ISO 27001 Annex : A.7.2 During Employment
ISO 27001 Annex : A.7.2 During Employment Its objective is to make sure that employees and contractors are conscious of and fulfill their information security responsibilities.
A.7.2.1 Management Responsibilities
Control- Management should mandate all employees and contractors to exercise information security in accordance with established policies and procedures set by the organization.
Implementation Guidance- Responsibilities for management should include ensuring employees and contractors are:
- Are adequately briefed about information security role and responsibilities before given access to confidential information or information systems;
- Shall provide proper guidelines stating the information security expectations from their roles in the organization.
- Motivated to comply with the organization’s information security policies;
- Achieving the level of information security awareness relevant to their organizational positions and responsibilities;
- comply with the terms and conditions of employment, including the information security policy of the organization and the relevant working methods;
- Seek to have relevant qualifications and expertise, and are regularly trained;
- An anonymous reporting platform is provided to report breaches of information security policies or procedures (“whistleblowing”). Management should demonstrate, and serve as a role model for, information security policies, procedures, and controls.
Other Information- If employees and contractors are not made aware of their responsibility for information security, they may cause significant damage to the organization. Motivated personnel are likely to be more professional and trigger fewer accidents related to information security.
Poor management can cause staff to feel undervalued, resulting in a negative impact on the organization’s information security. Poor management, for example, can lead to neglecting information security or, potential misuse of the assets of an organization.
To win in the market place you must first win in the workplace– Doug Conant
A well said verse which address the employees positive attitude towards his work and the organization. Speaking about employment in every organization will raise awareness of the roles and responsibilities of preserving and protecting the confidentiality of the organization’s assets.
Annex 7.2 of the Standard ISO 27001 addresses various activities and implications of organizational infringements. At Infosavvy , we have experienced trainers who can provide you with a better insight into the information security in the business and can help you learn about safeguards to protect your business. We qualify for one of the highest information security certificates IRCA CQI ISO 27001:2013 Lead Auditor (LA) and ISO 27001 Lead Implementer (LI) (TÜV SÜD Certification)
A.7.2.2 Information Security Awareness, Education and Training
Control- All company workers and, where necessary, contractors will receive adequate awareness education and training, as well as daily updates on organizational policies and procedures, as applicable to their job function.
Implementation Guidance- An information security awareness program will strive to make workers and, where appropriate, contractors aware of their information security responsibilities and the instances where those responsibilities will be discharged.
In line with the information security policies and related procedures of the organization, and, information security awareness plan should be introduced, taking into account the information to be protected of the organization and the controls to be carried out to guard the information. The awareness plan will include a range of awareness-raising events, such as promotions and booklet issuance or newsletter launches.
Related Product : ISO 27001 Lead Auditor Training And Certification ISMS
The awareness program should be organized in the context of the roles of the employees in the organization and, if necessary, the expected awareness of contractors. the activities in the awareness program, ideally annually, will be scheduled over time so that new workers and contractors can be identified and replicated. The awareness program should also be frequently updated so that it conforms to the organizational policies and procedures and draws on lessons learned from events in the area of information security.
Awareness training should be carried out as required by the information security awareness program of the organization. Awareness training may take advantage of multiple distribution platforms, including classroom-based, distance learning, web-based, self-paced, and others.
Information security training and curriculum will also cover key aspects such as:
– To state the commitment of management to information security across the organization;
– The need to become familiar with the relevant rules and regulations on information security, as specified in policies, guidelines, laws, regulations, contracts, and agreements;
– Personal accountability of own acts and inactions and overall responsibility for securing or protecting organizational and external information;
– Basic procedures (e.g. reporting of security incidents) and baseline controls (e.g. password security, malware controls and clear desks);
– Contact points and tools for additional knowledge and guidance on information security issues, including more information security awareness and training materials.
Information security awareness and training should take place on a regular basis. Initial education and training refers to those who transition to new positions or roles with significantly different information security criteria, not just to new beginnings, but should take place before the role is active.
In order to implement education and training efficiently, the organization must establish an education and training program. The plan will be consistent with the information security policies and procedures of the organization, taking into account the information to be protected and the safeguards that have been implemented in place to protect the information. The curriculum should consider various forms of education and preparation, e.g. seminars or self-study.
Also Read : ISO 27001 Annex : A.7 Human Resource Security
Other Information- When designing an awareness plan, it is important not only to concentrate on ‘what’ and ‘how,’ but also on ‘why.’ It is crucial for employees to understand the purpose of information security and the possible positive and negative effects on the organization from their own behavior.
Awareness, training, and awareness can be part of other training programs, such as general IT or general security training, or in collaboration with them. Awareness, education, and training programs should be necessary and suitable for the duties, responsibilities, and skills of the person.
At the conclusion of an awareness, education, and training course for testing knowledge transfer, and evaluation of employee comprehension may be carried out.
------------------------------------------------------------------------------------------------------------
Infosavvy, 2nd Floor, Sai Niketan, Chandavalkar Road Opp. Gora Gandhi Hotel, Above Jumbo King, beside Speakwell Institute, Borivali West, Mumbai, Maharashtra 400092
Contact us – www.info-savvy.com
Comments
Post a Comment