Cybersecurity ECS Educational ISMS ISO 27001 Security

Understanding ISO 27001:2022 Annex A.9 – Access Control

We started the ISO 27001:2022 series with the promise of explaining how the 14 categories of controls can be implemented. Today we address ISO 27001:2022 Annex A.9, “Access Control”. Access control is a fundamental component of information security management systems (ISMS). It provides guidelines for implementing controls to ensure that only authorized individuals have access to information […]

Cybersecurity ECS Educational ISO 27001

Understanding ISO 27001:2022 Annex A.7 – Human Resource Security

We started the ISO 27001:2022 series with the promise of explaining how the 14 categories of controls can be implemented. Today we address ISO 27001:2022 Annex A.7, “Human Resource Security”.     These controls address the critical role that personnel play in information security within an organization. This annex emphasizes the need for organizations to implement measures […]

Cybersecurity ECS Educational ISO 27001

Understanding ISO 27001:2022 Annex A.5 – Information Security Policies

We started the ISO 27001:2022 series with the promise of explaining how the 14 categories of controls can be implemented. We start today with A.5. Information Security Policies.     Importance of Information Security Policies Information security policies are crucial components of any organization’s cybersecurity framework. They provide guidelines and principles for safeguarding sensitive information, […]

Cybersecurity ECS Educational ISMS

The ISO 27000 family of protocols and their role in cybersecurity

The ISO 27000 family of protocols represent a series of standards developed by the International Organization for Standardization (ISO) to address various aspects of information security management. These standards provide a framework for organizations to establish, implement, maintain, and continually improve their information security management systems (ISMS). Each standard within the ISO 27000 family serves […]

Cybersecurity ECS Educational NIS2 Security

Demystifying cybersecurity terms: Policy, Standard, Procedure, Controls, Framework, Zero Trust

I am often asked what is the difference between Policy, Standard, Procedure in cybersecurity. Well, here it is: 1. Cybersecurity Standard A cybersecurity standard is a set of guidelines, criteria, or best practices that organizations follow to ensure that their security controls and procedures align with industry standards or regulatory requirements. Standards provide a benchmark […]

Automotive Cybersecurity ECS Educational NIS2

How to implement an Information Security Management System (ISMS)

We wrote here https://www.sorinmustaca.com/how-to-nis2-eu-directive/ that the 3rd  step in implementing the requirements of the directive is to establish a cybersecurity framework. If you haven’t read what a cybersecurity framework means, then you should read article: https://www.sorinmustaca.com/demystifying-cybersecurity-terms-policy-standard-procedure-controls-framework/ . An ISMS is typically based on the ISO 27001 standard, which provides a framework for establishing, implementing, maintaining, […]

ECS General Security

NIS2: 1. Perform a gap analysis

We wrote here https://www.sorinmustaca.com/how-to-nis2-eu-directive/ that the first step in implementing NIS2 requirements is to perform a gap analysis.   The most critical part when performing a gap analysis is to define upfront against which standard or security framework are you comparing the existing situation. It is usual when performing a gap analysis of security maturity […]

General

ISO27001 and GDPR

We are talking about Article 32 of GDPR: https://gdpr-info.eu/art-32-gdpr/ It basically says that you should have some measures in place in order to protect customer data by reducing the risk of a customer data to be lost or stolen(through a data breach, through classical theft, losing drives, making information public unintentionally an so on).   […]