Questions tagged [iso27002]
ISO/IEC 27002 is a code of practice - a generic, advisory document which recommends information security controls addressing information security control objectives arising from risks to the confidentiality, integrity and availability of information.
7
questions
-1
votes
1
answer
125
views
ISO 27001 2013 version not being updated
Is there any reason why an information security standard such as ISO 27001 is not getting updated as Information Security field is constantly changing and also the requirements but its latest version ...
- 11
0
votes
1
answer
247
views
What alternative standard for ISO 27001 can be used in Australia?
I am looking for alternatives, that are less strict and less time consuming, than ISO 27001. Australia is in the Commonwealth, so maybe Cyber Essentials Plus could work, but I do not know if that ...
1
vote
1
answer
141
views
Does a customer who uses a cloud service provider with ISO27017 compliance, need their own certificate to be compliant themselves?
ISO 27017 advises both cloud service customers and providers. Microsoft Azure is compliant with ISO27017.
Let us say that a cloud service customer who uses Microsoft Azure wants to be compliant with ...
- 291
0
votes
0
answers
89
views
standards reference to perimeter security
I have the following problematic that I am currently dealing with. I have two zones/perimeters that need to be interconnected, some standards protocols have to be whitelisted such as HTTP, FTP, SSH ...
- 1
1
vote
2
answers
203
views
ISO 27002 Controls - Which Ones to Implement First
Im struggling to understand in which order I should implement the ISO 27002 controls. I was thinking about using the CIS Top 20 to help but what is the best route?
- 197
-1
votes
2
answers
319
views
Potential risks per ISO 27002 clauses 5-18
I have a study project related to establishing of ISO 27001.
I will do GAP analyses on "fictional" company over all ISO 27001 Annex A controls using ISO 27002.
After I do that, I will detect the ...
- 31
2
votes
5
answers
5k
views
Expressing the risk of not having a security policy (e.g. ISO 27002, chapter 5)
How do I express non-compliance to ISO 27002 chapter 5 as a risk?
The basic principle of an ISMS according to ISO 27001 is a risk-based approach. Following this, every control of Annex A (ISO 27002) ...
- 10.2k