http___www.iso27001standard.com_hr_tag_interni-audit__1.xml
1.1 2.1 2.2 2.3 3.1 4.1 4.2 5.1 5.2 6.1 6.2 7.1 7.2 8.1 9.1 9.2 9.3 10.1 10.2 11.1 11.2 11.3 12.1 15.1
Mandatory documented procedures required by ISO 27001 If you heard that ISO 27001 requires many procedures, this is not quite true. The standard actually requires only four documented procedures: a procedure for the control of documents, a procedure for internal ISMS audits, a procedure for corrective action, and a procedure for preventive action. The term “documented” means that “the procedure is established, documented, implemented and maintained” (ISO/IEC 27001, 4.3.1 Note 1). Note: in this blog post I will not write about other mandatory documents like ISMS Scope, ISMS Policy, Risk Assessment Methodology, Risk Assessment Report, Statement of Applicability, Risk Treatment Plan, etc. – here I focus on procedures only. The procedure for the control of documents (document management procedure) should define who is responsible for approving documents and for reviewing them, how to identify the changes and revision status, how to distribute the documents, etc. In other words, this procedure should define how the organization’s bloodstream (the flow of documents) will function. The procedure for internal audits must define responsibilities for planning and conducting audits, how audit results are reported, and how the records are maintained. This means that the main rules for conducting the audit must be set. The procedure for corrective action should define how the nonconformity and its cause are identified, how the necessary actions are defined and implemented, what records are taken, and how the review of the actions is performed. The purpose of this procedure is to define how each corrective action should eliminate the cause of the nonconformity so that it wouldn’t occur again. The procedure for preventive action is almost the same as the procedure for corrective action, the difference being that it aims at eliminating the cause of the nonconformity so that it wouldn’t occur in the first place. Because of their similarities, these two procedures are usually merged in one. But why is it that ISO 27001 requires documented procedures that are not related to information security, while security procedures are not mandatory? The answer is in risk assessment – ISO 27001 does require you to perform risk assessment, and when this risk assessment identifies certain unacceptable risks, then ISO 27001 requires a control from its Annex A to be implemented that will decrease the risk(s). The control can be technical (for instance, anti-virus software for decreasing the risk of malicious software attack), but could also be organizational – to implement a policy or a procedure (for instance, implement a back-up procedure). Therefore, the procedures are becoming mandatory only if the risk assessment identifies unacceptable risks. One important note though – as opposed to the four mandatory procedures which must be documented, the procedures arising from controls in Annex A do not have to be documented. It is up to the organization to estimate whether such a procedure is to be documented or not. You could consider the four mandatory procedures as the pillars of your management system (together with the security policy) – after they are firmly set in the ground, you can start building the walls of your house. This becomes obvious when you look at other management systems – the same four procedures are mandatory there, too – in ISO 9001 (quality management systems), ISO 14001 (environmental management systems), and BS 25999-2 (business continuity management systems). As a consequence, you can use these procedures as the main link between different management systems if you want to develop the so called “integrated management system”. You can also check out our video tutorial How to Write ISO 27001/ISO 22301 Document Control Procedure. http://blog.iso27001standard.com/
1.1 1.2 2.1 2.2 2.3 3.1 3.2 4.1 4.2 4.3 4.4 5.1 5.2 5.3 5.4 5.5
Menadžment vam je u zadatak dao da implementirate kontinuitet poslovanja, ali niste sasvim sigurni kako ćete to učiniti? Iako to nije lak zadatak, možete se poslužiti metodologijom iz norme BS 25999-2 kako biste si olakšali život – u nastavku se …Read More ... Ako tek započinjete s provedbom norme ISO 27001, vjerojatno to želite učiniti na što lakši način. Tu vas moram razočarati: ovakva provedba nije lak posao. Međutim, pokušat ću vam ga olakšati tako što ću vam opisati 16 koraka koje morate …Read More ... Ako ste čuli da norma ISO 27001 propisuje mnogo procedura, to nije u potpunosti točno. Zapravo je prema normi potrebno dokumentirati samo četiri procedure: proceduru za upravljanje dokumentacijom, proceduru za interne audite ISMS-a, proceduru za korektivne mjere i proceduru za …Read More ... Ako se po prvi put susrećete s pojmom internog auditora vjerojatno ste zbunjeni – Zašto mi je potrebna još jedna provjera? Tko će to platiti? Koga da angažiram da to napravi? To je toliki gubitak vremena … Sve ipak ne …Read More ... Već ste uveli normu ISO 9001? Čuli ste da bi možda bilo dobro uvesti i normu ISO 27001? Ali kako vam nešto vezano za kvalitetu može pomoći u provedbi informacijske sigurnosti? Može, i više nego što mislite. Norma ISO 9001 …Read More ...