Expert Advice Community

Guest

Outsourced components

  Quote
Guest
Guest user Created:   Jan 13, 2016 Last commented:   Jan 13, 2016

Outsourced components

0 0

Assign topic to the user

ISO 27001 DOCUMENTATION TOOLKIT

Step-by-step implementation for smaller companies.

ISO 27001 DOCUMENTATION TOOLKIT

Step-by-step implementation for smaller companies.

Guest
AntonioS Jan 13, 2016

We have outsourced a couple of components of our organization. The support of our server hardware and operating system is supported by 1 company, while the datacenter where these servers sit is supported by another company. 
Question 1: How would I write this up for our asset inventory?
Question 2: Are the contracted companies asset owners or risk owners?
Question 3: Do I list the datacenter facility as a facility asset or simply identify the environmental threats for the servers there as having sharedoutsourced risks for their security control, and ensure our supplier contracts discuss mitigating those threats?
Question 4: For that matter should I ever list the facility as an asset, or simply the systems and information contained in the facility as assets?
 

Answers:

Answer 1: From my point of view, simply including them in your asset inventory (following your methodology), if these assets are related to the scope of your ISMS.
Answer 2: Yes, external companies can be asset owners and risk owners (even for those assets that are n ot part of the ISMS scope). For example, the asset owner of a server can be the IT administrator of the external company, and the risk owner can be the head of the IT department of the external company. For more information about these terms, please read this article “Risk owners vs. Asset owners in ISO 27001:2013” :  https://advisera.com/27001academy/knowledgebase/risk-owners-vs-asset-owners-in-iso-270012013/ 
Answer 3: From my point of view it is better if you list the datacenter as facility asset. Here it is important to have an asset for the datacenter (type facility), because there are threats directly related to this type of asset (there are also other threats directly related to the servers), furthermore you need to ensure that your supplier contract discuss about risks and the mitigation of threats.
Answer 4: An approach can be: Identify the facility as an asset, and also the systems and information contained on it, because they are different type of assets and have different threats/vulnerabilities. Another approach can be: Identify an unique asset and assign to it all threats/vulnerabilities related to the facility, systems and information.
Finally, this article about the asset inventory can be interesting for you “How to handle Asset register (Asset inventory) according to ISO 27001” : https://advisera.com/27001academy/knowledgebase/how-to-handle-asset-register-asset-inventory-according-to-iso-27001/

Quote
0 0

Comment as guest or Sign in

HTML tags are not allowed

Jan 13, 2016

Jan 13, 2016