Security Policy: Difference between revisions

#what needs to be monitored and measured, including information security processes and controls;

#the methods for monitoring, measurement, analysis and evaluation, as applicable, to ensure valid results;

#when the monitoring and measuring shall be performed;

#who shall monitor and measure;

#when the results from monitoring and measurement shall be analysed and evaluated; and

#who shall analyse and evaluate these results.

#conforms to

*the organization’s own requirements for its information security management system; and

 

#is effectively implemented and maintained.

#plan, establish, implement and maintain an audit programme(s), including the frequency, methods, responsibilities, planning requirements and reporting. The audit programme(s) shall take into consideration the importance of the processes concerned and the results of previous audits;

#define the audit criteria and scope for each audit;

#select auditors and conduct audits that ensure objectivity and the impartiality of the audit process;

#ensure that the results of the audits are reported to relevant management; and

#retain documented information as evidence of the audit programme(s) and the audit results.

#the status of actions from previous management reviews;

#changes in external and internal issues that are relevant to the information security management system;

#feedback on the information security performance, including trends in:

#nonconformities and corrective actions;

#monitoring and measurement results;

3) audit results; and

4) fulfilment of information security objectives;

#feedback from interested parties;

#results of risk assessment and status of risk treatment plan; and

#opportunities for continual improvement.