ISO 27001 Compliance Archives

Why You Should Consider an Intangible Asset Inventory (and the Risks of Not Having One)

IT security professionals can get caught up in the physical asset world. But what intangible assets should we be tracking?

An important part of IT security is maintaining an asset inventory. The inventory should document owners, data classification and other pertinent information. Consider cost and metrics associated with the asset’s lifetime. A physical asset inventory enables an IT department to have security […]

Sawyer Miller2020-03-26T13:04:51+00:00Cyber Risk Management, ISO 27001 Compliance|0 Comments

COVID-19 and ISO 27001: What Coronavirus Means for Your Certification Audit

Many organizations have been impacted by office closures during the COVID-19 pandemic. Here’s how to maintain your ISO 27001 certification during the crisis.

Many organizations are facing the challenge of maintaining their ISO 27001 certification schedule during the Coronavirus (COVID-19) pandemic. This includes scheduling (or rescheduling) on-site audits in a time when most organizations aren’t sure when they will be able to […]

Christian Hyatt2020-03-23T12:53:11+00:00ISO 27001 Compliance, IT Audit & Compliance, News and Events|0 Comments

How to Create Effective Policies

How to leverage information security policies into leveling up your security program.

People often regard information security policy as a “check-the-box” compliance initiative. Many organizations will copy a policy template, make small revisions applicable to their context, […]

Kendall Morris2020-01-24T13:42:36+00:00CISO Discussions, Cyber Risk Management, ISO 27001 Compliance, IT Audit & Compliance, SOC Reporting|1 Comment

Craftsmanship in Music and Compliance

If you’ve been on stage for a speech or performing arts, you know stage fright is real. Businesses can get nervous when they hear the word “audit” in the same way musicians can get nervous before a performance. However, there is one great way to alleviate that fear: preparation. If your business prepares well, you will see the fruits […]

Jack Nguyen2020-01-23T16:04:08+00:00ISO 27001 Compliance, IT Audit & Compliance, Regulatory Compliance|0 Comments

What Are Your Privacy KPIs?

Identifying and maintaining measures of success in privacy programs.

The publication of ISO 27701 is an exciting development for all companies looking to enhance and potentially certify their privacy programs. As companies race to digest and implement the new standard, many questions arise around how to address some of its particular requirements. One such area involves the governance of an ISO 27701 […]

Philip Brudney2020-01-23T19:24:19+00:00ISO 27001 Compliance, Privacy Compliance|0 Comments

Managing an Organization’s Passwords

How to keep the keys to the kingdom from escaping the kingdom.

Proper password management is a huge step that an organization can take to strengthen security. It also addresses multiple criteria for all the major security frameworks. For example, see examples from ISO 27001 and SOC 2 as of the date of this writing:

ISO 27001 A9.4.2: Where required by the access […]

Kendall Morris2020-01-23T16:17:32+00:00Cyber Risk Management, ISO 27001 Compliance, IT Audit & Compliance, Penetration Testing|0 Comments

Planning, Executing and Learning from Tabletop Exercises

Throughout the process of maturing your governance and compliance environment, you have likely encountered the need for conducting an annual or quarterly preparedness exercise, commonly referred to as a “tabletop exercise”.

These exercises are required for compliance with numerous standards, including ISO 27001/22301, GDPR, and SOC 2 just to name a few. While the focus of each tabletop may change, the format […]

Glenn Chamberlain2020-01-17T21:39:14+00:00ISO 27001 Compliance, IT Audit & Compliance, Regulatory Compliance|3 Comments

ISO 27001: Understanding Security Roles and Responsibilities and Why They Are Vital to the Success of Your Security Program

When building your Information Security Management System (ISMS) as part of ISO 27001 program implementation one of the most important elements of the system of management for your security program is ensuring all stakeholders understand their roles and responsibilities. (If you are unfamiliar with ISO 27001 and the “ISMS” you can read our whitepaper on the ISO […]

Christian Hyatt2020-01-17T21:17:01+00:00CISO Discussions, Cyber Risk Management, ISO 27001 Compliance|0 Comments

ISO 27701 Privacy Framework Could be the GDPR Certification We’ve Been Waiting For

Faced with regulatory penalties, an avalanche of due diligence questionnaires, and stringent contractual clauses, companies of all sizes have been impacted by GDPR. To date, most companies have tackled GDPR with sheer effort, investing billions of dollars toward compliance with little or no assurance their efforts have paid off. As a result, business leaders are left wondering “Are we compliant?” […]

Philip Brudney2020-01-17T21:17:02+00:00ISO 27001 Compliance, Privacy Compliance, Regulatory Compliance|0 Comments

Business Continuity Planning: It Takes a Village

Business Continuity Planning (BCP) and Disaster Recovery are essential tools for organizations of any size and maturity level; but what may not be apparent is the appropriate amount of resources required to ensure organizations are prepared with an effective BCP. All too often, the task of constructing and maintaining the organizations Business Continuity Plan falls to a select few or even […]

Glenn Chamberlain2020-01-17T21:17:19+00:00ISO 27001 Compliance, IT Audit & Compliance|0 Comments