The ISO 27001 Episode

KirkpatrickPrice is on a mission to help 10,000 people elevate the standards for cybersecurity and compliance. Join Our Cybersecurity Mission: https://www.linkedin.com/showcase/107184577/admin/dashboard/

ISO 27001 – Information Security Management Systems: https://www.iso.org/standard/27001
What's new in the 2022 version: https://kirkpatrickprice.com/blog/web...

Annex A Control 5.35 – Independent Review 
You have to conduct an independent review of your ISMS, which could be an external party or an operationally-independent internal resource. 

ISO 27001 Certification Bodies 

·       British Standards Institute (BSI)

·       Mastermind Assurance

·       Performance Review Institute (PRI)

Stage 1 Audit Report  
Minor nonconformities  
These are not seen as serious. You must develop, follow, and complete your own internal Corrective Action Plan (CAP) before Stage 2. You are not required to send your CAP for minor nonconformities at Stage 1. 

Major nonconformities  
You need to produce a CAP for the certifying body with all actions completed before Stage 2. You need to submit your CAP before scheduling Stage 2. Send your CAP to your auditor.  
 
Stage 2 Audit Report  
Minor nonconformities  
A written Corrective Action Plan (CAP) must be sent to your certification body. A certification decision is made. The CAP will be reviewed by your Client Manager and details the nonconformity, the cause, the proposed corrective action, who is responsible and the date the action will be implemented; you will have five working days to do this.

Major nonconformities  
If a major nonconformity is raised or remains outstanding from Stage 1, an additional visit will need to be booked; this is to confirm the implementation of an effective CAP. This additional visit will take place within 30 days; however, you may request to have the visit earlier. Major nonconformities must be addressed within six months of the assessment and prior to the issuance of the certificate. Send your CAP to your Client Manager.

Opportunities for Improvement  
When conducting an audit, your Client Manager may encounter a situation that doesn’t qualify as a nonconformity, but could improve your system. These Opportunities for Improvement (OFI) are revealed during the audit process and include any suggestions for improvement, as well as any findings that could lead to potential nonconformities. While it’s not required to include OFIs in your CAP, your Client Manager will include them in your auditing report to encourage continual improvement. 

KirkpatrickPrice is on a mission to help 10,000 people elevate the standards for cybersecurity and compliance. Join Our Cybersecurity Mission: https://www.linkedin.com/showcase/our-cybersecurity-mission