In this episode of InfoSec Insider, George Ryan and Jack Woods, both Consultants at URM, discuss some of the most common nonconformities they encounter when auditing organisations against the management system requirements of ISO 27001, focusing on Clauses 4, 5 and 6. Drawing upon their auditing and consultancy experience, they provide practical guidance on common mistakes and how organisations can strengthen their approach. George Ryan and Jack Woods discuss:

  • Common issues relating to Clause 4, including keeping internal and external issues up to date, considering climate change, correctly identifying the needs and expectations of interested parties, and understanding how ISMS processes interact.
  • Why leadership involvement and commitment are critical to meeting Clause 5 requirements, from aligning information security objectives with wider business objectives to ensuring information security policies are appropriately approved and endorsed by top management.
  • Common pitfalls under Clause 6, including risk assessments without a clearly defined methodology, objectives that are not measurable or time-bound, and the importance of producing valid, comparable and repeatable risk assessment results.
  • How organisations can avoid problems with their Statement of Applicability, including weak justifications for excluding Annex A controls and assumptions that physical or development-related controls do not apply to their organisation.
  • Why changes to the ISMS need to be properly planned and recorded, and how overlooking business and organisational changes, rather than simply technical changes, can lead to nonconformities.

  • And more.

If there's a GRC or cyber security related issue you'd like us to explore, share it with us here here: https://urmconsulting.com/podcasts/common-nonconformities-in-clauses-4-5-and-6-of-iso-27001

We use listener questions to guide future discussions and ensure our episodes tackle the challenges that matter most to organisations like yours.

You can find more episodes of InfoSec Insider here: https://urmconsulting.com/podcasts              

Brought to you by URM, the UK’s leading information and cyber security specialists.         

Rss
Podden och tillhörande omslagsbild på den här sidan tillhör URM Consulting. Innehållet i podden är skapat av URM Consulting och inte av, eller tillsammans med, Poddtoppen.