Expert Advice Community

Guest

Separate Risk Assessment

  Quote
Guest
Guest user Created:   Oct 28, 2020 Last commented:   Oct 29, 2020

Separate Risk Assessment

I'm currently working for a bank and we have around 250 plus branches..
We have a requirement for all our branches to get complied with ISO 27001:2013.
What my question is how to approach this task?
We are currently in the process of certifying our head office..
Do we need to conduct separate risk assessments and asset inventory for each branch. Isn't there an easy way?

0 0

Assign topic to the user

ISO 27001 DOCUMENTATION TOOLKIT

Step-by-step implementation for smaller companies.

ISO 27001 DOCUMENTATION TOOLKIT

Step-by-step implementation for smaller companies.

Expert
Rhand Leal Oct 28, 2020

I'm assuming that at the moment only your head office will be ISO 27001 certified, and the other units will work to fulfill ISO 27001 requirements, not seeking certification at this moment.

Considering that, a good approach would be to split the branches into groups with similar characteristics (e.g., size, location, etc.), so you can identify general solutions for them and let them work on their specifics. ISO 27001 does not require a separate risk assessment for each branch.
 
For example, considering the asset inventory, you can have a single general inventory covering as many branches as possible, and specific inventories according to the needs of each branch. In the case of risk assessment, you can start with a general risk assessment covering all branches, and include specific risks for specific branches as needed.

In situations like this, the best approach is "start global, specify local", i.e., define as many general solutions as possible, allowing each branch to customize them according to their needs (based on results of risk assessment and applicable legal requirements).  

These articles will provide you a further explanation about risk assessment and inventory:

Quote
0 1
Guest
Wageesha Oct 29, 2020

Thank you, @Rhand Leal

Quote
0 0

Comment as guest or Sign in

HTML tags are not allowed

Oct 28, 2020

Oct 29, 2020