Below is the diagram to demonstrate steps involved in an audit: The following documents can be used as reference: Audit Checklist Audit Plan Sample Policy Format Audit Report Template Risk Register Statement of Applicability (SOA)
Tag Archives: cybersecurity
The Audit (ISO 19011)
What is an Audit? Systematic, independent and documented process for obtaining audit evidence and evaluating it objectively to determine the extent to which the audit criteria are fulfilled. Auditing means asking the auditee what he does, and checking to see if he does it. Types of Audit Actors in audit Auditing Principles
Monthly Round Up for the month of May 2024
Nissan data breach exposed Social Security numbers of thousands of employees Nissan suffered a data breach last November in a ransomware attack that exposed the Social Security numbers of thousands of former and current employees, the Japanese automaker said 15th May. Nissan’s U.S.-based subsidiary, Nissan North America, detailed the cyberattack in a May 15 letter toContinue reading “Monthly Round Up for the month of May 2024”
A.8 Technological Controls (34 Controls)
A.8.1 User end point devices Information stored on, processed by or accessible via user end point devices shall be protected. A.8.2 Privileged access rights The allocation and use of privileged access rights shall be restricted and managed. A.8.3 Information access restriction Access to information and other associated assets shall be restricted in accordance with theContinue reading “A.8 Technological Controls (34 Controls)”
A.7 Physical Controls (14 Controls)
A.7.1 Physical security perimeters Security perimeters shall be defined and used to protect areas that contain information and other associated assets. A.7.2 Physical entry Secure areas shall be protected by appropriate entry controls and access points. A.7.3 Securing offices, rooms and facilities Physical security for offices, rooms and facilities shall be designed and implemented. A.7.4Continue reading “A.7 Physical Controls (14 Controls)”
A.6 People Controls (8 Controls)
A.6.1 Screening Background verification checks on all candidates to become personnel shall be carried out prior to joining the organization and on an ongoing basis taking into consideration applicable laws, regulations and ethics and be proportional to the business requirements, the classification of the information to be accessed and the perceived risks. A.6.2 Terms andContinue reading “A.6 People Controls (8 Controls)”
A.5 Organizational Controls (37 Controls)
A.5.1 Policies for information security Information security policy and topic-specific policies shall be defined, approved by management, published, communicated to and acknowledged by relevant personnel and relevant interested parties, and reviewed at planned intervals and if significant changes occur. A.5.2 Information security roles and responsibilities Information security roles and responsibilities shall be defined and allocatedContinue reading “A.5 Organizational Controls (37 Controls)”
Control Groups / Annexure
ISO 27001 Controls A.5 Organizational Controls A.6 People Controls A.7 Physical Controls A.8 Technological Controls
Monthly Round Up for the month of April 2024
Boat Data Breach Exposes Personal Information of Over 7.5 Million Users Amit Gupta-led startup Boat has reportedly witnessed a major data breach incident. The private details of over 7.5 million customers have made their way onto the dark web. This includes sensitive information like names, addresses, phone numbers, email addresses, and customer IDs. As perContinue reading “Monthly Round Up for the month of April 2024”
Lab 2: Network Security Groups and Application Security Groups
Objective You have been asked to implement your organization’s virtual networking infrastructure and test to ensure it is working correctly. In particular: Exercise 1: Create the virtual networking infrastructure Step 1: Type Virtual networks and press the Enter key and click + Create. Step 2: Fill in the details On the IP addresses tab ofContinue reading “Lab 2: Network Security Groups and Application Security Groups”
