Tag
ISO 27001, page 2
66 articles
Audit readiness
Running several audits on one calendar
How to fit SOC 2, ISO 27001 and PCI DSS into one year: each audit's fixed dates, aligning or staggering fieldwork, and annual controls that serve all three.
6 min read
Security engineering
Writing an incident response plan
An incident response plan people can follow at 3 a.m.: what it must contain, setting severity and roles, tracking notification deadlines, and what to keep.
6 min read
Compliance frameworks
The ISO 27001 management review, done properly
What ISO 27001 clause 9.3 requires of a management review, who must take part, how to prepare each input, and what the record needs to show your auditor.
6 min read
Security engineering
Security monitoring and alerting
Logs prove nothing until someone looks. Which detections to build first, how to route and triage alerts, tune without losing coverage, and evidence it all.
6 min read
Audit readiness
Working well with your auditor
What your SOC 2 auditor or ISO certification body can and cannot help with, what to agree at kickoff, how to disagree with a finding, and what to ask after.
6 min read
Compliance frameworks
Running the ISO 27001 internal audit
What ISO 27001 clause 9.2 requires of an internal audit, who can perform it, how to build the audit program, and how to run one audit from plan to report.
6 min read
Security engineering
Centralized logging for compliance
What to log, what each event must contain, how long to keep it, and how to protect it. Centralized logging mapped to SOC 2, ISO 27001, PCI DSS and HIPAA.
5 min read
Audit readiness
What to do when a control fails mid-period
A control failed partway through your SOC 2 or ISO 27001 audit period. How to contain it, measure the extent, find the cause, and tell your auditor.
6 min read
Security engineering
Access reviews that hold up under audit
Most access reviews fail on evidence, not on rigor. Here is what an auditor samples, and the four artifacts that make a review defensible months later.
3 min read
Compliance frameworks
ISO 27001 surveillance audits: what to expect each year
What an ISO 27001 surveillance audit must cover, how the certification body samples across the three-year cycle, and how to run the year between audits.
6 min read
Security engineering
MDM vs a lightweight endpoint agent
MDM enforces device settings; a lightweight agent reports them. What auditors need from endpoints, when each approach fits, and how to combine the two.
6 min read
Security engineering
Full-disk encryption on every laptop
A lost laptop is a non-event if you can prove it was encrypted. What the rules say, why recovery keys matter, and how to evidence encryption on every device.
5 min read
Compliance frameworks
ISO 27001 stage 1 vs stage 2 audits
What the certification body examines in an ISO 27001 stage 1 and stage 2 audit, how the two stages differ, what happens between them, and how to prepare.
6 min read
Compliance frameworks
Why the same control appears in four frameworks
SOC 2, ISO 27001, HIPAA and PCI DSS ask overlapping questions in different words. Mapping once and reusing the evidence is what makes the second one fast.
3 min read
Audit readiness
First-audit mistakes, and how to avoid them
The mistakes that make a first SOC 2 or ISO 27001 audit slower and messier: aspirational policies, unknown populations, ignored vendors and the draft report.
6 min read
Security engineering
Patch management evidence
"Show us systems are patched" is a hard request when assets differ. The evidence that holds up for laptops, servers, containers and managed services, over time.
6 min read
Risk and vendors
Vendor tiering by data access
How to tier vendors by the data and systems they can reach, the intake questions that set a tier, what each tier triggers, and edge cases that mislead.
6 min read
Compliance frameworks
Moving from ISO 27001:2013 to the 2022 edition
The ISO 27001:2013 transition period is over. What changed in the clauses and Annex A, where 2013 leftovers hide in an ISMS, and how to check for them.
6 min read
Security engineering
Vulnerability management SLAs auditors accept
Auditors test whether you met your own remediation windows. How to set severity tiers and SLAs you can keep, handle exceptions, and evidence every finding.
6 min read
Compliance frameworks
Building a privacy information management system on your ISMS
A step-by-step plan for extending an ISO 27001 ISMS into an ISO 27701 PIMS: roles, scope, privacy risk, controls, and the management review changes.
6 min read
Compliance frameworks
How to write a Statement of Applicability
What ISO 27001 requires in a Statement of Applicability, the columns worth adding, how to justify inclusions and exclusions, and how to keep it current.
6 min read
Risk and vendors
Risk treatment options: mitigate, transfer, accept or avoid
What each of the four risk treatment options really commits you to, the evidence each leaves, why transfer never moves accountability, and when to mix.
6 min read
Security engineering
Joiner, mover, leaver processes
Joiner, mover, leaver is one access process with three triggers. How to run each event from the HR record, why movers get missed, and what evidence to keep.
6 min read
Audit readiness
Preparing control owners for auditor interviews
Who auditors interview, the questions control owners and staff are asked, a one-page briefing for each owner, and the line between preparing and coaching.
6 min read