Tag
ISO 27001, page 3
66 articles
Security engineering
Offboarding that removes access the same day
Late access removal is a classic audit exception. How to set a testable standard, start from a trigger you trust, and remove access in the right order.
6 min read
Compliance frameworks
The ISO 27001:2022 Annex A themes, explained
How the 93 Annex A controls in ISO 27001:2022 are grouped into four themes, which 11 controls are new, and how ISO 27002 attributes let you sort them.
5 min read
Audit readiness
What happens in an audit walkthrough
What an auditor does in a control walkthrough, what they are testing, what to have open on screen, and the mistakes that turn a one-hour session into three.
6 min read
Risk and vendors
Writing a risk appetite statement
How to write a security risk appetite statement leadership will approve: appetite vs tolerance, a structure by category, sample wording, and common faults.
6 min read
Security engineering
Managing privileged access
Admin accounts carry most of your access risk. How to find them, separate them, grant elevation for hours instead of years, and log what privileged users do.
6 min read
Compliance frameworks
ISO 27001 clause 6: risk assessment and treatment
What ISO 27001 clause 6.1 requires of your risk assessment and treatment process, step by step, the records it must leave, and where auditors find gaps.
6 min read
Audit readiness
How auditors sample controls
How SOC 2 auditors set sample sizes, select items from your population and handle a failed sample, and how ISO 27001 certification audits sample instead.
6 min read
Security engineering
Least privilege in practice
Every framework asks for least privilege and none says how. Designing roles, finding excess access, separating duties on a small team, and proving all of it.
6 min read
Compliance frameworks
ISO 27701 controller and processor controls
How to decide which ISO 27701 role you hold per activity, what the controller and processor control sets ask for, and the evidence each one has to produce.
6 min read
Risk and vendors
Risk scoring: likelihood and impact
How to build likelihood and impact scales two people apply the same way, how to combine them without false precision, and how auditors test your scores.
6 min read
Compliance frameworks
ISO 27001 clause 4: context and interested parties
What ISO 27001 clauses 4.1 to 4.4 require, how to record your issues and interested parties so they drive scope and risk, and what auditors look for.
6 min read
Audit readiness
Types of audit evidence, and which is strongest
Inquiry, observation, inspection and reperformance, ranked the way auditing standards rank them, and what that ranking means for the records you keep.
6 min read
Security engineering
SSO as a compliance control
Single sign-on makes access controls cheaper to run and easier to prove, but only for the apps behind it. What SSO covers, what it misses, and what to test.
6 min read
Risk and vendors
Building a risk register auditors accept
The fields a risk register needs, how to write risks that are not missing controls in disguise, and the register mistakes auditors turn into findings.
7 min read
Security engineering
Enforcing MFA for every user
Turning MFA on is easy. Proving it covers every account is not. Where coverage breaks, which factors hold up, and the MFA evidence auditors actually test.
7 min read
Audit readiness
Planning your first audit timeline
Plan a first SOC 2 or ISO 27001 audit backward from the date it is needed: the steps that cannot be compressed, what each waits on, and where plans slip.
6 min read
Compliance frameworks
ISO 27701 explained: extending ISO 27001 to privacy
What ISO 27701 adds to an ISO 27001 ISMS, how controller and processor controls fit, why the 2025 revision matters, and who should pursue it.
6 min read
Compliance frameworks
What an ISMS is, in plain terms
An ISMS is the management system ISO 27001 certifies, not a tool or a binder. What it is made of, what clauses 4 to 10 require, and where Annex A fits.
6 min read