Part 25 - Clause A6 Organisation of information security
This clause, A6, of the ISO 27001 standard is there to provide some background and management framework guidance.
It is a little bit "hodgepodge" of requirements. Plus the requirements don’t seem to match with one another but there you go.
It covers such disparate requirements like: responsibilities, segregating duties, dealing with authorities, special interest groups, project management, mobile devices and teleworking.
In any case the clause is split into two sub-clauses.
A6.1 Internal Organisation
The clause A6.1 covers off the internal organisation requirements.
It starts with responsibilities. As with any management system, being really clear about everyone’s roles, responsibilities and authorities is a key for having a successful system. I have written about roles, responsibilities and authorities previously, click here for more details.
Next up, and similar to being clear with responsibilities, is segregation of duties. The standard spells it out that segregation helps “reduce opportunities for unauthorised or unintentional modification or misuse of the organisation’s assets”. So make sure that your system has segregated duties effectively.
Then follows that you need to be in contact with authorities and local special interest groups. For Mango, we have a direct link with CERTNZ, the local cyber-security Government Agency here in New Zealand. Plus we are part of the local Tech Society to keep ourselves abreast of the latest tech news and developments.
Then there is the requirement that information security shall be address in project management. This is good practise anyway. Here at Mango we have information security at each stage of our development, implementation and support stages.
A6.2 Mobile devices and teleworking
The increasing use of mobile devices in business can be a reasonably significant risk to business. As more and more application are moving to mobile, keeping the information secure is an on-going problem. A few things we did here at Mango were:
- Increase the strength of passwords
- Move to 2-factor authentication
- Regularly update the apps
- Check the app privacy
For tele-working staff here at Mango we reviewed and updated our policies and procedures for keeping them secure and well protected.
- Be clear with roles, responsibilities and authorities
- Make sure duties of staff are well segregated
- Keep in constant contact with authorities and special interest groups
- Ensure information security is covered off in project management
- Put some strong controls in place for Mobile Devices and Tele-workers.
View previous blogs in this series "ISO 27001 Information Security Management Standard":