12 docs tagged with "ISO 27001"

Organisational and technical boundaries of the ISMS or AIMS, including systems, activities, sites, suppliers and exclusions.

Statement of which controls apply, are excluded, or are treated—the Statement of Applicability.

What is communicated about the management system, to whom, when, through which channel, and with what evidence.

Evidence that a role has the required skill, qualification and training, with expiry.

A nonconformity and the containment, root cause, action, owner, due date, effectiveness test and closure that follow.

An asset, system, facility, service or process the ISMS governs, with classification and ownership.

A security or AI event the management system must classify, decide on, communicate and learn from.

A measurable management-system objective with target, measure, owner, period and result.

A recorded review of the management system by top management: inputs, decisions and resulting actions.

Internal and external issues, objectives and jurisdictions that frame the ISMS or AIMS.

A versioned assessment of risk: criteria, method, likelihood, consequence, residual and review trigger.

A requirement an interested party places on the management system, with provenance into guidance, control, risk and policy.