My CMS

Kategorie: ISO 27001

  • How to implement equipment physical protection according to ISO 27001 A.11.2 – Part 1

    Most of the companies today have controls to protect themselves from malicious software (viruses, trojans, etc.), to prevent employees from accessing malicious sites (filtering addresses through proxy servers), or to encrypt information when it is sent/received through email. However, I often find companies that neglect the physical protection of equipment, … The post How to…

  • How to implement equipment physical protection according to ISO 27001 A.11.2 – Part 1

    Most of the companies today have controls to protect themselves from malicious software (viruses, trojans, etc.), to prevent employees from accessing malicious sites (filtering addresses through proxy servers), or to encrypt information when it is sent/received through email. However, I often find companies that neglect the physical protection of equipment, … The post How to…

  • 3 strategies to implement any ISO standard

    If you’re considering the implementation of ISO 27001, ISO 9001, ISO 14001, ISO 20000, or any other ISO management standard, you’re probably overwhelmed with various approaches on how to start and finish such project successfully. In my opinion, there are three basic options to implement these standards: (1) do it … The post 3 strategies…

  • 3 strategies to implement any ISO standard

    If you’re considering the implementation of ISO 27001, ISO 9001, ISO 14001, ISO 20000, or any other ISO management standard, you’re probably overwhelmed with various approaches on how to start and finish such project successfully. In my opinion, there are three basic options to implement these standards: (1) do it … The post 3 strategies…

  • ISO 31010: What to use instead of the asset-based approach for ISO 27001 risk identification

    One of the most significant changes in the 2013 version of ISO 27001, a worldwide standard for Information Security Management Systems, is that it does not prescribe any approach in the risk assessment anymore. While it still requires the adoption of a process-based risk assessment approach (learn more here: ISO 27001 … The post ISO 31010:…

  • ISO 31010: What to use instead of the asset-based approach for ISO 27001 risk identification

    One of the most significant changes in the 2013 version of ISO 27001, a worldwide standard for Information Security Management Systems, is that it does not prescribe any approach in the risk assessment anymore. While it still requires the adoption of a process-based risk assessment approach (learn more here: ISO 27001 … The post ISO 31010:…

  • ISO 27001 vs. ITIL: Similarities and differences

    IT services are one of the main pathways for information to flow through organizations, their clients and partners, and as legal and contractual requirements are increasingly including information protection demands (the healthcare industry is an example), these services and their management practices must evolve to adapt to this new scenario. … The post ISO 27001…

  • ISO 27001 vs. ITIL: Similarities and differences

    IT services are one of the main pathways for information to flow through organizations, their clients and partners, and as legal and contractual requirements are increasingly including information protection demands (the healthcare industry is an example), these services and their management practices must evolve to adapt to this new scenario. … The post ISO 27001…

  • Accreditation vs. certification vs. registration in the ISO world

    Things with ISO standards can get really complicated: there are many ISO management standards – the most popular ones are ISO 9001, ISO 14001, ISO 27001, ISO 22301, ISO 20000, etc. – and there are a multitude of ways to get accredited/certified/registered related to those standards. But, that’s not all … The post Accreditation vs.…

  • Accreditation vs. certification vs. registration in the ISO world

    Things with ISO standards can get really complicated: there are many ISO management standards – the most popular ones are ISO 9001, ISO 14001, ISO 27001, ISO 22301, ISO 20000, etc. – and there are a multitude of ways to get accredited/certified/registered related to those standards. But, that’s not all … The post Accreditation vs.…

  • What to look for when hiring a security professional

    Besides proper procedures and technologies, counting on good professionals can make all the difference during implementation and operation of any process or project. The “Apollo 13” movie shows what skilled men can do when procedures and technology fail (remember the “mailbox” device). On the other hand, what are the chances … The post What to…

  • What to look for when hiring a security professional

    Besides proper procedures and technologies, counting on good professionals can make all the difference during implementation and operation of any process or project. The “Apollo 13” movie shows what skilled men can do when procedures and technology fail (remember the “mailbox” device). On the other hand, what are the chances … The post What to…

  • Implementing restrictions on software installation using ISO 27001 control A.12.6.2

    Currently, in all companies around the world, it is necessary to install software (operating systems, office applications, financial applications, applications development, etc.). But, in general, the installation of this software is not sufficiently controlled, which can lead to certain risks. ISO 27001:2013 can help these companies with the implementation of an Information … The post Implementing restrictions…

  • Key performance indicators for an ISO 27001 ISMS

    Think about a medical exam. Our objective is for the physician to tell us that our health is ok and that we’ll live a long life, right? And how does the physician evaluate our health to determine if we are on track or not? By using several biological indicators, like … The post Key performance…

  • Key performance indicators for an ISO 27001 ISMS

    Think about a medical exam. Our objective is for the physician to tell us that our health is ok and that we’ll live a long life, right? And how does the physician evaluate our health to determine if we are on track or not? By using several biological indicators, like … The post Key performance…