ISO 27001:2022

For questions and discussions around ISO 27001:2022

  • 4 Topics
  • 8 Replies

4 Topics

lesleyheizman
lesleyheizmanNew Participant
posted in ISO 27001:2022

Automating Security Event Log capture-Best Practices/etc-Thoughts?

Hey Drata community! I’m curious and thought I would pose this question here, as part of our ISO 27001 program we keep a security event log and then when something upgrades to an incident we create the corrective action report for the incident etc. We had started doing some automation around this, for example we monitor most of the programs/services we use in a slack channel and we also get feeds from different sources for possible events we should look into. We’ve started doing some work around automating those into tickets in our service desk, but curious what processes others are using or if you’ve found any great ways to automate part of this in your organizations? A lot of our feeds contain quite a bit of noise such as downtime maintenance etc. I’m interested in comparing notes in how we can improve this or automate even further :) Hit me up if you have any tips!  

7
Troy_Fine
1 month ago
T
terryrNew Participant
posted in ISO 27001:2022

board of directors' responsibility

The board of director has a fiduciary duty to ensure that the company and management have implemented adequate controls to mitigate risk to the organisations business operations and response to cybersecurity incidents. on regular basis, the board should receive reports on cybersecurity activities and the risk associated with them, metric on IT performance and efforts taken by management to monitor and mitigate risk. The board should assess the adequacy of the resources devoted to policies addressing cybersecurity, support required, and sufficiency of controls in place regarding [protection of data, compliance and education efforts. It should also review the measures taken by management to prevent cyberrisk.The ISO 27000 series is the main standard used in organisations and the standard ISO/IEC 27014:2020 addresses the governance of information security and sets out the responsibilities of the Board in four governance processes; Evaluate, direct, monitor and communication.   

1
Helina Medhin
1 month ago
Elliot at Drata
Elliot at DrataDrata Creative Lead
posted in ISO 27001:2022

The IAF released the transition requirements for ISO 27001:2013 to ISO 27001:2022

Via our friendly compliance expert @Troy_Fine on Linkedin🚨 It's finally happening....sort ofThe IAF released the transition requirements for ISO 27001:2013 to ISO 27001:2022.General Key points:-All accreditation bodies will have 12 months from the last day of publication month of ISO 27001:2022 to assess and transition conformity assessment bodies (CAB) they accredit.-Organizations already certified to ISO 27001:2013 will have 36 months from the last day of publication month of ISO 27001:2022 to transition to and be certified to ISO 27001:2022.-All certifications based on ISO 27001:2013 shall expire or be withdrawn at the end of the transition period.Transition Audit Key Points-CABs may conduct the transition audit in conjunction with the surveillance audit, recertification audit or through a separate audit.-The transition audit shall not only rely on the document review, especially for reviewing the technological controls.-The transition audit shall include, but not limited to the fo

0
Elliot at Drata
7 months ago
Elliot at Drata
Elliot at DrataDrata Creative Lead
posted in ISO 27001:2022

ISO 27001: A Beginner’s Guide

ISO 27001 is the international standard that describes best practices for an Information Security Management Systems(ISMS). It’s based on a set of controls and measures, which organizations can use to achieve information security. Interested in the ISO 27001 process? We have an entire ISO 27001 beginner’s guide to get you started.The ISO 27001 standard requires that you have procedures in place to cover aspects of the ISMS, including:Information security risk management (What are the risks you face and how do you treat those risks?) Monitoring, measurement, analysis, and evaluation (How is the effectiveness of the information security management system evaluated?) Improvement (How are nonconformities evaluated and corrected?)Read the full beginner’s guide here or drop your questions in this part of the community.

0
Elliot at Drata
8 months ago

Badge winners

Show all badges
Terms & ConditionsCookie settings