Independent thinking. Informed defence.

CISO Times

Intelligence for the people behind the defence.

The CISO Decision Brief

Regulation, audit and certification

Scoping, preparing for and passing audits, and working out where ISO 27001, NIS2, DORA and GDPR overlap.

The packs behind these answers

How do we…

Methods: how a thing is done well.

  1. How do we set the scope of our ISMS?
  2. How do we justify excluding an Annex A control?
  3. How do we prepare our people for auditor interviews?
  4. How do we run an internal audit when we are small?
  5. How do we run a management review that actually decides things?
  6. How do we find the minimum control set when DORA, NIS2 and ISO 27001 all apply to us?
  7. How do we show that our management body has approved and oversees our NIS2 measures?
  8. How do we get ready for a NIS2 supervisor's request for evidence?
  9. How do we plan cybersecurity training for our management body?
  10. How do we build and keep our register of information on ICT third-party arrangements?
  11. How do we show our management body has approved and oversees our ICT risk management framework?
  12. How do we get ready for a supervisor's request for DORA evidence?
  13. How do we leave an ICT provider that supports a critical or important function without stopping the service?

When do we…

Triggers and timing: when something has to happen.

  1. When are we ready for the Stage 1 audit?
  2. When will certification realistically happen, and what will it cost?
  3. When is a NIS2 readiness gap blocking, and who must hear about it?
  4. When does DORA require threat-led penetration testing, and how do we plan the other tests?
  5. When is a DORA readiness gap blocking, and who must hear about it?

Is it…

Judgements with a yes or no at their centre.

  1. Is our organisation in scope of NIS2, and as essential or important?
  2. Is our organisation a financial entity under DORA, and which duties follow?
  3. Do we qualify for the simplified ICT risk management framework or the microenterprise relief?
  4. Does our ISO 27001 certificate satisfy DORA's ICT risk management framework?

If…, then how…

Situations: something has happened, what now.

  1. If the auditor raises a major nonconformity, then what?
  2. If we are halfway through implementation and behind plan, then do we move the audit date?
  3. If we are not sure whether we must register with our NIS2 authority, then what do we do?
  4. If a customer that is a financial entity asks us to accept DORA contract terms, then what do we do?

Other categories