Questions tagged [iso27002]

ISO/IEC 27002 is a code of practice - a generic, advisory document which recommends information security controls addressing information security control objectives arising from risks to the confidentiality, integrity and availability of information.

0
votes
0answers
29 views

standards reference to perimeter security

I have the following problematic that I am currently dealing with. I have two zones/perimeters that need to be interconnected, some standards protocols have to be whitelisted such as HTTP, FTP, SSH ...
1
vote
2answers
65 views

ISO 27002 Controls - Which Ones to Implement First

Im struggling to understand in which order I should implement the ISO 27002 controls. I was thinking about using the CIS Top 20 to help but what is the best route?
-1
votes
1answer
83 views

Potential risks per ISO 27002 clauses 5-18

I have a study project related to establishing of ISO 27001. I will do GAP analyses on "fictional" company over all ISO 27001 Annex A controls using ISO 27002. After I do that, I will detect the ...
2
votes
4answers
1k views

Expressing the risk of not having a security policy (e.g. ISO 27002, chapter 5)

How do I express non-compliance to ISO 27002 chapter 5 as a risk? The basic principle of an ISMS according to ISO 27001 is a risk-based approach. Following this, every control of Annex A (ISO 27002) ...