SPRING DISCOUNT
Get 30% off on toolkits, course exams, and Conformio yearly plans.
Limited-time offer – ends April 25, 2024
Use promo code:
SPRING30

Expert Advice Community

Guest

Statement of Applicability/Annex A Documents

  Quote
Guest
Guest post Created:   Jan 12, 2016 Last commented:   Jan 12, 2016

Statement of Applicability/Annex A Documents

Currently I am working on the Statement_of_Applicability document to properly fill out the different sections, and more specifically A.15 Supplier relationships area. In the Scope document, we specifically excluded suppliers for the initial certification process, but we fully intend to revist that process at a later date. Knowing that "Suppliers" are excluded from the scope, how would we specifically approach Internet Service Provider, Firewall Management Vendor, service agreement vendors, point to point network connectivity services to our DR and satelite office in another city? Would we exclude these external services/outsourced processes, or include them but specifically include the particular vendors for Information Services, as this is our main focus for the initial certification. Suppliers to a container shipping company, such as ourselves, would include any equipment, supplies, maintenance products for our vessels and offices aquisitioned through our co rporate purchasing department or overseas in various ports around the world, so I wanted to see if and where would be the line drawn in the preverbial "sand". Thanks in advance for the assistance.
0 0

Assign topic to the user

ISO 27001 DOCUMENTATION TOOLKIT

Step-by-step implementation for smaller companies.

ISO 27001 DOCUMENTATION TOOLKIT

Step-by-step implementation for smaller companies.

Guest
DejanK Jan 12, 2016

Todd,

To answer your question, I'll quote a paragraph from our ISMS Scope template: "The organization needs to define the boundaries of its ISMS in order to decide which information it wants to protect. Such information will need to be protected no matter whether it is additionally stored, processed or transferred in or out of the ISMS scope. The fact that some information is available outside of the scope doesn't mean the security measures won't apply to it – this only means that the responsibility for applying the security measures will be transferred to a third party who manages that information. "

The point is - you need to require your suppliers and partners to protect your information - and you need to determine these requirements through the risk assessment.

Quote
0 0

Comment as guest or Sign in

HTML tags are not allowed

Jan 12, 2016

Jan 12, 2016

Suggested Topics