For many if not most organisations information security risk management is a new and relatively immature activity that they are still discovering and learning more about. This can mean that the results of the activity can be imperfect. As we learn we can improve the process to better fit the requirements of the organisation but […]
A brief post this time on my thoughts as to how best integrate certification to the Government’s Cyber Essentials scheme into an ISO 27001 ISMS. I’m going to intentionally stay away from how to achieve certification to Cyber Essentials, and just focus on how it might sit within your ISMS. Assuming that you’ve identified a good business […]
Over the past week I’ve been looking at our existing processes for managing risk, how information security risk fits within this framework, and what improvements can be made overall. One of my concerns is that most people aren’t used to explicitly thinking about risk and that my colleagues need to be able to relate to […]