Security Policy: Difference between revisions
Jump to navigation
Jump to search
mNo edit summary |
No edit summary |
||
| (2 intermediate revisions by the same user not shown) | |||
| Line 344: | Line 344: | ||
The organization shall continually improve the suitability, adequacy and effectiveness of the information security management system | The organization shall continually improve the suitability, adequacy and effectiveness of the information security management system | ||
== Apenndix | == Apenndix == | ||
{| class="wikitable" | {| class="wikitable" | ||
| Line 352: | Line 352: | ||
| 1.3 || Scope of the ISMS | | 1.3 || Scope of the ISMS | ||
|- | |- | ||
| | | 2.2 & 3.2 || IS Policy & Objectives | ||
|- | |- | ||
| | | 3.1.2 || Risk Assessment & Risk Treatment Methodology | ||
|- | |- | ||
| | | 3.1.3.d || Statement of Applicability | ||
|- | |- | ||
| | | 3.1.3.5 & 3.2 || Risk treatment plan | ||
|- | |- | ||
| | | 5.2 || Risk assessment report | ||
|- | |- | ||
| A.7.1.2 & A.13.2.4 || Definition of Security Roles and Responsibilities | | A.7.1.2 & A.13.2.4 || Definition of Security Roles and Responsibilities | ||
| Line 382: | Line 382: | ||
| A.18.1.1 || Statutory, Regulatory, and Contractual Requirements | | A.18.1.1 || Statutory, Regulatory, and Contractual Requirements | ||
|- | |- | ||
| | | 4.2 || Records of Training, Skills, Experience and Qualifications | ||
|- | |- | ||
| | | 6.1 || Monitoring and Measurement Results | ||
|- | |- | ||
| | | 6.2 || Internal Audit Program | ||
|- | |- | ||
| | | 6.2 || Results of Internal Audits | ||
|- | |- | ||
| | | 6.3 || Results of the Management Review | ||
|- | |- | ||
| | | 7.1 || Results of Corrective Actions | ||
|- | |- | ||
| A.12.4.1 & 12.4.3 || Logs of User Activities, Exceptions, and Security Events | | A.12.4.1 & 12.4.3 || Logs of User Activities, Exceptions, and Security Events | ||
|- | |- | ||
| | | 4.5 || Procedure for document control | ||
|- | |- | ||
| | | 4.5 || Controls for managing records | ||
|- | |- | ||
| | | 6.2 || Procedure for internal audit | ||
|- | |- | ||
| | | 7.1 || Procedure for corrective action | ||
|- | |- | ||
| A.6.2.1 || Bring your own device (BYOD) policy | | A.6.2.1 || Bring your own device (BYOD) policy | ||
| Line 432: | Line 432: | ||
| A.17.2.1 || Business continuity strategy | | A.17.2.1 || Business continuity strategy | ||
|} | |} | ||
== See also== | |||
[[Security_Appendix | Security Appendix]] | |||