ISO 27001

Introduction In the first post of this series, I introduced the Assume Breach principle. I also highlighted three areas that often need more attention: Business Continuity Planning, Data Loss Prevention and Cryptography. This post focuses on Business Continuity Planning (BCP). Many organisations have a continuity plan on paper. They may have a policy, a list of key systems and a recovery plan. But documents alone do not keep a business running. The plan must work during a real crisis. ...

Introduction In the past year, I have performed numerous internal audits. Across many of these audits, I observed a recurring pattern: three important security domains are often either limited in scope or insufficiently implemented: Business Continuity Planning Data Loss Prevention Cryptography In most cases, an initial effort has been made. However, the actual coverage, maturity and operational effectiveness of these implementations are often lacking. In my view, these controls do not always receive the level of attention and organisational weight they deserve. ...