Start a new topic and get direct answers from the Expert Advice Community.
CREATE NEW TOPIC +Search results
11294 results
Guest
Guest
Create New Topic As guest or Sign in
Assign topic to the user
-
Application risk assessment
Answer:
If you mean how to perform the risk assessment for a software, basically you need to perform the risk assessment in the same way that for another asset, identifying threats/vulnerabilities and calculating the risk considering the impact and the likelihood of the threats, but in the case of software, you need to identify threats/vulnerabilities specifically related to the software (for example, regarding threats: software errors, unauthorized use of software, malicious code, unauthorized installation of software, etc. and regarding vulnerabilities: complicated user interface, default passwords not changed, insufficiente software testing, etc.). Here you can see a catalogue of threats/vulnerabilities “Catalogue of threats & vulnerabilities” : https://advisera.com/27001academy/knowledgebase/threats-vulnerabilities/
This article can be also useful for you “ISO 27001 risk assessment: How to match assets, threats and vulnerabilities” : https://advisera.com/27001academy/knowledgebase/iso-27001-risk-assessment-how-to-match-assets-threats-and-vulnerabilities/ cademy/knowledgebase/iso-27001-risk-assessment-how-to-match-assets-threats-and-vulnerabilities/
And also this one “How to write ISO 27001 risk assessment methodology” : https://advisera.com/27001academy/knowledgebase/write-iso-27001-risk-assessment-methodology/
Finally, our online course can be also interesting for you because we give more information about the risk assessment “ISO 27001:2013 Foundations Course” : https://advisera.com/training/iso-27001-foundations-course/ -
System access by the security guard
Answer:
I am not sure what do you mean with security guards, but generally in an ISMS the CISO is responsible for the coordination of all activities related to the securing the information in a company, so, from my point of view, in your case, the CISO should define the access control policy, and in accordance with this policy, an expert technical (or any other person with sufficient knowledge about how to implement technically the access control policy) could give access to the system to the different employees.
This article can help you "How to handle access control according to ISO 27001" : https://advisera.com/27001academy/blog/2015/07/27/how-to-handle-access-control-according-to-iso-27001/
And our online course can be also interesting for you because we give more information about the ISMS and the access control “ISO 27001:2013 Foundations Course” : https://advisera.com/training/iso-27001-foundations-course/ -
Structure for a project plan
In this video tutorial you can see a filled sample of the Project plan: https://advisera.com/27001academy/tutorial/free-tutorial-how-to-set-up-iso-27001-project-writing-the-project-plan/ -
Existing controls decrease the level of risk
Nice topic!! always helpful. Thanks a lot! -
Guide for Indicators and risk assessment
Answer:
If your question is about measurement, ISO 27001 does not have this information, but you can find in ISO 27004 a complete guide of best practices about how to measure an Information Security Management System (completely compatible with ISO 27001). So, this standard can help you to develop formulas that can help you to assess every control in an organization.
Anyway, this article can help you “How to perform monitoring and measurement in ISO 27001” : https://advisera.com/27001academy/blog/2015/06/08/how-to-perform-monitoring-and-measurement-in-iso-27001/
If your question is about the risk assessment, ISO 27001 simply defines requirements about the risk management, so ISO 27001 is not a guide, but you can use ISO 27005 -which a guide of best practices for the development of the risk management- as guide to perform the risk assessment.
This article can be also interesting for you “How to write ISO 270 01 risk assessment methodology” : https://advisera.com/27001academy/knowledgebase/write-iso-27001-risk-assessment-methodology/
And also this one “ISO 27001 risk assessment & treatment - 6 basic steps” : https://advisera.com/27001academy/knowledgebase/iso-27001-risk-assessment-treatment-6-basic-steps/
Finally, our online course can be also interesting for you because we give more information about the measurement of an Information Security Management System, and also about the risk assessment “ISO 27001:2013 Foundations Course” : https://advisera.com/training/iso-27001-foundations-course/ -
Incorporating ISMS scope and policy into QMS
Answer:
Yes, the best way to maintain both quality and information security management systems is to create integrated management system that will fulfill requirements of both ISO 9001 and ISO 27001. Besides information security policy and the scope there are a lot of common requirements of both standards. There are clauses 7, 9 and 10 of ISO 27001:2013 and ISO 9001:2015 with practically the same requirements so they can be addressed at the same time.
For more information, see: Using ISO 9001 for implementing ISO 27001 https://advisera.com/27001academy/blog/2010/03/08/using-iso-9001-for-implementing-iso-27001/ -
Incident and Change Management in two separate SW tools?
Answer:
Generally, I would suggest to keep all processes in one tool i.e. that you manage all processes with single SW solution. Reason for that is that you will have all information in one place and many information will be transferred automatically between process activities (e.g. you enter only once information in Incident Management and them when you open a Problem ticket or Change request - same data will be transferred). If you don't have that (you asked for risks) - then there is a chance that some information will be lost (e.g. asset information which you need for Incident management as well as Change Management). -
Estimating the price for risk assessment
Answer:
When acting as a consultant, you normally charge per hour or per day - for risk assessment jobs it is usually per day. To calculate the amount of time you'll need for your job, you have to know the following:
- Are you going to perform the interviews with all the department heads, or are they going to fill out the risk assessment sheets themselves
- Are you going to participate in determining the security controls, or will the client do this on their own
- Which other documents should you write
By the way, as part of our ISO 27001 Consultant Toolkit https://advisera.com/27001academy/consultants/ you'll find a document called "Division of tasks & time plan" which describes all the tasks in more detail, together with the expected timing for each.
In my book Secure & Simple you'll find a detailed explanation of the risk assessment process: https://advisera.com/books/secure-and-simple-a-small-business-guide-to-implementing-iso-27001-on-your-own/
This article may also help you: 3 phases of delivering an ISO 27001/ISO 22301 consulting job https://advisera.com/27001academy/blog/2015/09/28/3-phases-of-delivering-an-iso-27001iso-22301-consulting-job/ -
Business Continuity or Disaster Recovery?
Answer:
I am sorry but I am not not sure what do you mean, but if your question is related to ISO 27001:2013, to be compliant with the standard, you can implement only a Disaster Recovery Plan (DRP) as a minimum (which is related to the IT infrastructure), keeping in mind that the DRP should be based on the results of the risk assessment.
If your question is related to ISO 22301, you need to implement the Business Continuity and the Disaster Recovery.
For more information about the Disaster Recovery and the Business Continuity, please read this article “Disaster recovery vs Business continuity” : https://advisera.com/27001academy/blog/2010/11/04/disaster-recovery-vs-business-continuity/
Finally, our online course can be also interesting for you because we give more information about the Business Continuity “ISO 27001:2013 Foundations Course” : https://advisera.com/training/iso-27001-foundations-course/ -
Certification that better suites a Health Maintenance Organization
Answer:
From the point of view of information security, the best certification could be ISO 27001, because this standard is the most important in the world, and is specifically developed for the protection of the information.
You can also use ISO 27001 together with ISO 27799, which is another standard specifically developed for the protection of personal health information.
This article can be interesting for you “How ISO 27001 and ISO 27799 complement each other in health organizations” : https://advisera.com/27001academy/blog/2016/06/13/how-iso-27001-and-iso-27799-complement-each-other-in-health-organizations/
And our online course can be also interesting for you because we give more information about ISO 27001 “ISO 27001:2013 Foundations Course” : https://advisera.com/training/iso-27001-foundations-course/