Clause 6.1.3 & clause 6.2 - by software outsourcing company in India

iFour ConsultancyClause 6.1.3 & Clause 6.2

 Risk management process
 Clause 6.1.3 : Risk treatment process
 Risk treatment strategies
 Clause 6.2 : Information security objectives
 References
Contents
Custom eCommerce Developers
http://www.ifourtechnolab.com

Risk management process

Clause 6.1.3 Information Security Risk Treatment
Organization should define and apply an information security risk treatment
process, implementation and operation.
Responds to risks evaluated in Clause 6.1.2(e) i.e. evaluation of information
security risks of ISO 27001:2013.
Documents all information related to this risk treatment process as
Risk Treatment Plan (RTP).

 Select appropriate information security risk treatment options by taking account of
the risk assessment results
 Determine all controls that are necessary to implement the information security
risk treatment options chosen above
 Compare the controls determined in above step with those in Annexure A of
ISO 27001:2013
 Verify that no necessary controls have been omitted
Risk treatment process

Risk treatment process (Continued)
 Produce a Statement Of Applicability(SoA) that contains the necessary
controls and justification for inclusions
Assess whether necessary controls listed in Annexure A of ISO 27001:2013 are
implemented or not
Provide justification for exclusions of controls from Annexure A of ISO
27001:2013
Formulate information security risk treatment plan (RTP)
Obtain risk owner’s approval of RTP and acceptance of the residual
information security risks

 Risks can be treated in four ways:
 Risk Acceptance
 Risk Reduction
 Risk Transference
 Risk Avoidance
Risk Treatment Strategies

 Risk Acceptance:
Risks are acceptable with current controls
 Risk Reduction:
Risks are reduced by implementing additional controls
 Risk Avoidance:
Risks can not be reduced with current controls and risks are not accepted
 Risk Transference:
Risks are transferred to other third parties
Risk Treatment Options

Documented Information for Clause 6.1.3
Organization should retain documented information about the information
security risk treatment process.
Information about risk treatment process is documented in two ways:
 Risk Treatment Plan
 Statement of Applicability

Organization shall establish information security objectives at relevant
functions and levels.
Information security objectives primarily concerns with:
Confidentiality
Integrity
Availability
Clause 6.2 : Information Security Objectives
Confidentiality Integrity
Availability

 Be consistent with information security policy
 Be measurable
 Be communicated
 Be updated as appropriate
 Take into account applicable information security requirements and results from
risk assessment and risk treatment
Information Security Objectives Characteristics

 Organization shall determine following information to achieve information security
objectives:
What will be done
What resources will be required
Who will be responsible
When it will be completed
How the results will be evaluated
Information Security Objectives Requirements

 Organization shall retain documented information on the information security
objectives.
 Information security objectives are documented and should be complied with
information security policies.
 Confidentiality, Integrity and Availability of information is documented to secure
information assets.
Documented information for Clause 6.2

References
http://www.slideshare.net/null0x00/iso-27001-2013-changes
http://www.bsigroup.com/LocalFiles/en-GB/iso-iec-27001/resources/BSI-
ISO27001-transition-guide-UK-EN-pdf.pdf
https://en.wikipedia.org/wiki/ISO/IEC_27001:2013
http://www.iso27001security.com/html/27001.html

iFour Consultancy Services
 Visit this website for more details:
http://www.ifourtechnolab.com
THANK YOU!!!

Clause 6.1.3 & clause 6.2 - by software outsourcing company in India

Empfohlen

Empfohlen

Weitere ähnliche Inhalte

Andere mochten auch

Andere mochten auch (10)

Kürzlich hochgeladen

Kürzlich hochgeladen (20)

Clause 6.1.3 & clause 6.2 - by software outsourcing company in India

Hinweis der Redaktion