Jaacostan

:: InfoSec Study Notes : Scribbling on ISO/IEC 27001:2013 Standard Part-2::   For Part-1 of this series , Go here. Context of the Organization The organization needs to identify the Internal and external issues that can affect the expected outcome. Hence context becomes an important consideration and helps to ensure that the ISMS is designed and adapted for your organization. -External Issues-external to the organization     External issues may include:     government regulations and changes in the law, Political conditions     economic shifts in your market     Partner,Vendors and competitor.     events that may affect your corporate image     Trends and changes in technology -Internal issues-within the organization and under direct control of the organization.     Internal issues can include :     regulatory requirements for the organization...

:: InfoSec Study Notes : Scribbling on ISO/IEC 27001:2013 Standard Part-1::   ISO/IEC 27001:2013 is an information security management standard. Organizations use it to manage and control the information security risks, to protect and preserve the confidentiality,integrity, and availability of information, and to establish your information security management system (ISMS). -Is a systematic framework to manage information security related risks and protect important information. -Also consists of requirements for an ISMS Annex A- a list of control objectives and controls for information security. -Annex A provides an essential tool for managing security. A list of security controls (or safeguards) that are to be used to improve security of information. -In brief, the Annex A lists the following control objective. This is a very large list which have more sub-topics/controls.     -Security Policy Management     -Corporate Security Management...