Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [iso27000]

The tag has no usage guidance.

2
votes
2answers
45 views

Definition of information in ISO 2700x

I've searched through recent versions of ISO 27000, 27001 and 27002 and couldn't find definition of "information". Where can I find it? Is "information" defined anywhere? Or maybe I should look at ...
2
votes
1answer
128 views

Starting with ISO 27001 - what to buy?

We want to start implementing the ISMS according to ISO 27001. Now I know that the ISO 2700x familiy consists of a lot of standards, a lot of them beeing industry-specific standard documents. My ...
1
vote
1answer
122 views

ISO Standard Security Field

What is the ISO standard that helps entities to implement security processes, concepts in the application security field ?
-1
votes
1answer
207 views

ISO 27001 structure and granularity of the content

I'm new to ISO 27001 and my goal is to come up with an ISMS policy for an mid-size organisation. As I did not purchase the standards, I went to read up advisera's articles and went through their free ...
0
votes
1answer
151 views

What is the difference between 'Eavesdropping' and 'Remote Spying' in ISO/IEC 27005?

In the Annex C of ISO/IEC 27005 typical threats are described, among others eavesdropping and remote spying. When searching on the internet for further description of the two terms I found them used ...
0
votes
1answer
91 views

Iso 27K Implementation

Suppose we buy a new cisco router or any IT equipment. How can we employ ISO 27k/NIST 800-37/NIST 800-53 or any other related information security management standards technically? I mean what should ...
0
votes
1answer
210 views

Special Level Agreements for ISO27001

Suppose that in the ISMS scope I have the management of services provided by some cloud provider, i.e the provider provides me a virtual server for performing certain critical operations. I would ...
0
votes
1answer
36 views

Treatment of Database as a Service in Asset Registry

I have a Relational Database (DB) that is hosted by a cloud provider in my asset registry to be used for ISO27001 certification.This implies everything is maintained by the cloud provider, e.g. ...
1
vote
2answers
550 views

ISO27001 Risk Assessment Methodology

I'm in the process of defining a risk assessment methodology for a company that would like to be aligned with ISO 27001. The standard states clearly that the aim is the protection of CIA (...
1
vote
3answers
479 views

Risk Assessment Methodology ISO 27001

I would like to apply ISO 27001 best practices for a company that has not completed its final online architecture yet and it is still under development phase. However, they pretty much know which ...
3
votes
1answer
94 views

Development of ISO27001 ISMS before production

I would like to ask if it is efficient and correct to design the ISO27001 ISMS for a company/organisation that is not yet in fully operational mode - e.g. their online architecture of their system is ...
1
vote
1answer
657 views

Crosswalks (aka Matrix) for InfoSec Compliance Standards

Looking to find a reference that maps the various control standards (i.e. HIPAA, PCI-DSS, GLBA, ISO) to each other. I envision the answer being a spreadsheet that outlines the controls for one ...
1
vote
1answer
261 views

ISO27001 Scoping : Defining boundaries

I would like to define the scope of the ISMS for an organisation in which information assets are sitting entirely on the cloud and managed through services provided by the cloud (even storing the data ...
1
vote
1answer
217 views

ISO27001: Scoping Definition for Data Hosted on Cloud

I'm trying to define a scoping definition, as required by ISO27001, for a company that offers advice to customers based on health-related data. The strength of this company is its advice that offers ...
2
votes
2answers
404 views

Does the use or the implementation of PDCA or Deming cycle in the Information Security Management System mandatory?

To comply with ISO 27001, does the Information Security Management System ought to implement the PDCA process ? or ISMS can choose another management method? PDCA process is the Plan Do Check and ...
4
votes
1answer
105 views

Is it possible for one Division of an organization to be certified ISO 27001?

Is it possible for an entity or a division part of an organization to be certified ISO 27001, specifically the Division Information Security Management System?
0
votes
1answer
750 views

Link to download the ISO 27002 clauses [closed]

Which link is authentic to download ISO 27002 clauses. I am not seeing a web page / PDF for the list of 133 controls to go through
5
votes
1answer
579 views

How do Software Development Processes, OWASP CLASP & MS SDL, and Security Standards fit together?

How do these three concepts fit together: The Software Development Process (SDP) indicates the different phases of creating an application. Well known processes are waterfall, spiral, agile, extreme ...
1
vote
1answer
198 views

What is the relation between ANSI and ISO regarding ISO 27000?

So in one answer I was told that ANSI is a governing body (the only one in the world) for ISO 27000? I think I got something wrong, because I don't see ANSI mentioned anywhere when I read about ...
2
votes
2answers
780 views

What could be the scope of ISO 27000 standards?

If a company wants to certify against some of ISO 27000-series standards (let's say ISO 27001 and ISO 27005), what could possibly be certified? I mean, is it IT processes in general in the ...
4
votes
1answer
378 views

Does ISO 27000 certification increase the risk of being attacked?

I asked my client (a bank) why they don't certify themselves against ISO 27000 standards. The answer was that if they certified, it would increase the risk of being attacked. Does that make any ...
2
votes
1answer
118 views

Outsourced software development ISO27002 definition

In ISO27002 section 14.2.7 it sets out the requirements for outsourced software development. By Outsourced software development are they referring to bespoke software or does this also include off-...
12
votes
3answers
35k views

What is the difference between ISO 27001 and ISO 27002?

What is the difference between ISO 27001 and ISO 27002? Are they related to each other or not?
1
vote
1answer
384 views

what is an internal iso 27001 technical auditor? [closed]

i have been recently hired by an ISO 27001 certified company as an " internal ISO technical auditor". My employer told me that my job is described as follow: this job is created because of the need ...
5
votes
2answers
3k views

ISO 27001 - procedures templates for ISMS at small companies? [closed]

Is anybody use publicly available (or relatively cheap) templates of procedures for ISO 27001 for build own information security management system capable to be conform standard. Any recommendation? ...
1
vote
2answers
742 views

What is ISO27000 (27001) and how to achieve it? [duplicate]

I have recently came across ISO 27000. Basically what I learnt is that it is used for audit purpose in organizations. Can you tell what exactly it is, if I am wrong? What tools are available for ISO ...
1
vote
2answers
493 views

Compliance with an industry recognized framework - ISO27k

I've been asked to figure out how to get our company to comply with an "Industry Recognized [Security] Framework" where '“Industry Recognized Framework” means a global industry recognized information ...
2
votes
5answers
5k views

Questions about in-scope information assets for an ISO27001 ISMS

I am in the process of writing a Scope for the information assets - in preparation for writing an ISO27001 compliant ISMS. I am confused as to if a VPN network is considered to be in Scope? as well ...
0
votes
1answer
768 views

How secure are the new TLDs ( .us, .io, …) and do they compare to .com? [closed]

The introduction of the new top level domains (TLDs) such as .music, .books, etc. will increase the number of people and organisations adding and removing entries into the root DNS servers (.) for ...
2
votes
2answers
2k views

ISO 27001 failure to comply

Say a small company just earned an ISO 27001 accreditation. What happens if during one of the audits it is found that the company didn't follow the ISMS? Is there a certain warning process that ...
-2
votes
2answers
1k views

which certification course should I choose? [closed]

The company I'm working in propose among others the following courses related to security ISO 27001 Lead Auditor ISO 27001 Lead Implementer Certified Certified Information Systems Security ...
15
votes
3answers
1k views

Should a penetration tester have training in ISO 27001/ITIL etc?

I recently got offered a promotion but as part of the package I've been requested to do ISO 27001, ITIL, ARPA and other kinds of training. I've previously avoided this sort of training as I felt it ...
4
votes
3answers
3k views

Security Assessment vs. Risk Analysis

What the real difference between IT Security Assessment based on ISO 27001 (or in general other international standard) and qualitative risk analysis? In some way the approach is much similar - ...
13
votes
5answers
1k views

ISO27000 implementation - Where do you get the standardization material?

In implementing ISO27000 (ISO27001&27002) I am wondering where I can download and review the standard? I wish to start implementing it but I am a bit stumped on where to start. Some sites offer ...