4 ms·
Can you explain this? I thought ISO 27002 was implementation guidance for ISO 27001. No mandatory requirements even the Annex A controls themselves aren’t manda
by beermonster 5y ago
Can you explain this? I thought ISO 27002 was implementation guidance for ISO 27001. No mandatory requirements even the Annex A controls themselves aren’t mandatory.
- mac-chaffee 5y agoGood point. At the company where I work, we have an ISO compliance team that converts that guidance into mandatory requirements. So the authority is coming from company policies rather than ISO itself.
- gabereiser 5y agoCorrect. Most companies won’t interpret and just mandate the guidance recommendations.