I am looking for a document framework for the ISO 27001 standard. Has anyone found a good and reputable resource with templates for the required minimum documentation of a certified ISMS?

3.3k views3 Upvotes3 Comments

Strategic Banking IT advisor in Banking, 10,001+ employees

Hi!

I once bought a template (not for 27001 however) from this site:

https://www.itgovernanceusa.com/shop/category/itgp-toolkits

They were inexpensive and did the job for my purpose.

There's also a website with free templates :

https://www.iso27001security.com/html/toolkit.html

I hope it could help.

Steve

Senior Information Security Manager in Software, 501 - 1,000 employees

Try https://www.iso27001security.com/

Chief Information Security Officer in Healthcare and Biotech, 1,001 - 5,000 employees

I used the https://www.iso27001security.com/html/toolkit.html

Content you might like

When migrating to the cloud, what's the top security issue that concerns you?

Cloud Security & GRC

Data security51%

Shared resources/services35%

Compliance11%

Other: please specify.1%

685 PARTICIPANTS

2.4k views5 Upvotes1 Comment

Would anyone be willing to share best practices about how their organization deals with ensuring Cookie Compliance, specifically to GDPR rules? Where should this sort of compliance review sit in an organization? The particular issue we have is who should review new web deployments that use cookies and to make the decisions on whether Cookies are Strictly Necessary or Functionality Cookies. For example is a Cookie required for a Live Chat to work Functionality or Strictly Necessary? Our Security team does not consider taking on these compliance reviews as their domain, as Cookie Compliance is not an internal security matter and the Data Protection team has a limited interest as the GDPR rules around Cookies apply in case of any Cookie being used by a website, whether or not it contains personal data.

Security & GRC Regulatory Compliance

Head of Cyber Security in Manufacturing, 501 - 1,000 employees

I would say, DPO and Security team both shall be involved and work hand in hand.

Most of the time the legals and or DPO don't have the technical acumen to understand when data is floating to third party services.

Lets ...read more

324 views1 Comment

Are short term bans of the use of GenAI applications and tools (such as ChatGPT) a good idea for end users in most organizations? For context see this article on the State of Maine Government's directive before you vote: https://www.govtech.com/artificial-intelligence/chatgpt-generative-ai-gets-6-month-ban-in-maine-government

Applications & Platforms End-User Services & Collaboration People & Leadership +4 more

Yes - Maine did the right thing. There are too many security risks with free versions of these tools. Not enough copyright or privacy protections of data.31%

No, but.... - You must have good security and privacy policies in place for ChatGPT (and other GenAI apps). My organization has policies and meaningful ways to enforce those policies and procedures for staff.52%

No - Bans simply don't work. Even without policies, this action hurts innovation and sends the wrong message to staff and the world about our organization.13%

I'm not sure. This action by Maine makes me think. Let me get back to you in a few weeks (or months).3%

357 PARTICIPANTS

9.5k views9 Upvotes1 Comment

If you had a magic wand - what's the #1 daily business challenge you'd eliminate?

People & Leadership Strategy & Architecture Cloud +57 more

CTO in Software, 201 - 500 employees

Without a doubt - Technical Debt! It's a ball and chain that creates an ever increasing drag on any organization, stifles innovation, and prevents transformation.

142 19 Replies

What are some effective ways to get buy-in from leadership to establish your first security PMO?

Security & GRC Security Strategy & Roadmap Internal CXO Relationships

Head of Information Security in Services (non-Government), 1,001 - 5,000 employees

The first thing you need to do is assess the maturity of your security program and then establish a roadmap of projects based on industry standard frameworks. Based on that assessment, you can develop an associated budget ...read more

135 views1 Comment