Checks
-
Document mergeAcceptable Use Policy and Remote Working and Mobile Devices Policy should be one document: Both Policies set the rules for company and personal devices and for the accounts on them, and they cover the same Requirement on user endpoint devices, so a reader has to check two documents for one answer.Recommended survivor: POL-002 — Acceptable Use PolicyKeep Acceptable Use Policy. Combine the documents, move the links, and archive the other through the Assistant write tools.
-
Document splitInternal Audit and Management Review Procedure should be two documents: Part A plans and runs the internal audits and Part B prepares and holds the management review. They have different owners, different timing, and different records, so each reads better as a Procedure of its own.
- Internal Audit Procedure — Planning, independence, and carrying out the internal audits, and the records of each audit.
- Management Review Procedure — Preparing and holding the management review, and the decisions that come out of it.
Create "Internal Audit Procedure" and "Management Review Procedure". Create the second document, move the right links, and edit both bodies through the Assistant write tools. -
Policy coverage adequacyPhysical and Environmental Security Policy words do not speak to one or more linked Requirements.
- iso-27001-2022 A.7.12 — The Policy covers security zones, office and data centre access, and environmental threats, but it does not speak of cabling, which is what this Requirement is about.
iso-27001-2022 A.7.12: The Policy covers security zones, office and data centre access, and environmental threats, but it does not speak of cabling, which is what this Requirement is about. Edit the Policy words and/or change the Requirement coverage links so the document speaks to each listed Requirement. -
Procedure implementation adequacyPhysical Access and Visitor Management Procedure words do not speak to one or more Policies it implements.
- POL-014 — Remote Working and Mobile Devices Policy — The Procedure covers visitors, badges, the Restricted zone, and data centre visits, but it does not speak of remote working, which is what this Policy is about.
Remote Working and Mobile Devices Policy: The Procedure covers visitors, badges, the Restricted zone, and data centre visits, but it does not speak of remote working, which is what this Policy is about. Edit the Procedure words and/or change which Policies it implements so the document speaks to each listed Policy. -
Uncovered RiskA sub-processor changes without notice to customers has no Requirement coverage.Link eu-gdpr-2016 Art. 28: The processor agreements are where customers agreed to the list of sub-processors and to notice of a change, so a sub-processor that changes without notice breaches exactly what this article asks the agreements to hold. Link iso-27001-2022 A.5.22: This is the control for following changes in a supplier's service between reviews, which is the gap that lets a sub-processor move processing without Tidewell IT noticing.
-
Uncovered RiskUnmanaged devices on the office network has no Requirement coverage.Link iso-27001-2022 A.8.1: Personal devices that visitors, contractors, and staff plug into the network of the Utrecht office are user endpoint devices, and the device management Tidewell IT already runs for its own laptops and mobile devices is the control that would cover them.