Start a new topic and get direct answers from the Expert Advice Community.
CREATE NEW TOPIC +Search results
11293 results
Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
Cloud Service Provider assessment considerations
Answer:
One of the most useful CSA's resources is the Cloud Controls Matrix, currently on version 3.0.1. It is a mapping of CSA recommended practices to the most known standards and regulations regarding information protection. Considering ISO standards, this matrix maps CSA practices to:
ISO/IEC 27001:2013 (information security management)
ISO/IEC 27002:2013 (information security practices)
ISO/IEC 27017:2015 (information security in cloud environments)
ISO/IEC 270018:2015 (protection of PII)
So, if someone whishes to create a vendor assessment guideline alignend with CSA practices, he can use the Cloud Controls Matrix to identify which CSA recommendations are mapped to supplier management practices from ISO 27001 (items marked with A.15.x.x) and ISO 27002 (items marked with 15.x.x), and choose those that are best fit for his organization. He also can use the same method to align his guideline to ISO 27017 (s ecurity in cloud services) and ISO 27018 (protection of PII).
The Cloud Controls Matrix can be found in this link: https://cloudsecurityalliance.org/download/cloud-controls-matrix-v3-0-1/ -
Policies vs. Procedures
Answer:
Policies are clear, simple statements of how your organisation intends to conduct its services, actions or business. They provide a set of guiding principles to help with decision making. Policies don't need to be long or complicated – a couple of sentences may be all you need for each policy area.
Procedures describe how each policy will be put into action in your organisation. Each procedure should outline:
- Who will do what
- What steps they need to take
- Which forms or documents to use.
Procedures might just be a few bullet points or instructions. Sometimes they work well as forms, checklists, instructions or flowcharts.
Policies and their accompanying procedures will vary b etween workplaces because they reflect the values, approaches and commitments of a specific organisation and its culture. But they share the same role in guiding your organisation.
In terms of ISO 9001 it is more common to write a procedure for HR, Biomedical Engineering, IT, Purchasing and Warehouses, and so forth because they fit better with the attributes of a procedure mentioned above.
For more information, see:
- How to structure quality management system documentation https://advisera.com/9001academy/knowledgebase/how-to-structure-quality-management-system-documentation/ -
Mapping all controls with risks
Answer:
No. First of all, most companies won't have risks related to every control, which means that most companies won't find all controls applicable - see this article which explains that logic: The basic logic of ISO 27001: How does information security work? https://advisera.com/27001academy/knowledgebase/the-basic-logic-of-iso-27001-how-does-information-security-work/
Second, you might find some controls applicable even though there are no related risks: there are cases when you have to comply with some laws or regulations - e.g. applying encryption - even though the risk assessment does not show any related risks.
By the way, this article will explain you how this applicability is documented: The importance of Statement of Applicability for ISO 27001 https://advisera.com/27001academy/knowledgebase/the-importance-of-statement-of-applicability-for-iso-27001/ -
Asset value
Answer:
Basically the asset value is the same that the impact value, and can be calculated as an assessment of impact of loss of confidentiality, integrity and availability of information.
This article can be interesting for you “How to assess consequences and likelihood in ISO 27001 risk analysis” : https://advisera.com/27001academy/iso-27001-risk-assessment-treatment-management/#assessment
And also this article “How to write ISO 27001 risk assessment methodology” : https://advisera.com/27001academy/knowledgebase/write-iso-27001-risk-assessment-methodology/
Finally, these materials will help you to know more about the assets value and the calculation of risks:
- free online training ISO 27001 Foundations Course https://advisera.com/training/iso-27001-foundations-course/
- book Secure & Simple: A Small-Business Gu ide to Implementing ISO 27001 On Your Own https://advisera.com/books/secure-and-simple-a-small-business-guide-to-implementing-iso-27001-on-your-own/ -
Updating Quality Manual to match ISO 9001:2015
I didn't know if I should have our quality manual follow the same format as the new ISO:2015. i.e have the following clause headings.
0) Introduction
1) Scope
2) Normality references
3) Terms and definitions
4) Context of organization
5) Leadership
6) Planning
7) Support
8) Operation
9) Performance evaluation
10) Improvement
Is it advisable though to update to reflect new versions of the ISO?
Answer:
There is no requirement for Quality Manual to follow structure of the standard. The reason why companies decide to do so is because it helps them see how each of the clauses are met in their Quality Management System. Other than this, there are no reasons for adopting the clause headings of the standard in the manual.
Furthermore, the standard no longer requires organizations to have documented Quality Manual, so if you find it redundant for your QMS, you can even exclude it from your system. For more information, see: The future of the Quality Manual in ISO 9001:2015 https://advisera.com/9001academy/knowledgebase/the-future-of-the-quality-manual-in-iso-90012015/ -
Evaluating risks
Answer:
In order to evaluate risks you need to define criteria. Criteria can be based on one or several features. Usually the criteria for evaluation of risk is a severity or consequence of the risk, if the risk has big severity or consequence, it is ranked higher on the list of risks or it can be labeled as significant risk in opposition to insignificant risks with small severity or consequence.
Another feature that can be taken as a criteria for risk evaluation is frequency of occurrence or probability. Some risk can have a big consequence but it rarely happens, so such risk can be considered as insignificant or low on the list of priorities. The risk with high probability and big consequence should be considered as significant, or unacceptable and such risk should be addressed.
There are additional criteria for evaluation of risk, such as detection, that can be used but the number and type of criteria to be used will depend on the needs of the company. Smaller companies will use simpler criteria that can be qualitative or quantitative and bigger and more complex companies will use more criteria and qualitative methodology.
For more information, see: Methodology for ISO 9001 Risk Analysis https://advisera.com/9001academy/blog/2015/09/01/methodology-for-iso-9001-risk-analysis/ -
Transition from BS 25999 to ISO 22301
Answer:
ISO 22301 was developed taking into consideration BS 25999, so there are very similarities between both standards. This article can help you to know more about these similarities, and also about the differences “ISO 22301 vs. BS 25999-2 - An Infographic” : https://advisera.com/27001academy/blog/2012/05/22/iso-22301-vs-bs-25999-2-an-infographic/
And another standard related to the business continuity, commonly used in USA, is the NFPA 1600. This article can be also interesting for you “NFPA 1600 vs. ISO 22301 - Similarities and differences” : https://advisera.com/27001academy/blog/2013/11/05/nfpa-1600-vs-iso-22301-similarities-and-differences/
Finally, this ebook about the ISO 22301 can be also interesting for you “Becoming resilient, the definitive guide to ISO 22301 implementation” : https://advisera.com/books/becoming-resilient-the-definitive-guide-to-iso-22301-implementation/ -
Transition from 2008 to 2015 of ISO 9001
Answer:
The most important thing about documentation in new version of the standard is that it refers to it as "documented information" and this term includes both documents and records. There are far less requirements for documentation in 2015 revision of the standard, there is no longer requirement for Quality Manual and six mandatory procedures as in 2008 revision.
In order to conduct the transition, you need to update your existing documents to adapt them to new requirements. Almost every requirement is altered to some extent and clause numbering is changed so every document will require at least minor updates. Also you will have to decide whether to keep the documents and procedures that are not mandatory any more, for example although the manual is no longer mandatory, lots of companies decide to keep it because they find it useful for their QMS.
For more information, see:
- How to make the transition f rom ISO 9001:2008 revision to the 2015 revision https://advisera.com/9001academy/blog/2015/10/06/how-to-make-the-transition-from-iso-90012008-revision-to-the-2015-revision/
- New approach to document and record control in ISO 9001:2015 https://advisera.com/9001academy/blog/2015/06/30/new-approach-to-document-and-record-control-in-iso-90012015/ -
Methodology for an IT audit
Answer:
ISO 27001 is developed for the establishment of an Information Security Management System, which means that this standard is for the protection of the information, so, basically ISO 27001 gives you a framework to identify risks and treat them implementing security controls, many of them are directly related to IT (but not all). So, this standard is not specifically developed to perform an IT audit, but you can use their security controls, although in the Annex A of ISO 27001 you can find a brief description of 114 security controls, while in the ISO 27002 you can find the same security controls but with a guide about how to implement each control.
So, maybe you can use the Annex A of ISO 27001 to select a group of security controls that you want to audit (related to IT), and if you need more information about each control you can see ISO 27002.
This article can be interesting for you “The basic logic of ISO 27001: How does information security work?” : https://advisera.com/27001academy/knowledgebase/the-basic-logic-of-iso-27001-how-does-information-security-work/
And this article about how to develop a checklist for an internal audit for ISO 27001 can be also interesting for you “How to make an Internal Audit checklist for ISO 27001 / ISO 22301” : https://advisera.com/27001academy/knowledgebase/how-to-make-an-internal-audit-checklist-for-iso-27001-iso-22301/
Finally, these materials will help you to know more about the security controls of ISO 27001 and how to audit them:
- free online training ISO 27001 Foundations Course https://advisera.com/training/iso-27001-foundations-course/
- free online training ISO 27001 Internal Auditor https://advisera.com/training/iso-27001-internal-auditor-course/
- book Secure & Simple: A Small-Business Guide to Implementing ISO 27001 On Your Own https://advisera.com/books/secure-and-simple-a-small-business-guide-to-implementing-iso-27001-on-your-own/