are very tricky to identify, analyze and treat: remember Sendai! This control extends well into business continuity management, hence BC strategies, policies, arrangements are probably partly relevant, as well as broader etc. commercial strategies etc. A16.1.1 Incident management responsibilities [Information- or IT- or information security-related] incident management rôles, A16.1.2 Incident responsibilities and objectives, plus policies, procedures and guidelines reporting (e.g. routine and emergency contact points), plus records/evidence concerning A16.1.3 events/incidents reported, logged, analyzed, possibly escalated, addressed and Vulnerability Specified resolved as evidence of compliance. The auditors will welcome evidence of a reporting In draft managed, measured, systematic, rational and effective process for handling A16.1.4 Incident Done incidents from cradle-to-grave, including post-incident wash-ups and assessment substantive organizational changes to embody the learning. For bonus points, show-off your strong forensics capability, and demonstrate that you also A16.1.5 Incident discover, respond/react to and learn from near-misses and incidents affecting response 3rd-parties. A16.1.6 Learning from incidents A16.1.7 Forensics As literally worded, the standard is primarily concerned with ensuring the A17.1.1 Planning continuity of important information security activities and controls during a infosec continuity major incident or disaster but you and I know that information security is … A17.1.2 Specified generally a relatively minor consideration under such circumstances and is Implementing In draft completely trumped by ensuring the continuity of core business activities, hence infosec continuity Done sensible documentation in this area includes business continuity strategies, policies, plans, procedures, test/exercise reports etc. demonstrating the A17.1.3 Verifying effectiveness of the organization’s preparations, including but extending far infosec continuity beyond information/IT and indeed information risk and security activities. [ISO
are very tricky to identify, analyze and treat: remember Sendai! This control extends well into business continuity management, hence BC strategies, policies, arrangements etc. are probably partly relevant, as well as broader commercial strategies etc. A16.1.1 Incident management responsibilities A16.1.2 Incident reporting A16.1.3 Vulnerability reporting A16.1.4 Incident assessment A16.1.5 Incident response A16.1.6 Learning from incidents A16.1.7 Forensics Specified In draft Done [Information- or IT- or information security-related] incident management rôles, responsibilities and objectives, plus policies, procedures and guidelines (e.g. routine and emergency contact points), plus records/evidence concerning events/incidents reported, logged, analyzed, possibly escalated, addressed and resolved as evidence of compliance. The auditors will welcome evidence of a managed, measured, systematic, rational and effective process for handling incidents from cradle-to-grave, including post-incident wash-ups and substantive organizational changes to embody the learning. For bonus points, show-off your strong forensics capability, and demonstrate that you also discover, respond/react to and learn from near-misses and incidents affecting 3rd-parties. A17.1.1 Planning infosec continuity A17.1.2 Implementing infosec continuity A17.1.3 Verifying infosec continuity Specified In draft Done As literally worded, the standard is primarily concerned with ensuring the continuity of important information security activities and controls during a major incident or disaster … but you and I know that information security is generally a relatively minor consideration under such circumstances and is completely trumped by ensuring the continuity of core business activities, hence sensible documentation in this area includes business continuity strategies, policies, plans, procedures, test/exercise reports etc. demonstrating the effectiveness of the organization’s preparations, including but extending far beyond information/IT and indeed information risk and security activities. [ISO
ISO27k_ISMS_Mandatory_documentation_checklist_release_1v1.docx