GRC Lab is an educational platform that provides courses and resources aimed at enhancing skills in Governance, Risk & Compliance.

GRC Lab

GRC Lab offers resources and courses aimed at helping professionals enhance their careers in Governance, Risk and Compliance, self-described as an all-in-one hub.

GRC Lab | 8,248 followers on LinkedIn. The all-in-one hub to help you launch, grow and accelerate your career in Governance, Risk and Compliance. | Learn from expert courses, utilize resources, and join an engaging community—all designed to boost your career in GRC.

What does it take to achieve compliance with ISO 27001? The answer? - “It depends…” Please note, I am NOT a lawyer, but that is the definitive answer.” Here is why it depends: ISO 27001 demands two types of documented information: Mandatory ↳Documents explicitly required by the standard. Additional ↳ Documents deemed as necessary by the organization for the effectiveness of the ISMS. For instance: ⦿ The Scope of the ISMS is a mandatory document, explicitly required. ⦿ The Statement of Applicability (SoA) is a mandatory document, explicitly required. ⦿ The requirements of interested parties have to be considered, but they are not explicitly required in the form of documented information. ⦿ A security zone concept of your physical perimeters, highly advisable to have but not explicitly required. Does this confuse you? Me personally, it still does. But, together with my partner Kertos , we have been working on a list of deliverables for an ISMS to integrate them on to our GRC platform. The result: - 1x Policy - 19x Topic-specific policies - 27x Procedures - 78x Records If you need help with implementing an ISMS, talk to me.

Let's dive deeper into the distinction between ISO 27001 and ISO 27002, as there's often confusion around these two standards. 📕 ISO/IEC 27001 ↳ A management system standard that describes requirements for establishing, implementing, maintaining, and improving an Information Security Management System (ISMS). This standard helps organizations to understand their context, establish information security objectives, and develop a risk management approach. 📕 ISO/IEC 27002 ↳ An informative standard that provides guidance on implementing the controls listed in Annex A of ISO 27001. ISO/IEC 27002 doesn't mandate specific controls; rather, it offers best practices that can be adapted based on your organization's risk assessment. Here's the key point: ⦿ The guidance of ISO/IEC 27002 is not mandatory! ⦿ You are free to design and implement controls in other ways, which is advisable to do. More about ISO/IEC 27002 → Link in first comment

The true harm of promises like "become ISO 27001 certified in 2 weeks". In the past week, there were numerous threads on LinkedIn about how GRC platforms and their collaboration with audit firms, weaken the credibility of SOC2 attestations, and ISO 27001 certificates. Here is what I think. The rush to get “certified fast” is understandable But, this is a risky shortcut that can lead to a certification that’s hollow at best. ISO 27001 is not just a checklist—it’s a system that requires thoughtful implementation and ongoing maintenance to provide real value. For instance, the standard requires a risk assessment to identify risks that are specific to the organisation in scope. Controls shall then be selected with regards to the results of such an assessment. While one might say, let's just implement all controls of annex, how to design them to actually treat the identified risks is completely overlooked with such an approach. Then, once controls are in place, an ISMS needs to be operated. This means gathering data, monitoring performance, and letting the system run before audits or management reviews. Only through regular operation can an organization understand how well its ISMS performs and make adjustments to continuously improve. Promises of certification within a couple of weeks ignore these fundamental steps. What did I miss? ____ If you enjoy posts like these, you might also like to visit GRC Lab, the all-in-one hub to launch, grow and accelerate your career in GRC. (link in first comment)

I finally managed to obtain a "real" Lead Auditor certification. What do I mean with real? While there are many providers of lead auditor certification programs, only a few of them have an accreditation. The TRECCERT ISO/IEC 27001 Lead Auditor certification program is one of them. It is accredited by ANAB against ISO 17024, similar to renowned programs like the CISSP or CISM. The exam tests your knowledge in 6 domains: - Domain 1 - 13.33% ISMS Fundamentals - Domain 2 - 36.66% ISMS Requirements and Controls - Domain 3 - 6.66% Auditing Fundamentals - Domain 4 - 10.00% Audit Initiation and Preparation - Domain 5 - 23.33% Audit Execution - Domain 6 - 10.00% Audit Reporting, Completion and Follow-Up How did I prepare? Maybe something to talk about it in the next post. ____ Interested in becoming a Lead Auditor or Lead Implementer yourself? Why not visit GRC Lab, the all-in-one hub to launch, grow and accelerate your career in GRC. https://lnkd.in/eHZdAExA

If you want to install the risk mindset, read these books: Links to the standards and publications can be found in my latest article. ________ Enjoy this? Join 7K+ in GRC Lab — my free newsletter to help you launch, grow and accelerate your career in GRC:

The (FREE) secret to safeguarding small businesses. If you've ever felt overwhelmed by the complex requirements of IT security frameworks, you're not alone. Many small business owners are told to implement frameworks that are too complex and costly. The result? - Exposed vulnerabilities - Financial strains - Inefficient resource allocation - Missed growth opportunities What a mess. Thankfully, I stumbled upon a hidden gem designed specifically for the unique needs of very small businesses (VSBs). Introducing DIN SPEC 27076:2023-05, a standard that changes the game for VSBs, making IT security accessible, manageable, and, believe it or not, free. When applied with insight, it enables businesses to assess and improve their security posture in a clear and straightforward way. In my newsletter, I’ll introduce how DIN SPEC 27076 can be used to help small businesses in improving their security. You’ll discover how to: - Follow the provided consulting process - Use the provided requirements catalogue - Generate a report - Derive suggestions for improvement Read here: Link in first comment

NIS2 is gaining momentum. Despite popular believe, organisations do not have to comply with NIS2. This is because NIS2 is a directive, issued by the European Union. Directives need to be transposed into national legislation by the EU member states first, to come into effect. The deadline to do so, was October, 18th. Many countries, including Germany have missed this deadline. In the most recent draft of the German NIS2 adaptation, the following categories of requirements were to be found. - Risk Management - Reporting Obligations - Information Obligations - Sanctions - Governance - Registration - Evidence - Critical Entities I expect them to be somehow similar to those of other European countries. Many of them can be fulfilled by an ISMS according to ISO/IEC 27001, but not ALL of them. Which ones trouble you the most?

Did you know there are close to 100 standards within the ISO 27000 family of standards? Yep, ISO/IEC 27001 is not alone. Want to find out more about them? https://lnkd.in/e_6eBvfu

A quick start guide for ISO/IEC 27001. If you feel like: ⦿ ISO 27001 is too hard to implement, ⦿ ISO 27001 is too expensive to implement, ⦿ ISO 27001 is just for big enterprises? You are not alone. A couple of years ago, I was in the same situation. I needed to provide advice on how to implement the standard. At that time I knew everything about its requirements (or at least I thought I knew), but I struggled to translate them into actionable tasks that follow a defined order. It all started with an empty spreadsheet. Fast forward to today, this spreadsheet now contains over 300 tasks, each mapped to normative requirements and suggestions for corresponding deliverables. This is how it's structured. ✅Step 1: Management Support ✅Step 2: Scope of the ISMS ✅Step 3: Gap Analysis ✅Step 4: Competence Assurance ✅Step 5: Information Security Policy ✅Step 6: Asset Inventory ✅Step 7: Risk Management Methodology ✅Step 8: Information security risk assessment ✅Step 9: Information security risk treatment ✅Step 10: Performance Evaluation ✅Step 11: Improvement 🏅Step 12: Certification audit Want to find out what the very first step in every ISO 27001 project should be? → Click the link in the comments to find out.

Would you like to see the functions of the NIST Cybersecurity Framework in ISO 27001? The CSF Core is divided into 6 functions that represent the highest level of organization within the framework. These functions are the broad actions we take to manage cybersecurity, such as identifying what needs protection and responding if there's a security issue. Each function is further divided into 22 categories, which are groups of cybersecurity outcomes closely related to each other. The categories are then divided into 106 subcategories, providing specific outcomes of technical and management activities. Would this approach resonate with you? --- Repost to help your network. ♻️ Follow The GRC Lab for more.

GRCL

COM:GRCLAB

GRC Lab