The discomfort zone

Compliance is a concern that pops up repeatedly on the ISO27k Forum, just this  morning for instance. Intrigued by ISO 27001 Annex A control A.18.1.1 “Identification of applicable legislation and contractual requirements”, members generally ask wh…

July 5, 2022
Read More >>

Shout, shout, let it all out

Here’s an insightful and enjoyable way to explore your psyche and vent a little tension at the end of a tough month, week or day.First, find yourself a private space to watch Tears for Fears.Now shout, shout, let it all out: what are the things you cou…

July 1, 2022
Read More >>

What are “information assets”?

Control 5.9 in ISO/IEC 27002:2022 recommends an inventory of information assets that should be “accurate, up to date, consistent and aligned with other inventories”.  Fair enough, but what are ‘information assets’? What, exactly, are we suppo…

June 30, 2022
Read More >>

Authorised exemptions

Inspired by an exchange on the ISO27k Forum yesterday morning, I wrote and published a simple 2-page exemptions policy template for SecAware. In essence, after explaining what ‘exemptions’ are, the policy requires that they are authorised after du…

June 30, 2022
Read More >>