SPRING DISCOUNT
Get 30% off on toolkits, course exams, and books.
Limited-time offer – ends May 26, 2022
Use promo code:
SPRING30

Expert Advice Community

Guest

Annex A Controls in Conformio

  Quote
Guest
Guest user Created:   Feb 01, 2022 Last commented:   Feb 01, 2022

Annex A Controls in Conformio

1. Seems like you are informing me through Conformio that I should prepare Policies with Annex A controls to incorporate into them (as seems in Project Plan). In example Title : Incident Response Policy, we will mention the annex A controls in it. Shouldn't we just have a folder A.16 Incident Security Incident Management and files A.16.1 Responsibilities, A.16.1.2 Reporting Information Security Events, A.16.1.3 Reporting Information Security Weaknesses, A .16.1.4 Assessment of and Decision on Information Security Events, etc.? 2. Is there a Tool JUST on Risk Assessment?

Assign topic to the user

ISO 27001 DOCUMENTATION TOOLKIT

Step-by-step implementation for smaller companies.

ISO 27001 DOCUMENTATION TOOLKIT

Step-by-step implementation for smaller companies.

Expert
Rhand Leal Feb 01, 2022

1. Seems like you are informing me through Conformio that I should prepare Policies with Annex A controls to incorporate into them (as seems in Project Plan). In example Title : Incident Response Policy, we will mention the annex A controls in it. Shouldn't we just have a folder A.16 Incident Security Incident Management and files A.16.1 Responsibilities, A.16.1.2 Reporting Information Security Events, A.16.1.3 Reporting Information Security Weaknesses, A .16.1.4 Assessment of and Decision on Information Security Events, etc.?

Please note that organizing documents as you suggest only makes them more difficult to read and maintain.

Considering your example, instead of a single document defining how incident management is implemented you would have to keep seven independent documents.

Additionally, when you have a document that refers to controls from different sections (e.g., the Supplier Security Policy refers to controls from sections A.7, A.8., A.14, and A.15), reading and maintenance become even more difficult.

 For further information, see:

2. Is there a Tool JUST on Risk Assessment?

To perform just risk assessment we have the Risk Assessment Toolkit (https://advisera.com/27001academy/iso-27001-22301-risk-assessment-toolkit/) which comprises of the following documents:

  • Risk Assessment and Risk Treatment Methodology
  • Risk Assessment Table
  • Risk Treatment Table
  • Risk Assessment and Treatment Report
  • Statement of Applicability
  • Risk Treatment Plan

This article will provide you a further explanation about risk assessment:

These materials will also help you regarding risk assessment:

Quote
0 0

Comment as guest or Sign in

HTML tags are not allowed

Feb 01, 2022

Feb 01, 2022

Suggested Topics