The webinar covers: 1) Risk Assessment Approach / Methodology, 2) Asset Inventory, 3) Risk Assessment, 4) Risk Treatment Plan, 5) Statement of Applicability to Annex A Controls. Presenter: The topic was presented by David Anders. Mr. Anders has worked more than 20+ years in the risk management field managing a broad spectrum of consulting services and product solutions. David has worked in the consulting field for 16 years and is the founder / CEO of SecuraStar, LLC, a niche ISO 27001 consulting firm in the United States and founder / CEO of ISMS Manager Software, LLC. Link of the recorded session published on YouTube: https://youtu.be/i4_1bJpzokA

1. 1© SecuraStar, LLC. 2012 / ISO Manager Software 2013

2. 2© SecuraStar, LLC. 2012 / ISO Manager Software 2013
ISO 27001
Section 6 – Planning
This presentation will cover ISO 27001 Section 6 – Planning in a step-by-step process including:
1) Risk Assessment Approach
2) Asset Inventory
3) Risk Assessment
4) Risk Treatment Plan
5) Statement of Applicability

3. 3© SecuraStar, LLC. 2012 / ISO Manager Software 2013
David Anders
CEO / President
Mr. David Anders has worked more than 20+ years in the risk management field managing a
broad spectrum of consulting services and product solutions. David has worked in the
consulting field for 16 years and is the founder / CEO of SecuraStar, LLC, a niche ISO 27001
consulting firm in the United States and founder / CEO of ISMS Manager Software, LLC.
855-476-2701
djanders@SecuraStar.com www.SecuraStar.com
linkedin.com/in/andersdave

4. 4© SecuraStar, LLC. 2012 / ISO Manager Software 2013

5. 5© SecuraStar, LLC. 2012 / ISO Manager Software 2013
Threats & Vulnerabilities
ISO 27001 SECTION 6 - PLANNING
RISK MANAGEMENT PROCESS
1) Raw Risk = No Controls
Map Controls
To
Annex A
(middle man)
FISMA
Risk
Assessment
Risk
CIA
Risk
Non-Compliance
Statement
Of
Applicability
Asset
Inventory
Risk
Treatment
Plan
Risk
Assessment
Approach
FedRAMP
HIPAA
© SecuraStar, Inc. 2012 REPRODUCTION PROHIBITED
Policies
Processes
Procedures
Busn Continuity
3) Current Risk = Current Controls
5) Risk Treatment Options?
4) Risk Acceptance Criteria?
6) Risk Treatment = Added Controls
Impact Scale
Likelihood Scale
Risk Treatment Options
Risk Acceptance Criteria
7) Residual Risk
PCI DSS
CSA
COBIT
2) Risk Acceptance Criteria?
Risk
Treatment
Options

6. 6© SecuraStar, LLC. 2012 / ISO Manager Software 2013
?
QUESTIONS
THANK YOU
855-476-2701
djanders@SecuraStar.com www.SecuraStar.com
linkedin.com/in/andersdave