Solved

enterprise security policy, ISMS

Posted on 2014-02-19
4
479 Views
Last Modified: 2014-03-11
i was asked to deploy a  ISMS,although i`ve never done this before. if anyone has some templates ready,id be very grateful.
0
Comment
Question by:DukewillNukem
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
4 Comments
 
LVL 80

Expert Comment

by:David Johnson, CD, MVP
ID: 39871947
What is ISMS ?? Need more details
0
 
LVL 63

Accepted Solution

by:
btan earned 500 total points
ID: 39872069
i believe ISMS is referring to the ISO 2700x stuffs, meaning the information security mgmt system.

http://www.iso27001standard.com/en/free-downloads
http://www.iso27001security.com/
http://www.iso27001security.com/html/iso27k_toolkit.html

Below are useful resources you can tap to but note that the latest is ISO 27001:2013 instead of the 27001:2005. Organizations currently certified should not expect much difficulty in transitioning from the 2005 version to the 2013 version. So good to focus on 2013 instead..

Some question to ask oneself first..
a) How long does it take to implement ISO 27001 / BS 25999? @ http://blog.iso27001standard.com/2011/11/08/how-long-does-it-take-to-implement-iso-27001-bs-25999/

b) Do you really need a consultant for ISO 27001 / BS 25999 implementation?
http://blog.iso27001standard.com/2011/12/06/do-you-really-need-a-consultant-for-iso-27001-bs-25999-implementation/

The above is pretty nice article from a writer whom is quite experience and share tips in implementing and achieving the certification. Another is the differences on 2005 and 2013 version.

http://blog.iso27001standard.com/2013/01/28/a-first-look-at-the-new-iso-27001-2013-draft-version/ 

A big change here: these are not mentioned within some other requirements, but now there are separate clauses with very concrete rules. The rules are that you need to set clear objectives, you need to define who will measure them and when, and you need to define who should analyze and evaluate those results. Further, comprehensive plans need to be developed that will describe how the objectives will be achieved.

The biggest change is there are no preventive actions anymore, at least not at first sight – they are basically merged in risk assessment and treatment, where they naturally belong.

Note the new controls and those retired one ...

http://blog.iso27001standard.com/2013/02/11/main-changes-in-the-new-iso-27002-2013-draft-version/

naturally, controls from ISO 27001 Annex A cannot change without changing ISO 27002 because the essence of these two standards is to be aligned. Since the structure of ISO 27002 is completely aligned with controls from ISO 27001, all these changes are also valid for new ISO 27001 Annex A.
0
 

Author Comment

by:DukewillNukem
ID: 39920081
this looks good.does anyone have a template which i can directly use?
0
 
LVL 63

Expert Comment

by:btan
ID: 39920246
So far, no public template but the ISO document would already serves as general baseline to chart further customisation to your need and environment
0

Featured Post

Announcing the Most Valuable Experts of 2016

MVEs are more concerned with the satisfaction of those they help than with the considerable points they can earn. They are the types of people you feel privileged to call colleagues. Join us in honoring this amazing group of Experts.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Manage ASA using outside IP 14 79
Windows Security Pop-Up 7 71
SMTP connect() failed - WordPress 6 59
Malware infection with local user rights? 6 48
Smart phones, smart watches, Bluetooth-connected devices—the IoT is all around us. In this article, we take a look at the security implications of our highly connected world.
Do you know what to look for when considering cloud computing? Should you hire someone or try to do it yourself? I'll be covering these questions and looking at the best options for you and your business.
Sending a Secure fax is easy with eFax Corporate (http://www.enterprise.efax.com). First, Just open a new email message.  In the To field, type your recipient's fax number @efaxsend.com. You can even send a secure international fax — just include t…
Nobody understands Phishing better than an anti-spam company. That’s why we are providing Phishing Awareness Training to our customers. According to a report by Verizon, only 3% of targeted users report malicious emails to management. With compan…

749 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question