it defines which information you intend to protect, where it is located and who handles it, which will directly impact in the effort and resources you will need.
2 - Does this still form part if ISMS?
Answer: The scope definition is a mandatory requirement in ISO 27001 (clause 4.3). Regarding Top-down approach, if you pay close attention , you will note the standard sections follow an implementation sequence, so the standard also considers scope definition as one of the first things to be done (just after understanding the organization, its context, and the needs and expectations of interested parties).
This article will provide you further explanation about scope definit ion:
- How to define the ISMS scope https://advisera.com/27001academy/knowledgebase/how-to-define-the-isms-scope/
These materials will also help you regarding scope definition:
- Book Secure & Simple: A Small-Business Guide to Implementing ISO 27001 On Your
Own https://advisera.com/books/secure-and-simple-a-small-business-guide-to-implementing-iso-27001-on-your-own/
- Free online training ISO 27001 Foundations Course
https://advisera.com/training/iso-27001-foundations-course/ -
Filling the risk assessment table
Answer: Sometimes the protective effect only takes place when several controls are applied together (e.g., for physical protection, implementing security perimeter without entry controls, or vice versa, does not make much sense). If one fails, the whole protection may be compromised. In cases like this it is enough to put the result on a single row. So, you should assess the effect of all controls implemented for a particular risk to decide how to record them in your Risk Treatment Table.
By the way, together with the toolkit you have received access to video tutorial called How to Implement Risk Treatment According to ISO 27001 which explains exactly how t his is done - I would recommend you watch this tutorial because it will explain you what does the standard require, what options do you have, how to fill out the data, etc. -
Risk treatment options
If I was to find security risks and vulnerabilities, what type of methods and security configurations would be appropriate to protect and prevent impact to systems?
According to the results of the Risk Assessment, one or more of the following treatments should be considered:
- Decrease the risk: implementation of controls to reduce probability of occurrence and/or impact of the risk, thus reducing overall risk (e.g., antivirus decreases the probability to get infected by malware, and backup decreases the impact of data loss)
- Avoid the risk: stop performing the activity that causes the risk (e.g., ban BYOD because the risks of unauthorized access to the device are too high)
- Share the risk: transfer the risk to another party (e.g., buy an insurance policy for you house against fire)
- Retain the risk: accept the risk as it is, because you have no other viable alternative to apply.
This article will provide you further explanation about risk treatment:
- 4 mitigation options in risk treatment according to ISO 27001 http:/ /advisera.com/27001academy/blog/2016/05/16/4-mitigation-options-risk-treatment-according-iso-27001/Also, what types of ways can I implement and design ISMS to comply with ISO 27001?
Generally speaking, you may have three implementation alternatives to consider:
- Implementation using your own employees: you do not use any external help, only the knowledge and the capacity of your own employees.
- Using a consultant: you hire an expert from outside the organization who has experience with the implementation
- Implementation by your own with external support: your employees do most of the implementation, getting help only on specific issues from an external party
This article will provide you further explanation about ISMS implementation alternatives:
- 3 strategies to implement any ISO standard https://advisera.com/articles/3-strategic-options-to-implement-any-iso-standard/
These materials will also help you regarding risk treatment and ISMS implementation alternatives:
- Book Secure & Simple: A Small-Business Guide to Implementing ISO 27001 On Your Own https://advisera.com/books/secure-and-simple-a-small-business-guide-to-implementing-iso-27001-on-your-own/
- Free online training ISO 27001 Foundations Course https://advisera.com/training/iso-27001-foundations-course/ -
Tools for ISO 27001 risk assessment and internal audits
Answer: Depending upon the size and complexity of your scope, simple spreadsheets can help you a lot to demonstrate a risk assessment and what you should do to conduct an internal audit. Since you asked for what you can use, I suggest you to take a look at these free document previews:
- Risk Assessment Table https://advisera.com/27001academy/documentation/risk-assessment-table/
- Internal Audit Checklist https://advisera.com/27001academy/documentation/internal-audit-checklist/
These articles will provide you further explanation about risk assessment and internal audit:
- ISO 27001 risk assessment & treatment – 6 basic steps https://advisera.com/27001academy/knowledgebase/iso-27001-risk-assessment-treatment-6-basic-steps/
- How to prepare for an ISO 27001 internal audit https://advisera.com/27001academy/blog/2016/07/11/how-to-prepare-for-an-iso-27001-internal-audit/
- Ho w to make an Internal Audit checklist for ISO 27001 / ISO 22301 https://advisera.com/27001academy/knowledgebase/how-to-make-an-internal-audit-checklist-for-iso-27001-iso-22301/
These materials will also help you regarding risk assessment and internal audit:
- Book Secure & Simple: A Small-Business Guide to Implementing ISO 27001 On Your
Own https://advisera.com/books/secure-and-simple-a-small-business-guide-to-implementing-iso-27001-on-your-own/
- Free online training ISO 27001 Foundations Course
https://advisera.com/training/iso-27001-foundations-course/ -
Supplier security according ISO 27001
Answer: The mentioned guideline refers to ISO 27001 Annex A.15 (Supplier Relationships). You must implement controls related to your suppliers only if:
1- Your Risk Assessment identified any supplier-related risks your organization considers unacceptable
2- Your organization decided to implement supplier controls for any other business reason not related to information security.
3 - Your customers requirements, or any legal or regulatory requirement, demands you to implement supplier control.
If your situation is not in any of these alternatives, you do not need to implement supplier-related controls.
This article will provide you further explanation about handling supplier security:
- 6-step process for handling supplier security according to ISO 27001https://advisera.com/27001academy/blog/2014/06/30/6-step-process-for-handling-supplier-security-according-to-iso-27001/
These mat erials will also help you regarding handling supplier security:
- Book Secure & Simple: A Small-Business Guide to Implementing ISO 27001 On Your
Own https://advisera.com/books/secure-and-simple-a-small-business-guide-to-implementing-iso-27001-on-your-own/
- Free online training ISO 27001 Foundations Course
https://advisera.com/training/iso-27001-foundations-course/ -
Conducting internal audit for the first time
I recently completed an internal audit training and this is my first official audit that I will conduct. Can you please guide me what to look at and what kind of questions should I ask?
Answer:
First you need to read the standard and understand the requirements related to the processes you are about to audit. Then you need to read all procedures and records from the processes and see if they are compliant with the requirements of the standard. Afterwards you need to formulate questions to be asked during the audit. The question should provide you with "yes or no" answers and each question should be relate to ether requirement of the standard or activity within the processes you are auditing. Once you prepared the checklist and got familiar with the standard requirements and procedures used in the processes you are ready for the audit.
Here are some articles about internal audit that might be interesting to you:
- Five Main St eps in ISO 9001 Internal Audit https://advisera.com/9001academy/knowledgebase/five-main-steps-in-iso-9001-internal-audit/
- How to create a check list for an ISO 9001 internal audit for your QMS https://advisera.com/9001academy/blog/2016/07/12/how-to-create-a-check-list-for-an-iso-9001-internal-audit-for-your-qms/
- Writing an Audit Checklist for ISO 9001 Processes https://advisera.com/9001academy/blog/2014/11/25/writing-audit-checklist-iso-9001-processes/ -
Definition of terms
Answer:
By control, I assume you think of operational control in ISO 14001. Operational Controls describe specific operations
for controlling and managing the activities, processes, products, and services associated with the significant environmental aspects.
By influence, I assume you think of environmental impact. The definition of environmental impact is change to the environment, whether adverse or beneficial, wholly or partially resulting from an organization’s environmental aspects.
For more information about terms and definitions within ISO 14001, see: Glossary of Environmental Management Words https://advisera.com/14001academy/blog/2019/08/27/key-iso-14001-benefits-to-customers/nowledgebase/glossary-of-environmental-management-words/