+DER.3.1.A5 Integration into the Information Security Process (S)

DER.3.1.A5 Integration into the Information Security Process (S)

An organisation SHOULD provide a policy for internal ISMS auditing. It SHOULD also establish a policy on the management of corrective action. These policies SHOULD specify that regular audits and revisions are part of the security process and initiated by said process.

Furthermore, the CISO SHOULD ensure that the results of audits and revisions are returned to the ISMS and incorporated into its improvement. The CISO SHOULD include the audits and revisions carried out and their results in their regular report to the organisation's Top Management. This SHOULD also detail the deficiencies eliminated and the quality improvements made.

1. Vue d’ensemble

1.1 Références

1.2 Exigences identifiées

1.3 Réglementations associées

2. Exigences identifiées

Exigences

3. Réglementations associées

Réglementations

Tickets liés

Liens
blocks G 0.18 Poor Planning or Lack of Adaptation
blocks G 0.19 Disclosure of Sensitive Information
blocks G 0.46 Loss of Integrity of Sensitive Information