Expert Advice Community

Guest

Risk treatment plan

  Quote
Guest
Guest user Created:   Apr 23, 2021 Last commented:   Apr 23, 2021

Risk treatment plan

hola, quiero hacer una consulta. Si el Plan de tratamiento de riesgo, es considerado como "Plan de acción" ¿pueden incluirse en en el plan los objetivos de seguridad de la información?

0 0

Assign topic to the user

Assign

ISO 27001 DOCUMENTATION TOOLKIT

Step-by-step implementation for smaller companies.

ISO 27001 DOCUMENTATION TOOLKIT

Step-by-step implementation for smaller companies.

Expert
Rhand Leal Apr 23, 2021

Hello, I want to make an inquiry. If the Risk Treatment Plan is considered an "Action Plan", can the information security objectives be included in the plan?

ISO 27001 is pretty flexible when it comes to documenting your security objectives - you can write them in your Information Security Policy, in the Statement of Applicability, or in some separate document.

When using our ISO 27001 Documentation Toolkit, you can document the general ISMS objectives in the Information Security Policy, and specific objectives for controls (or groups of controls) in the Statement of Applicability.

Including the information security objectives within the risk treatment plan, which can be considered an “Action plan”, or in the asset list would not be efficient, because a single information security objective can be linked to many actions in the plan or assets in the assets list, what would make them very difficult to understand and maintain.

This article will also help you: 

In this free online training, you'll find detailed guidance on setting the objectives: 

Quote
0 0

Comment as guest or Sign in

HTML tags are not allowed

Apr 23, 2021

Apr 23, 2021

Suggested Topics