Expert Advice Community

Guest

Doubts regarding the policy, scope ISO 27001:2013

  Quote
Guest
Guest user Created:   Aug 05, 2020 Last commented:   Aug 05, 2020

Doubts regarding the policy, scope ISO 27001:2013

Quisiera saber como puedo plantearme el hacer los procedimientos de mi empresa si el 95% de mi infraestructura esta en AWS.
Por ejemplo, quería pensar en si AWS puede compartirme su SOA para conocer sus objetivos y su justificación de los controles y asi alinearlos con los de AWS.
Los únicos equipos que están en las instalaciones son las PC y todas accesan via VPN a AWS.

0 0

Assign topic to the user

ISO 27001 DOCUMENTATION TOOLKIT

Step-by-step implementation for smaller companies.

ISO 27001 DOCUMENTATION TOOLKIT

Step-by-step implementation for smaller companies.

Expert
Rhand Leal Aug 05, 2020

I would like to know how I can consider doing my company's procedures if 95% of my infrastructure is on AWS.
For example, I wanted to think about whether AWS can share their SOA with me to learn about their goals and rationale for controls and align them with those of AWS.
The only computers that are in the facilities are the PCs and all access via VPN to AWS.

Regarding the ISMS scope and policies, you only need to focus on the part of the cloud infrastructure that you have direct control over (this will depend on the contracted cloud service - i.e. you would include data for SaaS, or data and application software for IaaS.).

Examples of what needs to be done within the company are: security training and awareness, access control (defining who has the access, periodic review, etc.), etc.

The part controlled by AWS you can handle through controls from section A.15 - Supplier relationships. In short, you need to identify the relevant risks related to the infrastructure controlled by AWS and check if the way they handle such risks is acceptable for your organization, and are properly documented in the Terms of Service. For that your understanding is correct, you can ask for the AWS SoA, so you can evaluate the applied controls, and check if they are included as security clauses in the Terms of Service. 

You'll find a more detailed explanation here:

Quote
0 0

Comment as guest or Sign in

HTML tags are not allowed

Aug 05, 2020

Aug 05, 2020

Suggested Topics