SPRING DISCOUNT
Get 30% off on toolkits, course exams, and Conformio yearly plans.
Limited-time offer – ends April 25, 2024
Use promo code:
SPRING30

Expert Advice Community

Guest

Filling template

  Quote
Guest
Guest user Created:   Oct 15, 2019 Last commented:   Oct 15, 2019

Filling template

  1. Hello, in which document is my question: "Method for identifying requirements“ (chapter "02" of the toolkit). Where inside the document is my question: "5. Management of records for this document“ Column 4: Measure to protect the recording. The record will be the "list of requirements“. The defined measure to protect the recording doesn’t make sense to me (the German version): "Nurfalls [Stellenbezeichnung] zur Bearbeitung von Daten berechtigt ist“. Can you please explain that to me?
  2. My question is inside chapter 4 of the method for identifying requirements. How does the annual assessment of the ISMS compliance with the requirements take place? What proof is required for this?
0 0

Assign topic to the user

ISO 27001 DOCUMENTATION TOOLKIT

Step-by-step implementation for smaller companies.

ISO 27001 DOCUMENTATION TOOLKIT

Step-by-step implementation for smaller companies.

Expert
Rhand Leal Oct 15, 2019

1. Hello, in which document is my question: "Method for identifying requirements“ (chapter "02" of the toolkit).
Where inside the document is my question: "5. Management of records for this document“
Column 4: Measure to protect the recording.
The record will be the "list of requirements“. The defined measure to protect the recording doesn’t make sense to me (the German version): "Nurfalls [Stellenbezeichnung] zur Bearbeitung von Daten berechtigt ist“.

Can you please explain that to me?

First of all, sorry for this translation.

Please note that the original text in English is "Only [job title] is authorized to edit data".

Different from other records which must not change over time (only in exceptions conditions), this list of requirements is a kind of record that may change regularly due to business and external factors (e.g., new customer's security requirements, new laws, and regulations, etc.). And to ensure changes are controlled the recommendation is that a defined role is in charge of updating this record.

2. My question is inside chapter 4 of the method for identifying requirements. How does the annual assessment of the ISMS compliance with the requirements take place? What proof is required for this? 

When auditing this record, the auditor will look for the previous lists in the period defined in the "Retention time" column, and will verify which changes were made from one version to the other and which person has made the change (in this case the job title defined in the "Control for record protection" column).

Quote
0 0

Comment as guest or Sign in

HTML tags are not allowed

Oct 15, 2019

Oct 15, 2019