Start a new topic and get direct answers from the Expert Advice Community.
CREATE NEW TOPIC +Search results
11275 results
Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
Security controls and the internal audit
Answer:
Some certification bodies requires you to check all security controls during the first internal audit, so our recommendation is that you review all the security controls during the initial internal audit.
There is no global accepted way, but you can distribute the 114 controls (133 control was in the previous version of the standard, not in the current) in the way that you want. For example, maybe you can review 1/3 of security controls each year.
By the way, maybe this article can be interesting for you, because can help you to perform the internal audit “How to make an Internal Audit checklist for ISO 27001 / ISO 22301” : https://advisera.com/27001academy/knowledgebase/how-to-make-an-internal-audit-checklist-for-iso-27001-iso-22301/
And maybe this article about the transition from ISO 27001 20 05 revision to 2013 revision can be also interesting for you “How to make a transition from ISO 27001 2005 revision to 2013 revision” : https://advisera.com/27001academy/knowledgebase/how-to-make-a-transition-from-iso-27001-2005-revision-to-2013-revision/
Finally, these materials will help you to know more about the internal audit:
- free online training ISO 27001 Foundations Course https://advisera.com/training/iso-27001-foundations-course/
- book Secure & Simple: A Small-Business Guide to Implementing ISO 27001 On Your Own https://advisera.com/books/secure-and-simple-a-small-business-guide-to-implementing-iso-27001-on-your-own/ -
ISO 27001 for health organizations
Answer:
ISO 27001 is not specifically developed for health organizations, but there is also another ISO standard that can help you: ISO 27799.
So, you can implement an Information Security Management System based on ISO 27001, and complement it with the ISO 27799, which basically is a guide of best practices about security controls related to health organizations.
From my point of view, these standard are the best option to protect information in health organizations.
This article can be useful for you “How ISO 27001 and ISO 27799 complement each other in health organizations” : https://advisera.com/27001academy/blog/2016/06/13/how-iso-27001-and-iso-27799-complement-each-other-in-health-organizations/
Finally, these materials will help you to know more about the ISO 27001:
- free online training ISO 27001 Foundations Course https://advisera.com/training/iso-27001-foundations-course/
- book Secure & Simple: A Small-Busi ness Guide to Implementing ISO 27001 On Your Own https://advisera.com/books/secure-and-simple-a-small-business-guide-to-implementing-iso-27001-on-your-own/ -
Certification against ISO 27018
ISO 27018 is not a certifiable standard. What an organization can offer to its customers is being ISO 27001 certified and include in its Statement of Aplicability (SOA) controls with ISO 27018 recomendations. That will accomplish what its customers expect. See more about SOA [here](https://advisera.com/27001academy/knowledgebase/the-importance-of-statement-of-applicability-for-iso-27001/). -
Cloud service customers and ISO 27018
Answer:
ISO 27018 is not a certifiable standard. It is a code of practice that can be used to support certifiable management systems, like ISO 27001 for information security management systems. For more information click [here]( https://advisera.com/27001academy/blog/2015/11/16/iso-27001-vs-iso-27018-standard-for-protecting-privacy-in-the-cloud/)
So, a cloud service customer could be certified against ISO 27001 and include in his/her Statement of Aplicability (SOA) controls with ISO 27018 recomendations, but this decision is up to him/her, and cannot be enforced. To know more about SOA click [here](https://advisera.com/27001academy/knowledgebase/the-importance-of-statement-of-applicability-for-iso-27001/) -
PII role identification
Answer:
Its a relative question, depending upon if it has its own data on this cloud service it uses, because:
- When you talk about your own data on the cloud service you use, you are the PII principal. You define by your own how the data can be used.
- When you deal with your customer data on the cloud service you use, you are the PII controller. You receive personal data from customers (the PII principals) and use a third party (the PII processor) to perform operations previously agreed with customers. -
Certification against ISO 27108
Answer:
ISO 27018 is not a certifiable standard. It is a code of practice that can be used to support certifiable management systems, like ISO 27001 for information security management systems. For more information click [here](https://advisera.com/27001academy/blog/2015/11/16/iso-27001-vs-iso-27018-standard-for-protecting-privacy-in-the-cloud/)
In case someone decides to use ISO 27001 to implement PII controls in a certifiable manner, either principal, controller and processor can be part of the certified scope, but with different purposes:
- For the PII principal, the certification purpose would be to ensure the PII principal can demand and verify actions from those who collect, store and process his/her PII
- For the PII controller and PII processor, the certification purpose would be to ensure they protect properly the PII they collect, store and process from their users -
Practical example of ISO 27018 PII processor, principal and controller
Answer:
Consider the following scenario: John wants to make a bank transfer, and asks Mark, his account manager, to arrange this operation. Mark receives the bank transfer information (account number, value to be transfered and transfer date) from John and authorizes Bill, his assistant, to do the bank transfer.
- John are the PII principal. The PII required for the bank transfer, the account data, is related to him.
- Mark, the account manager, is the PII controller. He is the one, besides John, who can authorize the use of John's PII to perform the bank transfer.
- Bill, Mark's assistant, is the PII processor. It is him who uses John's PII to perform the bank transfer in accordance with Mark's instructions (value to be transfered and transfer date, sent by John). -
ISO 14001 vs ISO 14025
Answer:
ISO 14001 - Environmental management system is a standard that provides a framework for environmental protection. It does not defines what kind of control you need to establish for environmental protection rather defines processes for identification, evaluation and control of significant environmental aspects in the company. For more information, see: ISO 14001: What is it, how does it work and why use it? https://advisera.com/14001academy/what-is-iso-14001/
ISO 14025 establishes the principles and specifies the procedures for developing Type III environmental declaration programmes and Type III environmental declarations. It specifically establishes the use of the ISO 14040 series of standards in the development of Type III environmental declara tion programmes and Type III environmental declarations. ISO 14025:2006 establishes principles for the use of environmental information.
Type III environmental declarations as described in ISO 14025 are primarily intended for use in business-to-business communication, but their use in business-to-consumer communication under certain conditions is not precluded.
As you can see, the standards are dealing with different things, if you want to establish environmental management system, you need to go with ISO 14001. ISO 14025 is used only for developing declarations and communication between businesses. -
How ISO 27001 and ISO 27002 are related
Answer:
The relation between ISO 27001 and ISO 27002 is simple: ISO 27001 establishes requirements for an Information Security Management System, and includes the Annex A with 114 security controls. ISO 27002 is a guide of best practices for the implementation of the 114 security controls of the Annex A of ISO 27001.
Really you only need to implement the necessary security controls after the risk analysis, and you will nee d ISO 27002 only if you need specific information about how to implement the security controls of Annex A of ISO 27001. This article can be interesting for you “The basic logic of ISO 27001: How does information security work?” : https://advisera.com/27001academy/knowledgebase/the-basic-logic-of-iso-27001-how-does-information-security-work/
And also this article "ISO 27001 vs. ISO 27002" : https://advisera.com/27001academy/knowledgebase/iso-27001-vs-iso-27002/
Regarding the threats/vulnerabilities, this article can be also interesting for you, because you can see a complete list of them “Catalogue of threats & vulnerabilities” : https://advisera.com/27001academy/knowledgebase/threats-vulnerabilities/
Finally, these materials will help you to know more about the ISO 27001:
- free online training ISO 27001 Foundations Course https://advisera.com/training/iso-27001-foundations-course/
- book Secure & Simple: A Small-Business Guide to Implementing ISO 27001 On Your Own https://advisera.com/books/secure-and-simple-a-small-business-guide-to-implementing-iso-27001-on-your-own/ -
ISO 27001, CISA and COBIT
Answer:
I am sorry but you cannot implement CISA in a company because it is only a certification for people. Regarding COBIT, this standard is focused on IT governance, which also includes the information security, but has a different objective.
So, if you need to manage the information security, the best standard from my point of view is ISO 27001, because is specifically developed for this, while COBIT is developed for IT governance.
This article can show you the benefits of ISO 27001 “Four key benefits of ISO 27001 implementation” : https://advisera.com/27001academy/knowledgebase/four-key-benefits-of-iso-27001-implementation/
And also this free webinar “ISO 27001 benefits: How to obtain management support” : https://advisera.com/27001academy/webinar/iso-27001-benefits-how-to-get-management-buy-in-free-webinar-on-demand/
Finally, these materials will help you to know more about the benefits of ISO 27001:
- free online training ISO 27001 Foundations Course https://training.advisera. com/course/iso-27001-foundations-course/
- book Secure & Simple: A Small-Business Guide to Implementing ISO 27001 On Your Own https://advisera.com/books/secure-and-simple-a-small-business-guide-to-implementing-iso-27001-on-your-own/