ISO 27001:2013 Clause 7 Support

Intro

Clause 7 concerns itself with resources. This applies to people, infrastructure, and the environment as much as physical resources, materials, tools, etc. This Clause is all about getting the right resources, the right people, and the right infrastructure in place to establish, implement, maintain and continually improve the ISMS. It deals with requirements for competence, Education and Trainning courses in cybersecurity awareness, and communications to support the ISMS and it could include making training and personnel available, for example. This clause also requires all personnel working under an organization’s control to be aware of the information security policy, how they contribute to its effectiveness, and the implications of not conforming. The organization also needs to ensure that internal and external communications relevant to information security and the ISMS are appropriately communicated. This includes identifying what needs to be communicated to whom, when, and how this is delivered.
It’s in this clause that the term “documented information” is referenced. Organizations need to determine the level of documented information that’s necessary to control the ISMS. There is also an emphasis on controlling access to documented information, which reflects the importance of information security. There is also a renewed focus on knowledge as a significant resource within your organization. When planning your quality objectives, a major consideration will be the current capacity and capability of your resources as well as those you may need to source from external suppliers/partners. This clause of the standard provides the requirements supporting the establishment and operations of an ISMS. Included in Clause 7 are:
7.1 Resources required to establish and operate an ISMS
7.2 Competence
7.3 Awareness ( Information Security Awareness )

7.4 Communication
7.5 Documented Information

Abstract

Clause 7 of ISO 27001 is all about getting the right resources, the right people, and the right infrastructure in place to establish, implement, maintain and continually improve the ISMS.

ISO 27001:2013 Clause 7 Support

Clause 7 Support, 7.2 Competence

7.2 Competence

The organization must determine the necessary competence of all people doing work under its control that affects its information security performance. It must also ensure that these people are competent on the basis of appropriate education, training, or experience. Where applicable, it must take actions to acquire the necessary competence, and evaluate the effectiveness of the actions taken; and must retain appropriate documented information as evidence of competence. Applicable actions may include, for example, the provision of training to, the mentoring of, or the reassignment of current employees; or the hiring or contracting of competent persons.

ISO 27001 clause 7.2 basically says that the organization will ensure that it has :

determined the competence of the people doing the work on the ISMS that could affect its performance
people that are deemed competent on the basis of the relevant education, training or experience
where required, take action to acquire the necessary competence and evaluated the effectiveness of the actions
retained evidence of the above for audit purposes

Clause 7.2 requires all persons to be competent in their roles within the ISMS. Competency comes about through the provision of training, education, experience, and skills. These are all to be considered in the management of human resources. To implement and maintain an effective ISMS you need to have supporting resources in place. These resources will need to be sufficient:

capable – if they are equipment or infrastructure; and
competent – if they are people.
at Management Review meetings.

There is a logical sequence that is reflected within this clause of the standard when addressing competency:

Determine the necessary competency requirements
Provide training or other actions to fill any gaps, considering past qualifications and experience. This may include recruiting.
Evaluate the effectiveness of the training or actions
Maintain records of education, training, skills, and experience, etc.

The need for people to be aware of their ISMS responsibilities is contained within Clause. The implementation of effective information security controls relies heavily on the knowledge and skills of your employees, suppliers, and contractors. To be certain of an appropriate knowledge and skills base you need to:

define what knowledge and skills are required;
determine who needs to have the knowledge and skills; and
set out how you can assess or verify that the right people have the right knowledge and skills.

A whole bunch of skills and experiences required for successful implementation and ongoing management of an ISMS that is certified to ISO 27001, beyond expertise in physical security, cybersecurity, computer security, or other forms of information security per se. Those include commercial, legal, HR, IT, as well as the relevant products & services expertise for the work in scope. Building and running an ISMS is usually a collaborative team job. Your auditor will expect you to have documents detailing your knowledge and skills requirements. Where you believe the requirements are satisfied this will need to be supported with records such as training certificates, course attendance records, or internal competency assessments. Most organizations that already use tools such as training/skills matrices, appraisals, or supplier assessments can satisfy the requirement for competence records by expanding the areas covered to include information security.

TRAINING

The ISMS requires that all personnel are competent in terms of their role within the ISMS. Any competency gaps that have been identiﬁed need to be addressed. However, there is some speciﬁc ISMS-focussed training for some target user groups. Some of these groups and the type of training that may be required are listed in the following table.

The training plan should consider the following:

Information Security Awareness
user awareness training
briefings for the Governance Forum
Education and Trainning courses in cybersecurity
targeted training for key “control owner” groups
- Network support
- Server support
- Service desk (user support. incident response)
- Human resources
briefings for key executives and line management

When developing any training plan consideration must be given to the following:

who the target audience is?
what messages do they need?
how will the message/training be delivered? Face-to-face, online, PowerPoint, team brieﬁngs?
when the training will occur and how often it needs to happen?
who will be responsible for organizing the training, updating the content, and delivering the material?
Are assessments or effectiveness metrics required? Quizzes? Surveys?

This type of information can be captured through a “training needs analysis” exercise. Once this type of information is captured, a training program can be developed.

The training plan should cover:

who the target audience is
what messages they need
how the message/training will be delivered
when the training will occur
how often the training needs to happen
who will be responsible for organizing/delivering
Whether any assessment mechanisms are required
If so. what would that look like?

Abstract

The organization must determine the necessary competence of all people doing work under its control that affects its information security performance.

ISO 27001:2013 Clause 7 Support

Clause 7 Support, 7.3 Awareness

7.3 Awareness

People doing work under the organization’s control shall be aware of the information security policy, their contribution to the effectiveness of the information security management system, including the benefits of improved information security performance; and the implications of not conforming with the information security management system requirements.

Clause 7.3 of ISO 27001 combines with clause 7.2 competence and 7.4 communication about the information security management system to all the relevant interested parties. Awareness is closely related to competence in the standard. People who work under the organization’s control must be made aware of the information security policy and its contents, what their personal performance means to the ISMS and its objectives, and what the implications of nonconformities may be to the ISMS. ISO 27001 is seeking confirmation that the people doing the work are aware of:

the information security policy
Information Security Awareness
their contribution to the effectiveness of the ISMS including benefits from its improved performance
what happens when the information security management system does not conform to its requirements

This generally will drive some level of training and awareness sessions targeting different audience groups. Awareness of non-conformance to the requirements of the ISMS must also be addressed. In addition to ensuring the specific competence of key personnel in relation to information security, the wider group of employees, suppliers, and contractors will need to be aware of the basic elements of your ISMS. As part of the implementation of the ISMS, the people within the organization must participate in the creation of the information security policy for top management to approve. They would have a good understanding of their role because it would have been agreed and documented as part of clause 7.1. This is central to establishing a supportive culture within the organization. All staff, suppliers, and contractors should be aware of the following:

That you have an ISMS and why you have one.
That you have an Information Security Policy and which particular elements of it are relevant to them.
How they can contribute to your organization protecting its valuable information and what they need to do to help the organization achieve its information security objectives.
Which policies, procedures, and controls are relevant to them and what the consequences are of not complying with them.
Awareness and understanding for 6.1 risk management, 6.2 ISMS objectives and 9.1 broader measurement & evaluation, 9.2 internal audits, 9.3 management reviews, 10.1 non-conformities, and corrective actions, as well as continual improvements in line with 10.2.

The communication of this information can normally be done through existing processes and documents such as inductions, employment contracts, toolbox talks, supplier agreements, employee briefings or updates.

Abstract

Awareness is closely related to competence in the standard. People who work under the organization’s control must be made aware of the information security policy and its contents, what their personal performance means to the ISMS and its objectives, and what the implications of nonconformities may be to the ISMS.

Security Awareness training

Hvordan unngå løsepengevirus

Lammende løsepengevirus, ødeleggende verdikjedeangrep, altfor vanlige kontokapringer og utspekulert økonomisk svindel. Slik beskytter du din virksomhet mot de vanligste digitale truslene.

Alle norske virksomheter må være forberedt på å håndtere. Rapporten beskriver hva disse truslene innebærer og hvordan de kan treffe virksomheten din. For å vite hvordan du og virksomheten best mulig kan beskytte dere mot disse truslene har NorSIS sjekklister for hva som bør gjennomgås eller være på plass i enhver virksomhet. Under finner du disse sjekklistene. Dersom det er noen av punktene i sjekklistene under du ikke forstår eller kan utføre selv, sjekk med din driftsleverandør.

Løsepengevirus

Med et par klikk og en nedlasting av et ukjent vedlegg i en e-post, en Facebook-post eller en SMS, kan hele virksomhetens IT-system bli lammet og kryptert. Løsepengevirus er en av de største digitale truslene mot norske virksomheter.

Sjekkliste for å unngå løsepengevirus

Har du sørget for:

at alle ansatte har fått opplæring i hva de bør tenke over/sjekke ut før de sier ja til å laste ned og installere programmer på maskinen?
å skille mellom hvilke ansatte som har administrasjonsrettigheter, brukerrettigheter og eventuelle andre rettigheter i systemene ut fra hvilket behov de har i sin jobb?
at det jevnlig tas sikkerhetskopier av alle viktige filer?
at sikkerhetskopien er offline eller på et annet nettverk enn det den sikkerhetskopierer?
at all nødvendig segmentering av nettverk er gjort? Dersom du lurer på om dette gjelder din virksomhet, spør driftsleverandøren din.
at alle virksomhetens datamaskiner, operativsystem og programvare til enhver tid er oppdatert?
at alle virksomhetens datamaskiner har og bruker oppdatert antivirusprogram?
at du og dine ansatte ikke har andre disker og enheter koblet til datamaskinen til enhver tid? Det vil hindre spredning av løsepengevirus til alle.
at du og dine ansatte ikke er tilkoblet skytjenester hele tiden? Løsepengevirus kan også spre seg til disse når du er logget på.
at du har en plan for hva du og dine ansatte skal gjøre dersom dere rammes av et løsepengevirus, og at alle ansatte kjenner til denne planen – for eksempel å trekke ut nettverkskablene og koble fra datamaskinene umiddelbart?
at dere tilbyr og bruker totrinnspålogging på alle kontoer?

Kontokapring

Bruker du eller noen andre i din virksomhet enkle passord for å logge inn på jobbtjenester? Da kan kriminelle lettere ta over en e-postkonto eller andre kontoer i virksomheten og utgi seg for å være en ansatt, stjele informasjon eller plante ondsinnet programvare.

Sjekkliste for å unngå kontokapring

Har du sørget for:

at alle virksomhetens systemer settes opp med totrinnspålogging som standard?
at alle ansatte bruker totrinnspålogging på alle sine innlogginger i alle systemer?
at alle brukere av systemet sikrer sin tilgang med et sterkt og unikt passord dersom det ikke er mulig å bruke totrinnspålogging i et system?
at det er stilt krav til nye leverandører/systemtilbydere eller andre om at innlogging må beskyttes med totrinnspålogging?
at alle vet at de må gi beskjed dersom de har lagt igjen brukernavn og passord et sted de er usikre på, for eksempel via en lenke?
at dere har rutiner for gjenoppretting av passord, det vil si at alle vet hvem de skal kontakte for å få et nytt passord og hvor de får passordet sendt?

Verdikjedeangrep

Din virksomhet kan rammes av et angrep på en av dine kunder, leverandører eller samarbeidspartnere. Eller du blir angrepet som et ledd i et angrep på en av dine samarbeidspartnere. Det kan få enorme konsekvenser for virksomhetens omdømme. Ifølge NSM er det sannsynlig at angrep på leverandørkjeder vil øke i Norge.

Sjekkliste for å unngå verdikjedeangrep

Har du sørget for:

at alle enheter, inkludert kaffetraktere og varmeovner som er koblet opp mot nett, er sikret med et godt brukernavn og passord, ikke standardpassordet som fulgte med?
at alle samarbeidspartnere, kunder og leverandører som har tilgang til dine datasystemer har gode rutiner for IT-sikkerhet?
å ha oversikt over dine verdier, verdikjeder og sårbarheter?
at dere har rutiner for å avinstallere programvare som ikke brukes? • at alle enheter er sikkerhetsoppdatert?
at dere har sørget for logging og monitorering av systemene, slik at uregelmessigheter kan oppdages?
at de ansatte har dedikert utstyr å jobbe på?

Svindel

Nettsvindel er fortsatt en stor trussel for små og mellomstore bedrifter. Dette er en type angrep der lav innsats kan gi angriperne stor uttelling. Det kan dreie seg om alt fra phishing og direktørsvindel, falske nettbutikker og falske nettprofiler til falske fakturaer.

Sjekkliste for å unngå å gå på phishing-forsøk

Har du sørget for:

at dere har en kultur der alle ansatte tør å si ifra hvis de gjør noe galt, og at du er et godt eksempel på dette ved å rose de som sier ifra om feil?
at dere har gode rutiner for at ingen betaler med kredittkort eller gir fra seg kredittkortinformasjon på steder der virksomheten ikke har en profil eller innlogging?
at virksomheten ikke tillater at noen kjører kode eller installerer programmer fra en lenke eller et vedlegg de har fått tilsendt?

Sjekkliste for å unngå direktør- og fakturasvindel:

Har du sørget for:

at henvendelser der det anmodes om pengeoverføringer alltid dobbeltsjekkes? Kommer den på e-post, les den to ganger og kontakt den som ber om overføringen på telefon, det vil si i en annen kanal enn den dere mottok henvendelsen gjennom, for å få bekreftet at den er ekte.
at dere har en rutine for at ledelsen informerer sine økonomimedarbeidere på forhånd dersom de vet at det kan bli aktuelt med eller behov for kjappe overføringer?
at rutinene for pengeoverføringer er risikovurdert, det vil si at dere blant annet har gjort en grundig gjennomgang av om rutinene kan «stå imot» et svindelforsøk eller muligheter for menneskelige feil?
at dere alltid dobbeltsjekker med leverandøren når dere har mottatt meldinger om endring av kontonummer? Her er det viktig å sjekke via en annen kanal enn der dere fikk henvendelsen om endringen. Dere må for eksempel ikke bruke telefonnummeret som står i e-posten dere mottok om kontonummerskifte.
å sikre e-postkontoene med totrinnspålogging for å unngå kontoovertagelse?

Sjekkliste for å oppdage og håndtere falske nettsider, profiler eller annet i din virksomhets navn:

Har du sørget for:

å ha oversikt over hvor virksomhetens navn blir nevnt, for eksempel et Google Alerts-søk som vil gi deg beskjed når det publiseres noe som inneholder navnet på virksomheten din?
å ta alle henvendelser fra kunder om dårlig behandling på alvor og sjekke ut hvor de faktisk stammer fra? Det kan stamme fra en falsk profil, nettsted eller lignende.
å ha rutiner for å si ifra til kunder og andre brukere, for eksempel på nettsiden deres og i sosiale medier, dersom noen har laget en falsk nettside, konkurranse eller profil og utgir seg for å være virksomheten din?

Our focus is on clause 7. Support in (ISO 27001) standard.

ISO 27001:2013 Clause 7 Support

Intro

Abstract

ISO 27001:2013 Clause 7 Support

Clause 7 Support, 7.2 Competence

7.2 Competence

Abstract

ISO 27001:2013 Clause 7 Support

Clause 7 Support, 7.3 Awareness

7.3 Awareness

Abstract

Security Awareness training

Hvordan unngå løsepengevirus

Løsepengevirus

Sjekkliste for å unngå løsepengevirus

Kontokapring

Sjekkliste for å unngå kontokapring

Verdikjedeangrep

Sjekkliste for å unngå verdikjedeangrep

Svindel

Sjekkliste for å unngå å gå på phishing-forsøk

Sjekkliste for å unngå direktør- og fakturasvindel:

Sjekkliste for å oppdage og håndtere falske nettsider, profiler eller annet i din virksomhets navn:

We use cookies to make your experience of our websites better.