<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>ISO 27001 &#38; BS 25999</title>
	<atom:link href="http://blog.iso27001standard.com/feed/" rel="self" type="application/rss+xml" />
	<link>http://blog.iso27001standard.com</link>
	<description>Leading blog on ISO 27001 &#38; BS 25999-2. Written by Dejan Kosutic.</description>
	<lastBuildDate>Mon, 30 Jan 2012 18:05:18 +0000</lastBuildDate>
	<generator>http://wordpress.org/?v=2.9.2</generator>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
			<item>
		<title>What is the difference between Recovery Time Objective (RTO) and Recovery Point Objective (RPO)?</title>
		<link>http://blog.iso27001standard.com/2012/01/30/what-is-the-difference-between-recovery-time-objective-rto-and-recovery-point-objective-rpo/</link>
		<comments>http://blog.iso27001standard.com/2012/01/30/what-is-the-difference-between-recovery-time-objective-rto-and-recovery-point-objective-rpo/#comments</comments>
		<pubDate>Mon, 30 Jan 2012 17:01:03 +0000</pubDate>
		<dc:creator>Dejan Kosutic</dc:creator>
				<category><![CDATA[Main]]></category>
		<category><![CDATA[BS 25999-2]]></category>
		<category><![CDATA[Business continuity]]></category>
		<category><![CDATA[business continuity strategy]]></category>
		<category><![CDATA[business impact analysis]]></category>
		<category><![CDATA[recovery point objective]]></category>
		<category><![CDATA[recovery time objective]]></category>

		<guid isPermaLink="false">http://blog.iso27001standard.com/?p=1495</guid>
		<description><![CDATA[
			
		
		ShareThey are both essential elements of business continuity, and they sound quite similar. But their purpose is quite different.
What is RTO?
So, what does RTO mean? BS 25999-2, a leading business continuity standard, defines RTO as &#8220;&#8230;target time set for resumption of product, service or activity delivery after an incident&#8221;.
This actually means that RTO is crucial [...]]]></description>
		<wfw:commentRss>http://blog.iso27001standard.com/2012/01/30/what-is-the-difference-between-recovery-time-objective-rto-and-recovery-point-objective-rpo/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Do you really need a consultant for ISO 27001 / BS 25999 implementation?</title>
		<link>http://blog.iso27001standard.com/2011/12/06/do-you-really-need-a-consultant-for-iso-27001-bs-25999-implementation/</link>
		<comments>http://blog.iso27001standard.com/2011/12/06/do-you-really-need-a-consultant-for-iso-27001-bs-25999-implementation/#comments</comments>
		<pubDate>Tue, 06 Dec 2011 11:09:54 +0000</pubDate>
		<dc:creator>Dejan Kosutic</dc:creator>
				<category><![CDATA[Main]]></category>
		<category><![CDATA[BS 25999-2]]></category>
		<category><![CDATA[ISO 27001]]></category>
		<category><![CDATA[training & awareness]]></category>

		<guid isPermaLink="false">http://blog.iso27001standard.com/?p=1489</guid>
		<description><![CDATA[
			
		
		ShareI&#8217;ve met quite a few companies considering how to start their ISO 27001 / BS 25999 project, with quite different approaches – some are convinced they can do it completely on their own (with no prior ISO 27001 knowledge), while others thought they can do it with the help of a consultant only.
They are both [...]]]></description>
		<wfw:commentRss>http://blog.iso27001standard.com/2011/12/06/do-you-really-need-a-consultant-for-iso-27001-bs-25999-implementation/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>ISO 27001 risk assessment &amp; treatment – 6 basic steps</title>
		<link>http://blog.iso27001standard.com/2011/11/22/iso-27001-risk-assessment-treatment-%e2%80%93-6-basic-steps/</link>
		<comments>http://blog.iso27001standard.com/2011/11/22/iso-27001-risk-assessment-treatment-%e2%80%93-6-basic-steps/#comments</comments>
		<pubDate>Tue, 22 Nov 2011 09:12:52 +0000</pubDate>
		<dc:creator>Dejan Kosutic</dc:creator>
				<category><![CDATA[Main]]></category>

		<guid isPermaLink="false">http://blog.iso27001standard.com/?p=1484</guid>
		<description><![CDATA[
			
		
		ShareRisk assessment (often called risk analysis) is probably the most complex part of ISO 27001 implementation; but at the same time risk assessment (and treatment) is the most important step at the beginning of your information security project – it sets the foundations for information security in your company.
The question is – why is it [...]]]></description>
		<wfw:commentRss>http://blog.iso27001standard.com/2011/11/22/iso-27001-risk-assessment-treatment-%e2%80%93-6-basic-steps/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>How long does it take to implement ISO 27001 / BS 25999?</title>
		<link>http://blog.iso27001standard.com/2011/11/08/how-long-does-it-take-to-implement-iso-27001-bs-25999/</link>
		<comments>http://blog.iso27001standard.com/2011/11/08/how-long-does-it-take-to-implement-iso-27001-bs-25999/#comments</comments>
		<pubDate>Tue, 08 Nov 2011 08:47:23 +0000</pubDate>
		<dc:creator>Dejan Kosutic</dc:creator>
				<category><![CDATA[Main]]></category>
		<category><![CDATA[BS 25999-2]]></category>
		<category><![CDATA[Business continuity]]></category>
		<category><![CDATA[Information security]]></category>
		<category><![CDATA[ISO 27001]]></category>

		<guid isPermaLink="false">http://blog.iso27001standard.com/?p=1479</guid>
		<description><![CDATA[
			
		
		ShareThis is probably the second most common question I hear about ISO 27001 and BS 25999 (the first one is How much does it cost?). Well, the answer is not really encouraging – most of the people I speak to expect it to be a few months. But this is not realistic – the reality [...]]]></description>
		<wfw:commentRss>http://blog.iso27001standard.com/2011/11/08/how-long-does-it-take-to-implement-iso-27001-bs-25999/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>What is cybersecurity and how can ISO 27001 help?</title>
		<link>http://blog.iso27001standard.com/2011/10/25/what-is-cybersecurity-and-how-can-iso-27001-help/</link>
		<comments>http://blog.iso27001standard.com/2011/10/25/what-is-cybersecurity-and-how-can-iso-27001-help/#comments</comments>
		<pubDate>Tue, 25 Oct 2011 12:01:33 +0000</pubDate>
		<dc:creator>Dejan Kosutic</dc:creator>
				<category><![CDATA[Main]]></category>

		<guid isPermaLink="false">http://blog.iso27001standard.com/?p=1473</guid>
		<description><![CDATA[
			
		
		ShareEvery time I speak to someone about cybersecurity I hear rather different definitions about what it actually is – but at least the general idea is pretty much the same. However, when it comes to the question on how to achieve it, opinions differ sharply.
This topic has become so hot lately that even President Obama [...]]]></description>
		<wfw:commentRss>http://blog.iso27001standard.com/2011/10/25/what-is-cybersecurity-and-how-can-iso-27001-help/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>ISO 27002 – What will the next revision bring?</title>
		<link>http://blog.iso27001standard.com/2011/10/10/iso-27002-%e2%80%93-what-will-the-next-revision-bring/</link>
		<comments>http://blog.iso27001standard.com/2011/10/10/iso-27002-%e2%80%93-what-will-the-next-revision-bring/#comments</comments>
		<pubDate>Mon, 10 Oct 2011 15:34:44 +0000</pubDate>
		<dc:creator>Dejan Kosutic</dc:creator>
				<category><![CDATA[Main]]></category>
		<category><![CDATA[Annex A]]></category>
		<category><![CDATA[controls]]></category>
		<category><![CDATA[Information security]]></category>
		<category><![CDATA[ISMS]]></category>
		<category><![CDATA[ISO 27001]]></category>
		<category><![CDATA[ISO 27002]]></category>
		<category><![CDATA[risk assessment]]></category>
		<category><![CDATA[Statement of Applicability]]></category>

		<guid isPermaLink="false">http://blog.iso27001standard.com/?p=1465</guid>
		<description><![CDATA[
			
		
		ShareIt&#8217;s been six years since the last revision of ISO/IEC 27002 (in 2005) – much has changed in information security since then, and this standard definitely needs some &#8220;facelifting&#8221;. Since ISO 27002 is closely tied to ISO 27001, this revision has to be done simultaneously for both standards, and is expected to happen in the [...]]]></description>
		<wfw:commentRss>http://blog.iso27001standard.com/2011/10/10/iso-27002-%e2%80%93-what-will-the-next-revision-bring/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Activation procedures for business continuity plan</title>
		<link>http://blog.iso27001standard.com/2011/09/26/activation-procedures-for-business-continuity-plan/</link>
		<comments>http://blog.iso27001standard.com/2011/09/26/activation-procedures-for-business-continuity-plan/#comments</comments>
		<pubDate>Mon, 26 Sep 2011 15:24:12 +0000</pubDate>
		<dc:creator>Dejan Kosutic</dc:creator>
				<category><![CDATA[Main]]></category>
		<category><![CDATA[BS 25999-2]]></category>
		<category><![CDATA[Business continuity]]></category>
		<category><![CDATA[business continuity plans]]></category>
		<category><![CDATA[disaster recovery]]></category>
		<category><![CDATA[incident response]]></category>
		<category><![CDATA[recovery time objective]]></category>
		<category><![CDATA[training & awareness]]></category>

		<guid isPermaLink="false">http://blog.iso27001standard.com/?p=1457</guid>
		<description><![CDATA[
			
		
		ShareHaving a business continuity plan is nice, but if you don&#8217;t know when and how to start using it, the money you&#8217;ve invested in it was spent in vain. Even worse, you&#8217;ll likely lose quite a lot of money because your business operations will be disrupted.
What is a business continuity plan?
Before going into the activation [...]]]></description>
		<wfw:commentRss>http://blog.iso27001standard.com/2011/09/26/activation-procedures-for-business-continuity-plan/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Becoming ISO 27001 certified &#8211; How to prepare for certification audit</title>
		<link>http://blog.iso27001standard.com/2011/09/13/becoming-iso-27001-certified-how-to-prepare-for-certification-audit/</link>
		<comments>http://blog.iso27001standard.com/2011/09/13/becoming-iso-27001-certified-how-to-prepare-for-certification-audit/#comments</comments>
		<pubDate>Tue, 13 Sep 2011 07:43:21 +0000</pubDate>
		<dc:creator>Dejan Kosutic</dc:creator>
				<category><![CDATA[Main]]></category>
		<category><![CDATA[certification]]></category>
		<category><![CDATA[corrective and preventive actions]]></category>
		<category><![CDATA[Information security]]></category>
		<category><![CDATA[internal audit]]></category>
		<category><![CDATA[ISO 27001]]></category>
		<category><![CDATA[management review]]></category>

		<guid isPermaLink="false">http://blog.iso27001standard.com/?p=1449</guid>
		<description><![CDATA[
			
		
		ShareIf you think writing a bunch of information security documents is enough to get ISO 27001 certificate , you&#8217;re wrong. You need to implement all the activities described in your documentation, but that&#8217;s not all – you also need to follow certain steps in the final phase of your ISO 27001 project.
ISO 27001 certification process
Let&#8217;s [...]]]></description>
		<wfw:commentRss>http://blog.iso27001standard.com/2011/09/13/becoming-iso-27001-certified-how-to-prepare-for-certification-audit/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>How to deal with insider threats?</title>
		<link>http://blog.iso27001standard.com/2011/06/27/how-to-deal-with-insider-threats/</link>
		<comments>http://blog.iso27001standard.com/2011/06/27/how-to-deal-with-insider-threats/#comments</comments>
		<pubDate>Mon, 27 Jun 2011 14:48:48 +0000</pubDate>
		<dc:creator>Dejan Kosutic</dc:creator>
				<category><![CDATA[Main]]></category>
		<category><![CDATA[Information security]]></category>
		<category><![CDATA[ISO 27001]]></category>
		<category><![CDATA[risk assessment]]></category>
		<category><![CDATA[risk treatment]]></category>
		<category><![CDATA[threats]]></category>
		<category><![CDATA[vulnerabilities]]></category>

		<guid isPermaLink="false">http://blog.iso27001standard.com/?p=1374</guid>
		<description><![CDATA[
			
		
		Share“Your ISO 27001 is nice in theory, but if our system administrator goes crazy, we’re dead.” – I hear this quite often when speaking to my clients about which security controls they should apply.
And it’s not only system administrators, it is also the line managers, engineers, top management, etc. – actually, anyone who has access [...]]]></description>
		<wfw:commentRss>http://blog.iso27001standard.com/2011/06/27/how-to-deal-with-insider-threats/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Is it possible to calculate the Return on Security Investment (ROSI)?</title>
		<link>http://blog.iso27001standard.com/2011/06/13/is-it-possible-to-calculate-the-return-on-security-investment-rosi/</link>
		<comments>http://blog.iso27001standard.com/2011/06/13/is-it-possible-to-calculate-the-return-on-security-investment-rosi/#comments</comments>
		<pubDate>Mon, 13 Jun 2011 15:42:47 +0000</pubDate>
		<dc:creator>Dejan Kosutic</dc:creator>
				<category><![CDATA[Main]]></category>
		<category><![CDATA[Business continuity]]></category>
		<category><![CDATA[Information security]]></category>
		<category><![CDATA[risk assessment]]></category>
		<category><![CDATA[risk treatment]]></category>

		<guid isPermaLink="false">http://blog.iso27001standard.com/?p=1363</guid>
		<description><![CDATA[
			
		
		ShareIf you are an information security or business continuity professional, then you’re probably aware of the most difficult part of your job: to convince your management that investment in information security/business continuity makes sense.
Traditionally, “making sense” for management means that the revenues that will result from the investment will be larger than the total cost [...]]]></description>
		<wfw:commentRss>http://blog.iso27001standard.com/2011/06/13/is-it-possible-to-calculate-the-return-on-security-investment-rosi/feed/</wfw:commentRss>
		<slash:comments>18</slash:comments>
		</item>
	</channel>
</rss>

