Everand Logo

Welcome to Everand!

  • Discover millions of ebooks, audiobooks, and so much more with a free trial

    Only $11.99/month after trial. Cancel anytime.

    ISO 27001 Risk Management in Plain English: A Step-by-Step Handbook for Information Security Practitioners in Small Businesses
    ISO 27001 Risk Management in Plain English: A Step-by-Step Handbook for Information Security Practitioners in Small Businesses
    ISO 27001 Risk Management in Plain English: A Step-by-Step Handbook for Information Security Practitioners in Small Businesses
    Ebook69 pages49 minutes

    ISO 27001 Risk Management in Plain English: A Step-by-Step Handbook for Information Security Practitioners in Small Businesses

    By Dejan Kosutic

    4/5

    ()

    Read preview

    About this ebook

    “Risk management is the central idea of ISO 27001. And, the way ISO 27001 tells you to achieve this tailor-made suit is to perform risk assessment and risk treatment.” This book, ISO 27001 Risk Management in Plain English, is a quick read for people who are focused solely on risk management. It has one aim in mind: to give you the knowledge and practical step-by-step process you need to successfully implement ISO 27001 risk assessment and treatment – without struggle, stress, or headaches.


    ISO 27001 Risk Management in Plain English is written primarily for beginners in this field and for people with moderate knowledge about risk assessment and treatment. It is structured in such a way that someone with no prior experience or knowledge about information security can quickly understand what it is all about, and how to implement the whole risk management project. However, if you do have experience with ISO 27001, but feel that you still have gaps in your knowledge, you’ll also find this book very helpful.


    This book will give you a complete overview of risk management according to ISO 27001. It will also explain the differences between risk management in ISO 27001 and other risk-oriented standards, such as ISO 27005 and ISO 31000. You will learn the five main steps in the risk management process, the purpose of risk assessment, and how to perform it.


    “In my experience, the employees (and the organization as a whole) are usually aware of only 25 to 40% of risks,” says author Dejan Kosutic. “Therefore, a thorough and systematic process needs to be carried out to find out everything that could endanger the confidentiality, integrity, and availability of their information.”


    This book will serve as your complete guide to ISO 27001 risk management. From the simple explanation of requirements, steps in risk management, development of methodology, and which documents are required for risk management – you will quickly see that this is the only book you’ll ever need on the subject.

    LanguageEnglish
    PublisherAdvisera Expert Solutions Ltd
    Release dateSep 15, 2017
    ISBN9789535745280
    ISO 27001 Risk Management in Plain English: A Step-by-Step Handbook for Information Security Practitioners in Small Businesses

    Read more from Dejan Kosutic

    Related to ISO 27001 Risk Management in Plain English

    Titles in the series (6)

    View More
    View More

    Related ebooks

    Security For You

    View More
    View More

    Related podcast episodes

    Related articles

    • Article

      Vulnerability Assessments

      Jan 7, 2021

      Vulnerability Assessments
      3 min read

    • Article

      Cyber Security IS A SHARED RESPONSIBILITY AT THE C-LEVEL

      Sep 21, 2016

      Data breaches can have far-reaching repercussions; protecting against them is a companywide mandate

      2 min read

    • Article

      Tactical Appreciation

      Aug 15, 2018

      Tactical Appreciation
      5 min read

    • Article

      Take Back Control

      May 22, 2018

      Take Back Control
      11 min read

    • Article

      Approaching Risk from The Boardroom

      Dec 2, 2022

      Looking into risk from the perspective of the boardroom demands a note on the concept of corporate governance itself and the resulting implications. Shareholders are the principals and need to have their rights protected; management is nominated and

      7 min read

    • Article

      Getting It Done

      Sep 1, 2020

      You developed the GettingItDone® management system and have been teaching it to Rotman MBA students for 19 years. What are its key principles? The system applies the thinking of three well known management gurus. The first is the late-great Peter F.

      5 min read

    • Article

      What’s Next? Using The Coronavirus Crisis To Assess Your Business And Come Back Stronger

      Jul 6, 2020

      Many businesses are currently grappling with the impact that Covid-19 is having on their day-to-day life. It is a worrying time as businesses adjust to sudden changes in demands from consumers, and potentially having to literally stop trading. If you

      3 min read

    • Article

      Data Security Standards

      Aug 24, 2021

      A lot of engineers like to rail against standards as pointless box-checking and in some cases they are. Especially when it comes to things like PCI-DSS. Fundamentally, any engineer can look at PCI-DSS and say honestly that it’s obvious, and that all

      1 min read

    • Article

      Feature

      May 22, 2022

      Feature
      4 min read

    • Article

      Pro-actions

      Jun 16, 2021

      https://pro-actions.com/ All businesses are like complicated ecosystems – lots of aspects have to be actioned together and efficiently to enable a successful business to work. A business tends only to be as strong as its weakest link. Pro-actions wor

      2 min read

    • Article

      AGILE: It Is All About Trust

      Oct 22, 2019

      AGILE: It Is All About Trust
      6 min read

    • Article

      Expert Contributors

      Aug 9, 2017

      BOB HERBOLD is the former Chief Operating Officer of Microsoft Corporation and the author of three books on leadership. His latest, What’s Holding You Back: 10 Bold Steps that Define Gutsy Leaders was released in 2011 by Wiley/Jossey-Bass. More on th

      2 min read

    • Article

      Can You Teach Leadership?

      Dec 2, 2022

      Can You Teach Leadership?
      9 min read

    • Article

      Utilising Technology For Sales Effectiveness

      Jul 20, 2022

      SALES & MARKETING LOGAN WEDGWOOD (MBA, MINSTD.) IS CEO OF STRATEGY EXECUTION ADVISORY FIRM, ADVISORY WORKS. WWW.ADVISORY.WORKS Why is it that some salespeople seemingly have all the natural capability they could ask for, but lack the performance to b

      2 min read

    • Article

      Running Beyond Empty

      Apr 20, 2022

      Running Beyond Empty
      6 min read

    • Article

      Mental Health Initiative For Business Owners

      Jul 18, 2023

      The recently launched Brave in Business e-learning series is a I new tool to help small business owner-operators to manage and improve their mental wellbeing. Made in partnership with MBIE, Spark Business Lab and The Institute of Organisational Psych

      1 min read

    • Article

      Myob

      Jun 6, 2018

      Do your eyes glaze over at the above acronym? Are you someone for whom the details of tax/P&L/balance sheets and their ilk are necessary evils, and merely the tedious tasks through which you must trudge in order to get on with what you really love to

      1 min read

    • Article

      A Focus on ESG

      Oct 19, 2021

      A Focus on ESG
      2 min read

    • Article

      A Scorecard for Your Financial Adviser

      Apr 24, 2019

      Sometimes it can be difficult to fully grasp the value of a financial adviser. Do they mostly manage my money? Are they doing a good job for me? How would I even know? These are important questions that can often be difficult to answer. There ar

      2 min read

    Related categories

    Reviews for ISO 27001 Risk Management in Plain English

    4/5

    8 ratings2 reviews

    What did you think?

    Tap to rate

    Review must be at least 10 words

    • 4/5
      The author broke down the process of implementing ISO 27001 in a manner that is quite easy to understand. Well written.
    • 4/5
      The given guide and examples of risk guidance much practical.

    Book preview

    ISO 27001 Risk Management in Plain English - Dejan Kosutic

    ISO 27001

    Risk Management in Plain English

    Also by Dejan Kosutic:

    Secure & Simple: A Small-Business Guide to Implementing ISO 27001 On Your Own

    9 Steps to Cybersecurity: The Manager’s Information Security Strategy Manual

    Becoming Resilient: The Definitive Guide to ISO 22301 Implementation

    Dejan Kosutic

    ISO 27001

    Risk Management in Plain English

    Step-by-step handbook for information security practitioners in small businesses

    Advisera Expert Solutions Ltd

    Zagreb, Croatia

    Copyright ©2016 by Dejan Kosutic

    All rights reserved. No part of this book may be reproduced, stored in a retrieval system or transmitted in any form or by any means, electronic, mechanical, photocopying, recording or otherwise, without written permission from the author, except for the inclusion of brief quotations in a review.

    Limit of Liability / Disclaimer of Warranty: While the publisher and author have used their best efforts in preparing this book, they make no representation or warranties with respect to the accuracy or completeness of the contents of this book and specifically disclaim any implied warranties of merchantability or fitness for a particular purpose. This book does not contain all information available on the subject. This book has not been created to be specific to any individual’s or organization’s situation or needs. You should consult with a professional where appropriate. The author and publisher shall have no liability or responsibility to any person or entity regarding any loss or damage incurred, or alleged to have been incurred, directly or indirectly, by the information contained in this book.

    First published by Advisera Expert Solutions Ltd

    Zavizanska 12, 10000 Zagreb

    Croatia

    European Union

    http://advisera.com/

    ISBN: 978-953-57452-8-0

    First Edition, 2016

    ABOUT THE AUTHOR

    Dejan Kosutic is the author of numerous articles, video tutorials, documentation templates, webinars, and courses about information security and business continuity management. He is the author of the leading ISO 27001 & ISO 22301 Blog, and has helped various organizations including financial institutions, government agencies, and IT companies implement information security management according to these standards.

    Click here to see his LinkedIn profile

    TABLE OF CONTENTS

    ABOUT THE AUTHOR

    PREFACE

    1 INTRODUCTION

    1.1.WHO SHOULD READ THIS BOOK?

    1.2 HOW TO READ THIS BOOK?

    1.3 WHAT THIS BOOK IS NOT

    1.4 WHY IS RISK MANAGEMENT THE CENTRAL PHILOSOPHY IN ISO 27001?

    1.5 RELATIONSHIP BETWEEN ENTERPRISE RISK MANAGEMENT AND INFORMATION SECURITY MANAGEMENT

    1.6 ISO 27001 VS. ISO 27005 VS. ISO 31000

    1.7 ADDITIONAL RESOURCES

    2 STEPS IN THE RISK MANAGEMENT

    2.1 ADDRESSING RISKS AND OPPORTUNITIES (CLAUSE 6.1.1)

    2.2 FIVE STEPS IN THE RISK MANAGEMENT PROCESS (CLAUSE 6.1)

    2.3 WRITING THE RISK ASSESSMENT METHODOLOGY (CLAUSE 6.1.2)

    2.4 RISK ASSESSMENT PART I: IDENTIFYING THE RISKS (CLAUSES 6.1.2 AND 8.2)

    2.5 RISK ASSESSMENT PART II: ANALYZING AND EVALUATING THE RISKS (CLAUSES 6.1.2 AND 8.2)

    2.6 PERFORMING RISK TREATMENT (CLAUSES 6.1.3 AND 8.3)

    2.7 STATEMENT OF APPLICABILITY: THE CENTRAL DOCUMENT OF THE WHOLE ISMS (CLAUSE 6.1.3 D)

    2.8 DEVELOPING THE RISK TREATMENT PLAN (CLAUSES 6.1.3, 6.2, AND 8.3)

    2.9 REGULAR REVIEW OF THE RISK ASSESSMENT AND TREATMENT (CLAUSE 8.2)

    2.10 SUCCESS FACTORS

    3 MINI CASE STUDY: PERFORMING RISK ASSESSMENT IN A SMALL HOSPITAL

    APENDIX - CATALOG OF THREATS AND

    VULNERABILITIES

    BIBLIOGRAPHY

    LIST OF FIGURES

    Figure 1: Relationship between enterprise risk management, information security, business continuity, IT, and cybersecurity

    Figure 2: Five steps in the risk management process

    Figure 3: Example of risk assessment table with identified risks

    Figure 4: Example of full risk assessment table

    Figure 5: Example of risk treatment table

    Figure 6: Example of Statement of Applicability

    Figure 7:

    Enjoying the preview?
    Page 1 of 1