IT Management & Cyber Security

ISO 27001 Annex : A.18 Compliance in this article explain  Compliance with Legal and Contractual Requirements,  Identification of Applicable Legislation and Contractual Requirements and  Intellectual Property Rights this controls. A.18.1 Compliance with Legal and Contractual Requirements It’s objective is  to protect against violation of legal, statutory, regulatory, or contractual obligations relating to  information security  and any other security requirements. A.18.1.1 Identification of Applicable Legislation and Contractual Requirements Control-   Each of these information systems and  organizations  should specifically identify, document, and update all relevant statutory, regulatory, contractual requirements, and the approach of the organization towards compliance with these requirements. Implementation Guidance-  There must also be identification and documentation of basic controls and individual obligations to fulfill those crit...

In this article explain ISO 27001 Annex : A.16.1.5 Response to Information Security Incidents, A.16.1.6 Learning from Information Security Incidents & A.16.1.7 Collection of Evidence this controls. A.16.1.5 Response to Information Security Incidents Control-   In the context of the documented procedures,  information security incidents  should be responded to. Implementation Guidance-  A nominated point of contact and other pertinent people within the organization or external parties should be able to respond to information security incidents. The following should be included in the response: Gathering evidence as soon as possible after the occurrence; Conduct forensic  security information  analysis where necessary; Escalation, wherein necessary; Ensuring adequate documentation for subsequent analysis of all responses activities involved; Communicate to other internal or external entities or organizations who need to know if an information security inc...

In this article explain ISO 27001 Annex : A.16.1.2 Reporting Information Security Events, A.16.1.3 Reporting Information Security Weaknesses & A.16.1.4 Assessment of and Decision on Information Security Events this contols. A.16.1.2 Reporting Information Security Events Control-  Information security incidents  should be reported as quickly as possible through appropriate management channels. Implementation Guidance-  Both employees and contractors will be made aware of their responsibility as soon as possible for reporting security incidents. The reporting protocols and the point of contact at which the incidents will be reported should also be known to them. Related Product :   ISO 27001 Lead Auditor Training And Certification ISMS Situation for information security incident documentation to be considered includes: Ineffective control of security; Breach of standards regarding quality of information,  confidentiality, and availability ; Towards human mista...

  ISO 27001 Annex : A.15.2 Supplier Service Delivery Management  It’s objective  is to maintain, in compliance with supplier agreements, an agreed level of information security and delivery of service. A.15.2.1  Monitoring and Review of Supplier Services Control-  Organizations shall  monitor, review  and audit the provision of service to suppliers on a regular basis. Implementation Guidance –  Monitoring and review of  supplier services  will ensure respect for the terms and conditions of information security of the arrangement and careful monitoring of incidents and issues related to  information security . This will include a process of service management between the client and the supplier: Monitor the level of service performance to verify agreement compliance; Review the supplier’s service reports and schedule progress meetings on a regular basis as required by the agreements; conduct supplier audits and follow-up on reported ...