Please enable JavaScript.

Coggle requires JavaScript to display documents.

ISO 27001 (4.2 Establishing and managing the ISMS (4.2.1 Establish the…

- - - - 1) includes a framework for setting objectives, direction and principles
      - 2) takes into account business and legal or regulatory requirements, and contractual security obligations
      - 3) aligns with the organization
      - 4) establishes criteria against which risk will be evaluated
      - 5) has been approved by management
    - - 1) Identify a risk assessment methodology
      - 2) Develop criteria for accepting risks and identify the acceptable levels of risk
    - - 1) Identify the assets and owners
      - 2) Identify the threats to those assets
      - 3) Identify the vulnerabilities that might be exploited by the threats
      - 4) Identify the impacts that losses of confidentiality, integrity and availability may have on the assets
    - - 1) Assess the potential business impacts
      - 2) Assess the realistic likelihood of security failures occurring
      - 3) Estimate the levels of risks
      - 4) Determine whether the risks are acceptable or require treatment
    - - 1) applying appropriate controls
      - 2) knowingly and objectively accepting risks
      - 3) avoiding risks
    - - 1) the control objectives and controls
      - 2) the control objectives and controls currently implemented
      - 3) the exclusion of any control objectives and controls in Annex A
      - 4) transferring the associated business risks to other parties
  - - - 1) promptly detect errors in the results of processing
      - 2) promptly identify attempted and successful security breaches and incidents
      - 3) enable management to determine whether the security activities are performing as expected
      - 4) help detect security events
      - 5) determine whether the actions taken to resolve a breach of security were effective
    - - 1) the organization
      - 2) technology
      - 3) business objectives and processes
      - 4) identified threats
      - 5) effectiveness of the implemented controls
      - 6) external events, such as changes to the legal or regulatory environment, changed contractual obligations, and changes in social climate
- - - - 1) business requirements
      - 2) security requirements
      - 3) business processes effecting the existing business requirements
      - 4) regulatory or legal requirements
      - 5) contractual obligations
      - 6) levels of risk and/or criteria for accepting risks
- - - - a) establish, implement, operate, monitor, review, maintain and improve an ISMS
      - b) ensure that information security procedures support the business requirements
      - c) identify and address legal and regulatory requirements and contractual security obligations
      - d) maintain adequate security by correct application of all implemented controls
      - e) carry out reviews when necessary, and to react appropriately to the results of these reviews
      - f) where required, improve the effectiveness of the ISMS
    - - a) determining the necessary competencies for personnel
      - b) providing training or taking other actions
      - c) evaluating the effectiveness of the actions taken
      - d) maintaining records of education, training, skills, experience and qualifications