ISO - Revision history

Richter: Blanked the page

2021-12-10T05:00:40Z

Blanked the page

Show changes

Richter: /* STEP 10 Practical advice on complying with ISO 27001 */

2021-12-10T04:58:32Z

STEP 10 Practical advice on complying with ISO 27001

Richter at 04:57, 10 December 2021

2021-12-10T04:57:39Z

Richter at 04:56, 10 December 2021

2021-12-10T04:56:28Z

Richter at 00:20, 10 December 2021

2021-12-10T00:20:35Z

Richter at 00:08, 10 December 2021

2021-12-10T00:08:46Z

Richter at 00:00, 10 December 2021

2021-12-10T00:00:16Z

Richter at 23:38, 9 December 2021

2021-12-09T23:38:54Z

Richter at 23:29, 9 December 2021

2021-12-09T23:29:01Z

Richter at 23:26, 9 December 2021

2021-12-09T23:26:01Z

@@ Line 223: / Line 223: @@
 <!--T:3-->
 == STEP 10 Practical advice on complying with ISO 27001 ==
-#ISMS motto: 'the less you {own, do, manage, keep...}, the easier to comply!'
+ISMS motto: 'the less you {own, do, manage, keep...}, the easier to comply!'
-##outsource non-essential services, leverage cloud services: email, antivirus, server monitoring, infrastructure and backups
+#outsource non-essential services, leverage cloud services: email, antivirus, server monitoring, infrastructure and backups
-##do not keep data that is not necessary (data = burden)
+#do not keep data that is not necessary (data = burden)
-##automate, automate, automate - don't do things that the computer can do for you
+#automate, automate, automate - don't do things that the computer can do for you
-##don't get carried away, align with realistic and current security demands to ensure a minimal attack surface
+#don't get carried away, align with realistic and current security demands to ensure a minimal attack surface
 KISS
-##simple policies can be understoo
+#simple policies can be understoo
-##simple procedures can be followed
+#simple procedures can be followed
-##small is beautiful in documenting ISMS
+#small is beautiful in documenting ISMS
 Statement of Applicability (SoA)
-##most controls apply to the full scope
+#most controls apply to the full scope
-##tailor at the operational / functional levels (teams)
+#tailor at the operational / functional levels (teams)
-##use the self-assessment checklists
+#use the self-assessment checklists
 <!--T:3-->
 == STEP 11 Assessment and Certification  ==

@@ Line 229: / Line 229: @@
 ##don't get carried away, align with realistic and current security demands to ensure a minimal attack surface
-#KISS
+KISS
 ##simple policies can be understoo
 ##simple procedures can be followed
 ##small is beautiful in documenting ISMS
-#Statement of Applicability (SoA)
+Statement of Applicability (SoA)
 ##most controls apply to the full scope
 ##tailor at the operational / functional levels (teams)

@@ Line 90: / Line 90: @@
 '''This can be done using the Cetbix ISO27005 questionnaires or the BSI questionnaires on your ISMS dashboard'''..
 <!--T:3-->
@@ Line 200: / Line 202: @@
 Management reviews are conducted to ensure the continuing suitability, adequacy and effectiveness of your ISMS. The review should include assessing opportunities for improvement and the need for changes to the ISMS, including the information security policy and objectives. Management Reviews should consider all aspects of the performance of the ISMS, including:
-    the results of audits
+#the results of audits
-    information security management system performance
+#information security management system performance
-    emergency preparedness and response
+#emergency preparedness and response
-    status of preventive and corrective actions follow‐up actions from previous management reviews
+#status of preventive and corrective actions follow‐up actions from previous management reviews
-    changes that could affect the ISMS, and recommendations for improvements
+#changes that could affect the ISMS, and recommendations for improvements
 It is useful to hold management reviews fairly frequently once the ISMS becomes operative and to only lengthen the periods between each review once you are confident the ISMS is operating satisfactorily as confirmed by both internal and external audits.

@@ Line 1: / Line 1: @@
-===How/Where do I start?=== <!--T:2-->
+=How/Where do I start?= <!--T:2-->
 <!--T:3-->
@@ Line 181: / Line 181: @@
 <!--T:3-->
-== STEP 9 Documentation Development ==
+== STEP 9 Implementation ==
-Congratulations - having purchased Cetbix license, you are provided with all documentations and forms digitally and manually which is going to be a lot easier that it might otherwise have been!
-===Why is there no score or graph?=== <!--T:4-->
+====11.4 Continual Improvement====
-<!--T:5-->
+#Information Security policy
-The Cetbix ISMS concept is that risk is zero if there are no threats or vulnerabilities, which means that nothing is shown on the graph.
+#Information Security objectives

@@ Line 156: / Line 156: @@
 '''Cetbix automatically generates your RTP report for you'''.
 '''Other reports such as Risk Register, Asset Register and other reports are generated automatically on Cetbix'''.
 ===Why is there no score or graph?=== <!--T:4-->
 <!--T:5-->
 The Cetbix ISMS concept is that risk is zero if there are no threats or vulnerabilities, which means that nothing is shown on the graph.

@@ Line 2: / Line 2: @@
 <!--T:3-->
-== STEP 1 ==
+== STEP 1 Management ==
 First get support from your top management. They must demonstrate their commitment and determination to implement an ISO27001 Information Security Management System in your organisation. Without top management commitment, no information security initiative can succeed.
@@ Line 22: / Line 22: @@
 <!--T:3-->
-== STEP 2 ==
+== STEP 2 Appointing the team ==
 Top management should appoint an Information Security Management Representative (ISMR), as its project manager to plan and oversee implementation, and a supportive team, including representatives of all organisational functions who fall within the scope.
@@ Line 38: / Line 38: @@
 #ensuring that ISMS defined, implemented, maintained and improved in conformance with the requirements of ISO 27001
 #reporting to top management on how well, or poorly, the ISMS is performing, including identifying any needs for improvement
 ===Why is there no score or graph?=== <!--T:4-->

@@ Line 5: / Line 5: @@
 To provide evidence of commitment to the development and implementation of an ISMS and continually improve its effectiveness, top management should:
-    *make clear to the organisation the importance of meeting customer, statutory and regulatory requirements,
+#make clear to the organisation the importance of meeting customer, statutory and regulatory requirements,
-    *define the organisation's information security policy and making this known to every member of staff
+#define the organisation's information security policy and making this known to every member of staff
-    *ensure that information security objectives are established at all levels and for all functions
+#ensure that information security objectives are established at all levels and for all functions
-    *ensure the availability of those resources required for the development and implementation of the ISMS
+#ensure the availability of those resources required for the development and implementation of the ISMS
-    *lead the required management review meetings
+#lead the required management review meetings
-   * encourage the involvement of all staff
+#encourage the involvement of all staff
-    *identify and communicate the key objectives to be achieved through the ISMS, such as:
+#identify and communicate the key objectives to be achieved through the ISMS, such as:
-        *keeping confidential information secure
+#keeping confidential information secure
-        *providing customers and stakeholders with confidence in how we manage risk
+#providing customers and stakeholders with confidence in how we manage risk
-       *allowing the secure exchange of information
+#allowing the secure exchange of information
-        *ensuring that legal obligations are met
+#ensuring that legal obligations are met
-        *providing a competitive advantage
+#providing a competitive advantage
-        *better managing and minimising risk exposure
+#better managing and minimising risk exposure
-        *raising awareness of security issues
+#raising awareness of security issues
 ===Why is there no score or graph?=== <!--T:4-->