Toolkit content - A.6.1
Assign topic to the user
Please note that control A.6.1.1 Information security roles and responsibilities is implemented in all templates of the toolkit (it does not require a separate document). Also, top-level roles and responsibilities are listed in the Information Security Policy.
Controls A.6.1.2 Segregation of duties, A.6.1.3 Contact with authorities and A.6.1.4 Contact with special interest groups do not require specific documentation, so there is no need to develop a policy or procedure for them.
In cases like this, you only need to provide a record showing how it was performed. For example, for control A.6.1.2 you only need to provide a list of which activities were divided. For controls A.6.1.3 and A.6.1.4, you need to provide a list of which authorities / special interest groups need to be contacted. Since the presentation of this information can vary according to the information systems of each organization, it is unfeasible to provide a template for recording this information.
About control A.6.1.5 Information security in project management, here's an article that explains the details of its application:
-How to manage security in project management according to ISO 27001 A.6.1.5 https://advisera.com/27001academy/what-is-iso-27001/
Comment as guest or Sign in
Jan 20, 2022