Security Policy: Difference between revisions

# Interested parties that are relevant to the information security management system; and  

# The requirements of these interested parties relevant to information security.  

#the external and internal issues mentioned above

#the requirements mentioned above

#interfaces and dependencies between activities performed by the organization, and those that are performed by other organizations.

#Ensuring the information security policy and the information security objectives are established and are compatible with the strategic direction of the organization;

#Ensuring the integration of the information security management system requirements into the organization’s processes;

#Ensuring that the resources needed for the information security management system are available;

#Communicating the importance of effective information security management and of conforming to the information security management system requirements;

#Ensuring that the information security management system achieves its intended outcome(s);

#Directing and supporting persons to contribute to the effectiveness of the information security management system;

#Promoting continual improvement; and

#Supporting other relevant management roles to demonstrate their leadership as it applies to their areas of responsibility.

:2. Includes information security objectives (see [[Security_Policy#information_security_objectives_and_planning_to_achieve_them|here]]) or provides the framework for setting information security objectives;

::(a) assess the potential consequences that would result if the risks identified were to materialize;

::(b) assess the realistic likelihood of the occurrence of the risks identified; and

::(c)determine the levels of risk;

::(a) compare the results of risk analysis with the risk criteria established; and

:3. Compare the controls determined above with those in Annex A of ISO/IEC 27001:2013 and verify that no necessary controls have been omitted;

:5. Produce a Statement of Applicability that contains the necessary controls above and justification for inclusions, whether they are implemented or not, and the justification for exclusions of controls from Annex A;

 

<small>NOTE Applicable actions may include, for example: the provision of training to, the mentoring of, or the reassignment of current employees; or the hiring or contracting of competent persons. </small>

#the information security policy;

#their contribution to the effectiveness of the information security management system, including the benefits of improved information security performance; and

#the implications of not conforming with the information security management system requirements.

#on what to communicate;

#when to communicate;

#with whom to communicate;

#who shall communicate; and

#the processes by which communication shall be effected.

#identification and description (e.g. a title, date, author, or reference number);

#format (e.g. language, software version, graphics) and media (e.g. paper, electronic); and

#review and approval for suitability and adequacy.

The organization shall plan, implement and control the processes needed to meet information security requirements, and to implement the actions determined in 3.1. The organization shall also implement plans to achieve information security objectives determined in 3.2.

The organization shall perform information security risk assessments at planned intervals or when significant changes are proposed or occur, taking account of the criteria established in 3.1.2.1.