Tag Info

New answers tagged

0

Your question is targetting two subjects: First, the use of 'another site that does not have an equitable set of physical and logical security controls' in the case of assets within the scope has to be documented. This is usually done in recovery plans/contingency plans. Second, you do owe the auditor nothing. However, if you have an incident and you see ...


1

27001 certification is about your ISMS, not your controls. If a control stops working, it doesn't impact your certification. Of course, if a control stops working, and your ISMS doesn't detect and fix that problem, then that impacts your certification....


1

A lot of this comes down to partnership, identification of responsibilities and communication between you and the cloud Service Provider (CSP) Preparation Identify who is responsible for monitoring suspicious activity. Do you capture logs, monitor and review logs and alerts? Does the CSP? Identification/Analysis If you suspect an incident, do you know ...


2

Plan your business continuity. You should identify the proper people for mission critical and non-mission critical services, which systems contain the most important information, who can decide when to take the systems offline and at what threshold. Good overview on (wikipedia)[http://en.wikipedia.org/wiki/Incident_management] ITIL has tons of information ...



Top 50 recent answers are included