ISO 27001 Clause 6.1 Actions to address risks and opportunities

-

Actions to address risks and opportunities


Overview

ISO/IEC 27001:2013 cares with the design of actions to deal with all kinds of risks and opportunities that are relevant to the ISMS. This includes risk assessment and planning for risk treatment.

The structure of ISO/IEC 27001 subdivides risks into two categories during planning:

  • Risks and opportunities relevant to the intended outcome(s) of the ISMS as a whole;
  • Information security risks that relate to the loss of confidentiality, integrity and availability of data within the scope of the ISMS.
The first category should be handled in accordance with requirements laid out in ISO/IEC 27001:2013 (general). Risks that fall under this category are often risks concerning the ISMS itself, the ISMS scope definition, top management’s commitment to information security, resources for operating the ISMS, etc. Opportunities that fall under this category are often opportunities concerning the outcome(s) of the ISMS, the commercial value of an ISMS, the efficiency of operating ISMS processes and knowledge security controls, etc.
The second category consists of all risks that directly relate to the loss of confidentiality, integrity and availability of data within the scope of the ISMS. These risks should be handled in accordance with (information security risk assessment) and (information security risk treatment). Organizations may prefer to use different techniques for every category.

The subdivision of requirements for addressing risks are often explained as follows:

  • It encourages compatibility with other management systems standards for those organizations that have integrated management systems for various aspects like quality, environment and knowledge security;
  • It requires that the organization defines and applies complete and detailed processes for information security risk assessment and treatment;
  • It emphasizes that information security risk management is that the core element of an ISMS. ISO/IEC 27001:2013 uses the expressions ‘determine the risks and opportunities’ and ‘address these risks and opportunities. The word “determine” are often considered to be like the word “assess” utilized in ISO/IEC 27001:2013 (i.e. identify, analyze and evaluate). Similarly, the word “address” are often considered like the word “treat” utilized in ISO/IEC 27001:2013.
When planning for the ISMS, the organization determines the risks and opportunities considering issues mentioned in understanding the organization and its context and requirements mentioned in understanding the needs and expectations of interested parties.

Implementation Guideline

For risks and opportunities relevant to the intended outcome(s) of the ISMS, the organization determines them supported internal and external issues and requirements from interested parties.

Then the organization plans its ISMS to:

  • Make sure that intended outcomes are delivered by the ISMS, e.g. that the knowledge security risks are known to the danger owners and treated to a suitable level;
  • Prevent or reduce undesired effects of risks relevant to the intended outcome(s) of the ISMS;
  • Achieve continual improvement, e.g. through appropriate mechanisms to detect and proper weaknesses within the management processes or taking opportunities for improving information security. Risks connected to a) above might be unclear processes and responsibilities, poor awareness among employees, poor engagement from management, etc. Risks connected to b) above might be poor risk management or poor awareness of risks. Risks connected to c) above might be poor management of the ISMS documentation and processes.
When a corporation pursues opportunities in its activities, these activities then affect the context of the organization (ISO/IEC 27001:2013) or the requirements and expectations of interested parties (ISO/IEC 27001:2013), may change the risks to the organization.
------------------------------------------------------------------------------------------------------------
This Blog Article is posted by
Infosavvy, 2nd Floor, Sai Niketan, Chandavalkar Road Opp. Gora Gandhi Hotel, Above Jumbo King, beside Speakwell Institute, Borivali West, Mumbai, Maharashtra 400092
Contact us – www.info-savvy.com

Comments

Post a Comment

Popular posts from this blog

10 Secrets You Will Never Know About Cyber Security And Its Important

-
Image
Know about Cyber Security Whether you’re a techie or not, there’s a good chance that your life is very reliant on the net and its wonders. Your social media accounts are likely humming, and you recognize your way round the IOT devices you employ . All of those devices connect you to the cyber world in a method or another. Here are 12 things to understand about  cyber security . And once you are sharing such a lot of your data online daily, you may also care about your cyber security.  If you’ve always thought cyber security are a few things only big companies got to care about change your mind, now. Cyber security is as critical on a private level, because it is on a company’s level. Besides, there’s hardly any job or profession, that’s not supported technology. With  jobs or a career in mind , you need to understand what threatens your security online and what you’ll be able to do to stay your data secure. 1  You’re a target to hackers Don’t ever say “It won’t happen t
Read more

ISO 27001 Annex : A.5 Information Security Policies

-
Image
5. 1  Management direction for information security ISO 27001 Annex : A.5 Information Security Policies, Its objective is to provide management guidance and  information security  assistance in accordance with business requirements and relevant laws and regulations. 5.1.1 Policies for Information Security Control-   A set of information security policies should be established, managed accepted, published and communicated to the employees and related external parties. Implementation Guidance-  At the very least companies need to identify a management-approved “information security strategy,” which outlines the organization’s approach to managing its information security goals. Information security policies should meet criteria that have been created by: Business strategy; Regulations, legislation and contracts; The present and projected  information security threat  environment Related Product :   ISO 27001 Lead Auditor Training And Certification ISMS The informa
Read more

Impact Of ISO 27001 Lead Auditor

-
Image
Information Security Management System  ISO 27001   Standard is an Information Security Management System. The main objective of this standard is the organization shall establish, implement and maintain the information security system within the organization. Evaluate the information security Risk at each stage of operation and take the necessary action to reduce the information security Risk within the organization. In common business practice the ISO 27001 standard is also referred as ISMS standard. The summarized requirement details of ISO 27001 are given below: Context of The Organization The organization shall identify the internal and external issue related to  information security , including the legal, regulatory and contractual requirements. Determining the scope of information security management system and establishing the information security management system. Leadership The top management of the organization demonstrates the leadership and commitments to
Read more