SPRING DISCOUNT
Get 30% off on toolkits, course exams, and Conformio yearly plans.
Limited-time offer – ends April 25, 2024
Use promo code:
SPRING30

Expert Advice Community

Guest

ISO 27001:2013

  Quote
Guest
Guest user Created:   Jan 12, 2016 Last commented:   Jan 12, 2016

ISO 27001:2013

I am acting for a client who is hoping to go for certification next April and the original gap analysis was done on the 2005 version of the standard. We are keen to be following the 2013 standard so are making the appropriate revisions in documents prepared to date. We have a Risk Treatment plan and a Corrective Action process but In order to show the auditor that we have "converted" I have prepared an extra document which i have called a "Remediation Plan" document which sets out the old controls, the gap analysis score, the new control and the description of the new control which then has a plan of action next to the control (stating the work we need to do such as policy/procedure/process/review etc). The plan of action is really a project plan of the individual groupings on the Risk Treatment Plan in more detail. Do you think that is enough to ensure the auditor knows we have converted ourselves over?
0 0

Assign topic to the user

ISO 27001 DOCUMENTATION TOOLKIT

Step-by-step implementation for smaller companies.

ISO 27001 DOCUMENTATION TOOLKIT

Step-by-step implementation for smaller companies.

Guest
DejanK Jan 12, 2016

The process you have set in place seems pretty systematic, but the auditor will look at the results, not the process itself. So for example, the auditor will check if risk owners are nominated for each risk (this is something that is new in 2013 revision), he won't care how you made this transition.

These articles will also help you:

How to make a transition from ISO 27001 2005 revision to 2013 revision https://advisera.com/27001academy/knowledgebase/how-to-make-a-transition-from-iso-27001-2005-revision-to-2013-revision/
What has changed in risk assessment in ISO 27001:2013 https://advisera.com/27001academy/knowledgebase/what-has-changed-in-risk-assessment-in-iso-270012013/

Quote
0 0

Comment as guest or Sign in

HTML tags are not allowed

Jan 12, 2016

Jan 12, 2016

Suggested Topics