Independent thinking. Informed defence.

CISO Times

Intelligence for the people behind the defence.

The CISO Decision Brief

Regulation, audit and certification

Scoping, preparing for and passing audits, and working out where ISO 27001, NIS2, DORA and GDPR overlap.

The packs behind these answers

How do we…

Methods: how a thing is done well.

  1. How do we set the scope of our ISMS?
  2. How do we justify excluding an Annex A control?
  3. How do we prepare our people for auditor interviews?
  4. How do we run an internal audit when we are small?
  5. How do we run a management review that actually decides things?
  6. How do we set up an ISO 27001 risk assessment and treatment method that stands up to an audit?
  7. How do we get the top management commitment and resources an ISO 27001 project needs?
  8. How do we write an information security policy and objectives that stand up to an ISO 27001 audit?
  9. How do we show that the people running our ISMS are competent and that our staff are aware?
  10. How do we choose a certification body and agree our audit dates?
  11. How do we keep our ISO 27001 certificate after the certification audit?
  12. How do we decide whether our own people, a consultant or both do the ISO 27001 implementation work?
  13. How do we decide which issues and interested parties' requirements our ISMS has to address?
  14. How do we decide what to monitor and measure in our ISMS, and who evaluates it?
  15. How do we use our cloud providers' certificates and reports in our ISMS scope and Statement of Applicability?
  16. How do we build a register of legal, regulatory and contractual requirements that stands up to an ISO 27001 audit?
  17. How do we keep an asset inventory that stands up to an ISO 27001 audit?
  18. How do we decide what documented information our ISMS needs and keep it under control?
  19. How do we decide what to log and monitor, and who reviews it, for an ISO 27001 audit?
  20. How do we decide which changes to systems need approval, and handle emergency changes, under ISO 27001?
  21. How do we decide where we need encryption and how we manage keys and certificates under ISO 27001?
  22. How do we decide the rules for remote working and personal devices under ISO 27001?
  23. How do we decide how to prevent data leakage and set the rules for sending information out, under ISO 27001?
  24. How do we work out which Member State's NIS2 rules apply to us, and whether we need an EU representative?
  25. How do we decide which of our functions are critical or important under DORA?
  26. How do we review our existing ICT contracts against DORA's contract terms and decide what to do about each gap?
  27. How do we find out what our national NIS2 law adds to the Directive?
  28. How do we decide which pre-employment screening and employment terms our ISMS needs?
  29. How do we control an outsourced process so that it counts inside our ISMS scope?
  30. How do we scope and certify an ISMS across several sites or legal entities?
  31. How do we add ISO 27701, ISO 22301 or ISO 9001 to our ISMS without doing the same work twice?
  32. How do we find the minimum control set when DORA, NIS2 and ISO 27001 all apply to us?
  33. How do we show that our management body has approved and oversees our NIS2 measures?
  34. How do we get ready for a NIS2 supervisor's request for evidence?
  35. How do we plan cybersecurity training for our management body?
  36. How do we build and keep our register of information on ICT third-party arrangements?
  37. How do we show our management body has approved and oversees our ICT risk management framework?
  38. How do we get ready for a supervisor's request for DORA evidence?
  39. How do we leave an ICT provider that supports a critical or important function without stopping the service?
  40. How do we run and record a HIPAA security risk analysis?
  41. What belongs inside the boundary of our SOC 2 report?
  42. How do we get ready for a SOC 2 examination: owners, evidence and a readiness check?
  43. How long should the observation period be, and what do we send customers in the gap?
  44. How do we choose a CPA firm for a SOC 2 examination?

When do we…

Triggers and timing: when something has to happen.

  1. When are we ready for the Stage 1 audit?
  2. When will certification realistically happen, and what will it cost?
  3. When is a NIS2 readiness gap blocking, and who must hear about it?
  4. When does DORA require threat-led penetration testing, and how do we plan the other tests?
  5. When is a DORA readiness gap blocking, and who must hear about it?

Is it…

Judgements with a yes or no at their centre.

  1. Do we need a separate register of risks and opportunities for our ISMS itself, apart from our risk register?
  2. Is our organisation in scope of NIS2, and as essential or important?
  3. Is our organisation a financial entity under DORA, and which duties follow?
  4. Do we qualify for the simplified ICT risk management framework or the microenterprise relief?
  5. Does our ISO 27001 certificate satisfy DORA's ICT risk management framework?
  6. Is our organisation a HIPAA covered entity, a business associate, or neither?
  7. Is an "addressable" HIPAA safeguard optional?
  8. Do we need a SOC 2 Type 1 or Type 2 report first?
  9. Which Trust Services Categories should our SOC 2 report cover?

If…, then how…

Situations: something has happened, what now.

  1. If the auditor raises a major nonconformity, then what?
  2. If we are halfway through implementation and behind plan, then do we move the audit date?
  3. If Stage 1 has raised concerns, then how do we get ready for Stage 2?
  4. If we build or configure software ourselves, how much secure development does ISO 27001 expect?
  5. If we work from a shared building or a rented office, which physical controls do we still need under ISO 27001?
  6. If a member of staff breaks the security policy, then how do we decide the disciplinary response?
  7. If an ICT provider we use is designated critical under DORA, then what changes for us?
  8. If an internal audit, an incident or a complaint shows a nonconformity, then how do we correct it and stop it coming back?
  9. If we are not sure whether we must register with our NIS2 authority, then what do we do?
  10. If a customer that is a financial entity asks us to accept DORA contract terms, then what do we do?
  11. If OCR asks for our HIPAA documents, then what should we have ready?
  12. A customer asks for SOC 2 and we hold ISO 27001: what do we send?
  13. If our SOC 2 examination finds an exception, then how do we respond?

Other categories