accedere

[accedere]

10 Steps to get certified for ISO/IEC 27001

ISO/IEC 27001:2103 is currently the leading international standard for Third Party Risk Management which is widely known for providing the best practices and framework for an information security management system (ISMS).

This standard was published by the International Organization for Standardization (ISO), an independent, non-governmental international organization with a membership of 167 national standards bodies in partnership with the International Electrotechnical Commission (IEC), a not-for-profit organization that works independently of any government; hence it is called as ISO/IEC 27001:2013.

The new update of the certifying standard ISO/IEC 27001 is expected to be released soon in 2022. For implementing ISO 27001 and monitoring it’s effectiveness there are certain mandatory steps that should be kept in mind and followed. Accedere Inc has summarized them into 10 steps as under:

1.Develop a team: A good team with required skills and expertise will make the ISMS implementation free of challenges. Top management to select the team based on the Information Security objectives, skills and expertise required to achieve the objectives. To kick start the project a leader be appointed with building a team with SWOT analysis for each member and assign right task to right team member to achieve maximum output. Project leader to ensure to meet the time and cost schedule. Top management must have periodical review meeting to ensure that implementation is as per plan. Project leader need to share status report regularly on status of implementation to the management.

2.Develop a plan: We all know that a plan is a foremost step while trying to achieve an important milestone or job-at-hand. Also, substitute plan(s) must be developed in case of any emergency. Developing a plan requires various important factors to be considered and implemented like assigning the roles and responsibilities, delegating the authorities and reporting, who will do the changes or improvement whenever required, what will be the mode of communication and its effective implementation.

3.Make the strategies: After developing a plan, strategies must be made regarding steps / actions which will help achieve the plan in the most effective manner. Strategies will provide a path & show the way to implement ISO/IEC 27001 in the most efficient way which will help to achieve the objective. Each strategy should also be analyzed to ensure that the outcome was as expectation and to monitor progress. Making strategies includes which kind of model will be implemented, what will the policy and procedure structure be, how to track and measure the tasks, etc.

4.Develop Documents: After planning and strategy, the requirement of developing the documents begin which is a crucial step of the entire implementation process. Most organizations chose to onboard ISO/IEC consultants who can build the documents as per the standard requirements. Each task or training taking place must be recorded. Documents like organization policies and structure of top management, instructions regarding working policies, previous records of employees and their working procedure, etc. should be there.

5.Objective of ISMS: Understanding and knowing the long-term and short-term objectives is required to ensure that the organizational objectives are achieved. In what way the ISMS will be useful in an organization must be clear while defining the objectives.

6.Standards for Security Comparison: The most crucial thing for protecting the data is to establish a standard for comparison. This makes sure that the activities are under control by doing daily monitoring and comparing according to the standards.

7.Managing the risks: ISMS is purely dependent on its risk management structure. It might not be wrong to say that the whole process of ISMS depends on the risk assessment process. ISO/IEC 27001 standards give the flexibility to the organization to defines and access its own risk management structure. This risk management process comprises of several steps like making a framework for this structure, knowing what kind of risk could occur, analyzing those risk by going through it thoroughly, doing the evaluation by comparing it with the established standards and make changes accordingly while considering various options to continuously monitor and the minimize the risk. A risk has a hierarchy according to the acceptance level. At a certain level, the risk is accepted but, when it excesses the level of acceptance the level of threat increases and causes plausible harm to an organization.

8.Risk action plan: Educate and train each employee and staff member about the security control methods so that data is kept secure all the time. According to the scope which has been made clear earlier, the task must be monitored at every step to determine the conformation.

9.Measure and evaluate: Always have an eye on every process and timely measure it with the standards and so the necessary changes can be taken if required. There must be a time frame defined for evaluating the process like in every minute, hour, every day or every 15 days, or 6 months or yearly. For continuous improvement, tracking should be laid down in several categories to define it properly like good, better, best. Or giving a rating e.g from 1-10.

10.Final certification stage: When every stage clears one by one, a certification body like us (https://Accedere.io) conducts external audit to finalize the certification process. A proper process is conducted, and everything is analyzed very precisely. This process may possibly consume time, hence choosing the right certification body is extremely important.

For more information kindly reach to info@accedere.io

Source link: https://medium.com/@accedere.io/10-steps-to-get-certified-for-iso-iec-27001-42b1e670c578

[accedere]

Accedere Inc. is elacted to share it’s client MoEngage’s Intelligent Customer Engagement

Accedere Inc. is elated to share that we recently got our client MoEngage’s Intelligent Customer Engagement Platform SaaS Application Services attested for STAR Level 2

Accedere started the process by conducting a SOC2 Type 2 assessment for the applicable Trust Services Criteria 2017(Security, Availability, and Confidentiality) along with theCCM 4.0.5 controls.A consolidated report was submitted to MoEngage and to the CSA STAR Registry to achieve this great credential. Credential can be viewed in https://cloudsecurityalliance.org/star/registry/moengage-inc.

Accedere Inc. supported MoEngage for submitting the CAIQ 4.0.2 for STAR Level 1 and STAR Level2 intake forms to CSA which finally led to MoEngage in successfully achieving their CSA STAR Level 2 Attestation.

This is a unique achievement for Accedere Inc., MoEngage and Cloud Security Alliance. There is greater adoption of the CSA STAR, the updated CSA’s Ver 4.0, and to the transparency by the Cloud Service Provider (CSP). Accedere Inc. Congratulates MoEngage on their incredible success!

Accedere Inc. is a global provider of Assurance services for cybersecurity compliance. Accedere Inc. is a Colorado CPA firm registered with PCAOB with a focus on Cloud Security and Privacy and empaneled Cloud Security Alliance (CSA) auditors for conducting assessments for CSA STAR Level 2 attestation and certification requirements. As an ISO/IEC certification body, Accedere Inc. has the relevant expertise in supporting ISO /IEC 27001 + STAR certification process too.

The CSA STAR Attestation leverages the requirements of the AICPA governed SOC 2 Type 2 Attestation along with the CSA Cloud Controls Matrix. Assessment review periods are determined by the client but should be no less than 6 months. For STAR Attestation, the renewal period is every 12 months. You must have a SOC 2 Type 2 Attest report to apply for STAR Attestation, or you can get the SOC 2 Type 2 and STAR together. The CSA STAR Level 2 can also be achieved using the ISO IEC 27001 approach along with the CCM controls that need to be in the scope of the Statement of Applicability.

STAR encompasses the key principles of transparency, rigorous auditing, and harmonization of standards outlined in the Cloud Controls Matrix (CCM). Publishing to the registry allows organizations to show current and potential customers their security and compliance posture, including the regulations, standards, and frameworks they adhere to. It ultimately reduces complexity and helps alleviate the need to fill out multiple customer questionnaires

CSA star is being recognized as the international harmonized GRC solution leading the way of trust for cloud providers, users and their stakeholders by providing and integrated cost-effective solution that decreases complexity and increases assurance and transparency while enabling organizations to secure their information, protect themselves from cyber-threats, reduce risk and strengthening their information governance and privacy platform.

Creates trust and accountability in the cloud market with increasing levels of transparency and assurance.

Provides the solution to an increasingly complex and resource demanding compliance landscape, by providing technical standards, a, integrated certification and attestation framework, and public registry of trusted data

Accedere’s Cloud Assurance Business is led by Ashwin Chaudhary who is an MBA, CPA and has certifications CCSK, CITP, CISSP, CISA, CISM, CRISC, CGEIT, CDPSE, ISO27001LA. For more details on how we can help please contact us on info@accedere.io and you can also visit our website to know about our detailed services www.accedere.io

Source link: https://medium.com/@accedere.io/accedere-inc-is-elacted-to-share-its-client-moengage-s-intelligent-customer-engagement-5f482d6b73c