What is the objective of Annex A.7.2 of ISO 27001:2013?The objective in this Annex is to ensure that employees and contractors are aware of and fulfil their information security responsibilities during employment. Show
A.7.2.1 Management responsibilitiesA good control describes how employees and contractors apply information security in accordance with the policies and procedures of the organisation. The responsibilities placed upon managers should include requirements to; Ensure that those they are responsible for understand the information security threats, vulnerabilities and controls relevant to their job roles and receive regular training (as per A7.2.2); Ensure buy-in to proactive and adequate support for relevant information security policies and controls; and Reinforce the requirements of the terms and conditions of employment. Managers play a critical role in ensuring security consciousness and conscientiousness throughout the organisation and in developing an appropriate “security culture”. A.7.2.2 Information Security Awareness, Education & TrainingAll employees and relevant contractors must receive appropriate awareness education and training to do their job well and securely. They must receive regular updates in organisational policies and procedures when they are changed too, along with a good understanding of the applicable legislation that affects them in the role. It is common for the information security team to partner with HR or a Learning & Development team to carry out skills, knowledge, competence and awareness assessments and to plan and implement a programme of awareness, education and training throughout the employment lifecycle (not just at induction). You need to be able to demonstrate that training and compliance to auditors. Also carefully consider how the training and awareness is delivered to give the staff and contractor resource the best chance of understanding and following it – this means careful attention to content and medium for delivery. What is the objective of Annex A.7.3 of ISO 27001:2013?Annex A.7.3 is about termination and change of employment. The objective in this Annex is to protect the organisation’s interests as part of the process of changing and terminating employment. A.7.3.1 Termination or change of employment responsibilitiesInformation security responsibilities and obligation that remain valid after termination or change of employment must be defined, communicated to the employee or contractor and enforced. Examples include keeping information confidential and not leaving with information that belongs to the organisation. It is really important to ensure that information remains protected after an employee or contractor leaves the organisation, as people themselves are walking data stores. The contractual terms & conditions should reinforce this, and the leaver’s process and/or contract termination process (including return of assets) should include a reminder to individuals that they have some responsibilities to the organisation even after they have left. An auditor will want to see evidence of leavers having returned their assets and the process being closed off and documented to demonstrate assets are updated in the asset inventory (A8.1.1) where appropriate too. This is not just about termination and exit. If an employee changes role e.g. moving from operations to sales, you should do a review to demonstrate they no longer have access to information assets that are not required in the new role, and are provisioned with access to information assets needed for the future. A.7.2.3 Disciplinary ProcessThere needs to be a documented disciplinary process in place and communicated (in line with A7.2.2 above). Whilst focused here for disciplinary action following security breaches, it can also be dovetailed with other disciplinary reasons. If your organisation already has a recognised HR disciplinary process then ensure it covers information security in the manner required for the ISO 27001:2013 standard. ISO 27001 policies, controls, and tools for Human Resource Security are included in ISMS.online. A perfect fusion of knowledge and technology for early ISO 27001 certificationLast Updated on December 22, 2021 by Admin
Explanation: An information security manager has to impress upon the human resources department the need for security awareness training for all employees. Budget considerations are more of an accounting function. The human resources department would become involved once they are convinced for the need of security awareness training. Recruiting IT-savvy staff may bring in new employees with better awareness of information security, but that is not a replacement for the training requirements of the other employees. Periodic risk assessments may or may not involve the human resources department function.
When speaking to an organization's human resources department about information security an information security manager should focus on the need for?Explanation: An information security manager has to impress upon the human resources department the need for security awareness training for all employees.
Which of the following is most important for a successful information security program?Explanation: Sufficient senior management support is the most important factor for the success of an information security program.
Which of the following is most effective in preventing security weaknesses in operating systems?Which of the following is MOST effective in preventing security weaknesses in operating systems? Explanation: Patch management corrects discovered weaknesses by applyinga correction (a patch) to the original program code. Change management controls the process of introducing changes to systems.
Which of the following devices should be placed within a demilitarized zone?Explanation: A mail relay should normally be placed within a demilitarized zone (DMZ) to shield the internal network. An authentication server, due to its sensitivity, should always be placed on the internal network, never on a DMZ that is subject to compromise.
|
When speaking to an organizations human resources department about information security an information security manager should focus on the need for?
zusammenhängende Posts
Urheberrechte © © 2024 paraquee Inc.
