Problems with inventory of assets
Assign topic to the user
Answer:
There are a couple of things that need to be cleared out here:
1) ISO 27001 does not require you to write a documented procedure related to control A.8.1.1
2) ISO 27001 clauses 7.5.1 and 8.1 allow you to choose which documents (i.e. policies, procedures and others) are important enough to write them down
3) Defining a process does not mean that you have to write a document. It simply means that you have to define who is responsible for what, when and how - this can be done verbally or in writing.
4) Since you did not manage your inventory of assets properly, you have two options: (a) to setup a process without writing a document, or (b) to setup a process by writing a procedure.
This article will also help you: How to handle Asset register (Asset inventory) according to ISO 27001 https://advisera.com/27001academy/knowledgebase/how-to-handle-asset-register-asset-inventory-according-to-iso-27001/
These materials will also help you regarding asset inventory:
- Book Secure & Simple: A Small-Business Guide to Implementing ISO 27001 On Your
Own https://advisera.com/books/secure-and-simple-a-small-business-guide-to-implementing-iso-27001-on-your-own/
- Free online training ISO 27001 Foundations Course
https://advisera.com/training/iso-27001-foundations-course/
Please what is the substance or modalities in developing a process without documenting and approving such a process. If am assigned a responsibility to carry out a task I thought am supposed to document the procedure involved so that if I resign tomorrow someone else guided by the documented procedure can seamlessly continue the work.
If you were to document each and every process, this would mean you would have hundreds of documents - so no, it is not mandatory to document every process.
Developing a process means you have to define exactly what are the inputs, what are the steps in performing certain activities, who is responsible, what is the timing, what are the outputs, etc.
If you do not want to document that process, this means you have to agree with all people involved exactly how this is done, in detail.
If you want to document that process, you simply have to write down everything you have defined.
This article can also help you: 8 criteria to decide which ISO 27001 policies and procedures to write https://advisera.com/27001academy/blog/2014/07/28/8-criteria-to-decide-which-iso-27001-policies-and-procedures-to-write/
Comment as guest or Sign in
Sep 11, 2018