11 most important facts about changes in ISO 27001/ISO 27002 Ībout ISO 27017 and ISO 27018, apart from specific templates, we have a toolkit integrating these templates into an ISO 27001 ISMS: įrom this link, you can download a free demo of the documents for evaluation.You can use the Activity description field in the BIA questionnaire form to specify which activities are included in the questionnaire.Customers that bought the toolkit in the last twelve months from the release of the new ISO 27001 will receive the updated documents, as well as information about what has changed and guidance on what changes in other documents. Our recommendation is to perform BIA for each department, so you can use a single BIA questionnaire for activities from the same departmentįor example, you may use a single questionnaire to cover activities from the HR department (e.g., payroll, benefits, training, etc.), but it is not recommended to use one questionnaire to cover HR and SW development activities. If the answer is YES, please indicate how to place this. I have another query: Within the Business Impact Questionnaire, this must be done for each activity that is managed in the organization or several activities can be placed in a single questionnaire. What to consider in security terms and conditions for employees according to ISO 27001 Ģ.
Statement of Acceptance of ISMS Documents, included in folder 08 Annex A Security Controls > A.7 Human Resource Security.Confidentiality Statement, included in folder 08 Annex A Security Controls > A.7 Human Resource Security.This folder is located in folder 08 Annex A Security Controls > A.16 Information Security Incident Management.Īs a suggestion you may also consider including reference to sanctions in the following documents: Within the points that are detailed in the ISO 27001 templates, there is no point related to sanctions, it is possible to place this point within the corresponding documents, to detail which are the (labor) reprimands that would be obtained by the Failure to comply with any of the guidelines of X Policy.Ī reference to the disciplinary process is included in the Incident Management Procedure, section 3.6 – Disciplinary actions.
0 kommentar(er)
