Show me desktop version

The ISO 27001 & ISO 22301 Blog

How to identify ISMS requirements of interested parties in ISO 27001

“If you do not know where you’re going, you’re unlikely to end there.” This saying from the title character in the movie Forrest Gump describes perfectly why many projects fail: lack of clear requirements. Definition of requirements is so important that, since 2012, all published ISO management systems standards, including …

Read More ...

What does ISO 27001 Lead Implementer training look like?

The ISMS (Information Security Management System) plays a very important role in every business these days. Since implementation of the ISMS can be a complex process (and usually differs in each industry sector), in order to participate and build this system, a good approach is to learn how to implement …

Read More ...

Segregation of duties in your ISMS according to ISO 27001 A.6.1.2

Today’s automated solutions and information and communication technologies allow a few people to handle a great deal of information and processes (e.g., stock exchange operators and air traffic controllers). While this is good to improve productivity, a potential side effect is that these few people may end up gathering excessive …

Read More ...

What does ISO 27001 Lead Auditor training look like?

In the last four years I’ve been preparing and presenting a lot of trainings for ISO 27001 Lead Auditor. At the end, participants understand that this is just the beginning of the journey to reach the “end of the stairs,” and become a professional in ISMS (Information Security Management System) auditing.  …

Read More ...

What is an Information Security Management System (ISMS) according to ISO 27001?

If you’ve started an  ISO 27001 implementation, you’ve surely come up with the term Information Security Management System or ISMS. Pretty vague term, isn’t it? And yet, the ISMS is the main “product” of ISO 27001 implementation. So, what exactly is an ISMS? ISO 27001 basically describes how to develop the …

Read More ...

Key performance indicators for an ISO 27001 ISMS

Think about a medical exam. Our objective is for the physician to tell us that our health is ok and that we’ll live a long life, right? And how does the physician evaluate our health to determine if we are on track or not? By using several biological indicators, like …

Read More ...

How to manage changes in an ISMS according to ISO 27001 A.12.1.2

Changes are necessary in the information technology sector, mainly because every so often it is necessary to update servers, systems, etc. But risks (seen from an information security point of view) arise when changes are performed in an uncontrolled way, i.e., confidentiality, integrity, and availability of systems, applications, information… could …

Read More ...

ISO 27001 Certification: What’s next after receiving the audit report?

For those who already run a management system, like an ISMS based on ISO 27001, the certification audit event is already known: the auditor arrives, performs the audit opening, evaluates processes and records, states the result, and elaborates the audit report, closing this phase of the audit process. However, why did …

Read More ...

CISA vs. ISO 27001 Lead Auditor certification

In a previous post, I talked about personal certifications helping the organization to comply with ISO 27001 clause 7.2 (see this post How personal certificates can help your company’s ISMS). In today’s post, I will show you two specific personal certifications (CISA and ISO 27001 Lead Auditor) and how they can …

Read More ...

Risk assessment vs. internal audit in ISO 27001 and ISO 22301

Quite often I see people searching for ISO 27001 or ISO 22301 checklists for performing the internal audit; however, they expect those checklists to help them with, e.g., which information does the organization have, who has access to it, how is it protected, how confidential is it, etc. The problem is – …

Read More ...

How to structure the documents for ISO 27001 Annex A controls

Once you’ve finished your risk assessment and treatment, it is time for you to start writing documents that describe your security controls according to ISO 27001 Annex A. But, which documents should you write? How do you structure them? Which one do you begin with? Here’s what I found to be …

Read More ...

How to create a Communication Plan according to ISO 27001

Communicating is a key activity for any human being. This is also the case for an organization. It helps through exchanging the most correct information to the best audience and at the best moment. It is certainly important in security management, because you want people to react in the proper …

Read More ...

Roles and responsibilities of top management in ISO 27001 and ISO 22301

Did you know that, in most cases, failure to implement ISO 27001 or ISO 22301 was directly related to the fact that top management did not want to assume their responsibilities for information security / business continuity in their companies? OK, you probably knew that. But, what are these responsibilities, …

Read More ...

Why is management review important for ISO 27001 and ISO 22301?

Like some other clauses in ISO 27001 and ISO 22301, clause 9.3, which defines requirements for management review, is one of the most misunderstood and most underappreciated elements of these standards. In practice, this review is usually done only to satisfy the certification auditor, but by doing so a great …

Read More ...

ISO 27001 & ISO 22301
Free Downloads

 

Upcoming free webinar
ISO 27001 & ISO 22301: Why is it better to implement them together?
Wednesday - March 1, 2017
Show posts:
Request callback
Request callback

Or call us directly

International calls
+1 (646) 759 9933