Get 2 Documentation Toolkits for the price of 1
Limited-time offer – ends March 28, 2024

Expert Advice Community

Guest

SOA Based ISMS Manual

  Quote
Guest
Guest user Created:   Sep 19, 2022 Last commented:   Sep 19, 2022

SOA Based ISMS Manual

We have now taken the first steps, but are still waiting for the release of the ISO standard for 2022.

We also want to align our SOA with this new version. I intend to structure the SOA in such a way that I have a high-level document that only contains the controls and the selection including the justification - the document is also available to customers because they have already asked for it in the certification process. The 2nd level describes the requirements from the standard and our planned and implemented implementation in more concrete terms - this also results in a kind of "Security Management Manual".

I have attached an initial draft for A5 (Organizational Controls) (2022). What do you think of it, does this procedure suit an auditor?

0 0

Assign topic to the user

ISO 27001 DOCUMENTATION TOOLKIT

Step-by-step implementation for smaller companies.

ISO 27001 DOCUMENTATION TOOLKIT

Step-by-step implementation for smaller companies.

Expert
Rhand Leal Sep 19, 2022

If I understood correctly, you’ve sent the SoA-based ISMS Manual.

Considering that, first is important to note that an SoA compliant with ISO 27001 must contain the following information:

  • All applied controls
  • Justification for inclusions
  • Implementation status
  • justification for exclusions of controls from Annex A

In case any of this information is missing, the SoA document will not be accepted by an auditor.

As for the 2nd level document (the SoA Based ISMS Manual), we do not recommend such an approach to our customers, because this kind of document requires a great effort to be written but is of very limited use for employees in the company. Instead, you should focus on writing the security policies and procedures (included in your toolkit) that describe how to implement and maintain security in your company.

For further information about an ISMS manual, please see:

Quote
0 0

Comment as guest or Sign in

HTML tags are not allowed

Sep 18, 2022

Sep 18, 2022

Suggested Topics