IT GRC Forum

With any project as complex as the implementation of ISO 27001 there are some things to avoid. Here are two quick things you shouldn't do:

The International Standard ISO 27001 (previously BS-7799) for Information Security Management has been designed to help organisations of all types and sizes to implement simple and relevant practices that will secure not just their computer and communications services, but also their offices, their valuable organisational information and the efficiency and well-being of their staff.

If you’ve been reading my blog, you probably think I’m convinced ISO 27001 is the most perfect document ever written. Actually, that’s not true – working with my clients and teaching on the subject, usually the same weaknesses of this standard emerge. Here they are, together with my suggestions how to resolve them:

Nowadays WikiLeaks is a hot story for a good reason – it is not very common for confidential documents of the world’s most powerful government to be published on the Internet. And some of these documents are, to put it mildly, embarrassing.

Have you ever found yourself in a situation where you have been given the task to write a security policy or a procedure? But you don’t want your document to end up like so many others – gathering dust in some forgotten drawer? Here are some thoughts that might help you…