management

ISO-27001-Annex-A.12.6-Technical-Vulnerability-Management

ISO 27001 Annex : A.12.6 Technical Vulnerability Management

Leave a Comment / ISO 27001 La, Knowledge Base / By

ISO 27001 Annex : A.12.6  Technical Vulnerability Management Its objective is to avoid technological vulnerabilities from being exploited. A.12.6.1  Management of Technical Vulnerabilities Control- Information on technological vulnerabilities of information systems used should be obtained in a timely manner, the exposure of the organization to such vulnerabilities should be assessed and appropriate measures taken to address the risk involved Implementation Guidance – An up-to-date and comprehensive asset inventory is necessary for the effective management of …

ISO 27001 Annex : A.12.6 Technical Vulnerability Management Read More »

ISO-27001-Annex-12-Operations-Security

ISO 27001 Annex : 12 Operations Security

14 Comments / ISO 27001 La, Knowledge Base / By

ISO 27001 Annex : 12 Operations Security in this article explain Operational procedures and responsibilities, Documented Operating Procedures, Change Management & Separation of Development, Testing and Operational Environments. A.12.1  Operational procedures and responsibilities Its objective is to ensure that information processing facilities operate correctly and securely. A.12.1.1  Documented Operating Procedures Control-Operating procedures should be documented and accessed by all users in need. Implementation Guidance- Documented procedures for operating information processing and communications facility activities should …

ISO 27001 Annex : 12 Operations Security Read More »

ISO-27001-Annex-A.10-Cryptography

ISO 27001 Annex : A.10 Cryptography

Leave a Comment / ISO 27001 La, Knowledge Base / By

ISO 27001 Annex : A.10 Cryptography in this article explaining Cryptographic controls, Policy on the Utilization of Cryptographic Controls & Key Management. A.10.1 Cryptographic controls Its objective is to ensure the proper and efficient use of cryptography to protect the confidentiality, authenticity and/or integrity of the information. A.10.1.1 Policy on the Utilization of Cryptographic Controls Control- A policy on the use of cryptographic controls to secure information should be developed and enforced. Implementation Guidance- The …

ISO 27001 Annex : A.10 Cryptography Read More »

ISO-27001-Annex-A.9.2-User-Access-Management

ISO 27001 Annex : A.9.2 User Access Management

Leave a Comment / ISO 27001 La, Knowledge Base / By

ISO 27001 Annex : A.9.2 User Access Management Its objective is to ensure approved user access and avoid unauthorized access to systems and facilities. A.9.2.1 User registration and de-registration Control- In order to allow the assignment of access rights, a systematic process of user registration and de-registration should be enforced. Implementation guidance- The process to manage user IDs should include: Use unique user IDs to encourage users to be connected to and hold accountable for …

ISO 27001 Annex : A.9.2 User Access Management Read More »

ISO-27001-Annex : A.9.1.2-Access-to-Networks-and-Network-Services

ISO 27001 Annex : A.9.1.2 Access to Networks and Network Services

Leave a Comment / ISO 27001 La, Knowledge Base / By

Control- ISO 27001 Annex : A.9.1.2 Access to Networks and Network Services Only network and network facilities which have expressly been approved for use will be made available to users. Implementation Guidance- A policy on the use of networks and network policy should be developed. Following points should be covered in this policy: networks and network infrastructure to which access is permitted; Authorization procedures for determining who is permitted to access which networks and Networking services; …

ISO 27001 Annex : A.9.1.2 Access to Networks and Network Services Read More »

Annex-A.9-Access-Control

ISO 27001 Annex : A.9 Access Control

Leave a Comment / ISO 27001 La, Knowledge Base / By

A.9.1 Business Requirements of Access Control ISO 27001 Annex : A.9 Access Control Its Objective is limiting the access to information and information processing facilities. A.9.1.1 Access Control Policy Control- An access control policy with supporting business and information security requirements should be established, documented, and reviewed. Implementation Guidance- Asset owners should lay down appropriate rules for access control, access rights, and limits on particular user roles to their assets, with the level of info …

ISO 27001 Annex : A.9 Access Control Read More »

ISO-27001-Annex - A.8.3-Media-Handling

ISO 27001 Annex : A.8.3 Media Handling

Leave a Comment / ISO 27001 La, Knowledge Base / By

ISO 27001 Annex : A.8.3 Media Handling Its objective is to Stop unauthorized release, alteration, deletion, or destruction of information contained in the media. A.8.3.1 Management of Removable Media Control- Procedures shall be implemented for the management of removable media in accordance with the classification scheme adopted by the organization. Implementation Guidance- The following guidelines should be considered for the management of removable media: If not needed, the contents of any reusable media that are …

ISO 27001 Annex : A.8.3 Media Handling Read More »

ISO-27001-Annex-A.8-Asset-Management

ISO 27001 Annex : A.8 Asset Management

Leave a Comment / ISO 27001 La, Knowledge Base / By

A.8.1 Responsibility for Assets ISO 27001 Annex : A.8 Asset Management Its objective is to identify and establish acceptable security responsibilities for the organization’s assets . A.8.1.1 Inventory of Assets Control- Assets related to information and information facilities of an organization should be identified and listed, inventory of these assets should also be maintained. Implementation Guidance- An organization will identify important assets in the information lifecycle, and document their importance. The life-cycle of information should …

ISO 27001 Annex : A.8 Asset Management Read More »

ISO-27001-Annex : A.7.2-During-Employment

ISO 27001 Annex : A.7.2 During Employment

Leave a Comment / ISO 27001 La, Knowledge Base / By

ISO 27001 Annex : A.7.2 During Employment Its objective is to make sure that employees and contractors are conscious of and fulfill their information security responsibilities. A.7.2.1 Management Responsibilities Control- Management should mandate all employees and contractors to exercise information security in accordance with established policies and procedures set by the organization. Implementation Guidance- Responsibilities for management should include ensuring employees and contractors are: Are adequately briefed about information security role and responsibilities before given …

ISO 27001 Annex : A.7.2 During Employment Read More »

ISO-27001-Annex : A.6-Organization-of-Information-Security

ISO 27001 Annex : A.6 Organization of Information Security

Leave a Comment / ISO 27001 La, Knowledge Base / By

6.1 Internal Organization ISO 27001 Annex : A.6 Organization of Information Security its object is to establish a management framework for initiating and controlling the implementation and functioning of information security within the organization. 6.1.1 Information Security Roles and Responsibilities Control- All responsibilities related to information security should be well defined and assigned. Implementation Guidance- Allocation of information security responsibilities should be carried out in compliance with information security policies (Refer A.5.1.1). Responsibilities for the …

ISO 27001 Annex : A.6 Organization of Information Security Read More »