Guest user Created: Jan 13, 2016 Last commented: Jan 13, 2016

Implement all the controls before certification audit?

ISO 27001 & 22301

For SOA, status should be Implemented for all applicable controls before final audit or even Planned is acceptable.

0 0

Assign topic to the user

Select user

Guest

DejanK Jan 13, 2016

Answer:

If you go for the certification audit, you should have most of your controls implemented, and make sure that controls that mitigate the biggest risks are fully implemented.

In other words, you can leave only smaller number of less significant controls to be implemented after the certification. In such case, you have to ask risk owners to accept the residual risks.

Quote

0 1

Comment as guest or Sign in

HTML tags are not allowed

Name *

Email *

I accept the Privacy and Terms

Notify me when someone replies

Jan 13, 2016

Expert Advice Community