The ISO Review Podcast
The ISO Review Podcast is produced by SimplifyISO and focuses on the latest developments in International Standards. Each episode offers guidance on getting the most out of management systems such as ISO certifications. It is co-hosted by Howard Fox, a business coach and host of the Success InSight Podcast, and Jim Moran, an ISO management system professional with more than 30 years of experience delivering ISO support.
Episodes
ISO 9001:2026 - Exploring the 10 Building Blocks of a Quality Culture
Welcome to another episode of the ISO Review Podcast, your trusted source for the latest updates on international standards and maximizing the value of your management systems. In today’s episode, Jim Moran and Howard Fox dive into the 2026 update of ISO 9001, which introduces a significant new requirement: the promotion of a quality culture and ethical behavior by top management. Drawing from Jim
ISO 9001:2026 Made Simple: Demystifying Key Changes, Risks, and Best Practices
Welcome back to the ISO Review Podcast, your trusted source for the latest developments in international standards and practical ISO management system insights. In this episode, Jim and HowardThe conversation focused on the release of ISO 9001:2026, providing listeners with an in-depth look at the newest changes to the world’s leading quality management standard. A key theme that emerged was the e
ISO 19011:2026 Guidelines for Auditing Management Systems - Annex A, Clauses 13-18
Welcome back to the ISO Review Podcast, your trusted source for the latest developments in international standards and practical ISO management system insights. In this episode, Jim and Howard conclude their comprehensive review of ISO 19011:2026, the essential auditing guidelines for management systems. Together, they dive into Annex A, covering Clauses A.13 to A.18, and discuss critical topics l
ISO 19011:2026 Guidelines for Auditing Management Systems - Annex A, Clauses 7-12
Welcome back to the ISO Review Podcast, your trusted source for the latest in international standards development and management systems excellence. In this episode, Jim and Howard continue their practical deep dive into ISO 19011, specifically focusing on Appendix A. Together, they explore key auditing topics such as compliance and conformance, understanding organizational context, leadership and
ISO 19011:2026 Guidelines for Auditing Management Systems - Annex A, Clauses 1-6
Welcome to the latest episode of the ISO Review Podcast, where we dive into the essentials of international standards and provide guidance for optimizing your management systems. In this episode, Howard Fox and ISO management system expert Jim Moran explore ISO 19011:2026, focusing on Appendix A, clauses 1 through 6. Whether you’re looking to refine your internal audit program or better understand
ISO 19011:2026 Guidelines for Auditing Management Systems - Clauses 6 & 7
Welcome to another episode of the ISO Review Podcast, your trusted source for the latest developments in international standards and practical guidance for getting the most out of your management systems. Join hosts Howard Fox and Jim Moran—an ISO management system professional celebrating 34 years of expertise—as they dive into the newly updated ISO 19011:2026 standard.In this episode, they break
ISO 19011:2026 Guidelines for Auditing Management Systems - Clauses 3-5
Welcome to another episode of the ISO Review Podcast, presented by Simplify ISO. Join hosts Jim Moran and Howard Fox as they explore the latest developments in international standards and offer practical guidance for maximizing your management systems. In this episode, Jim Moran shares insights into the newly released 2026 edition of ISO 19011, the key auditing standard for management systems. Tog
ISO 9001:2026 Final Draft Release: Key Changes for Organizations and Quality Management Professionals
Welcome to another episode of the ISO Review Podcast, your trusted resource for the latest developments in international standards and tips for maximizing your management systems. In this episode, hosts Jim Moran and Howard Fox dive into the just-released final draft of ISO 9001:2026, marking a new evolution in quality management standards. Jim Moran highlights the key changes—ranging from editori
50 Ways to Simplify Your ISO Management System - Part X
Welcome to another episode of the ISO Review Podcast, produced by Simplify ISO. Join hosts Howard Fox and Jim Moran as they wrap up their popular series, “50 Ways to Simplify Your ISO Management System.” In this episode, Jim Moran, who brings over 34 years of ISO expertise, shares the final five tips for streamlining management systems—covering practical advice on corrective actions, root cause an
50 Ways to Simplify Your ISO Management System - Part IX
Welcome back to another episode of the ISO Review Podcast, presented by Simplify ISO. Join hosts Howard Fox and ISO management system expert Jim Moran as they continue their journey through "50 Ways to Simplify Your ISO Management System." In this episode, they break down tips 41 to 45, covering practical strategies like using internal audits as process reviews, focusing audits on critic
50 Ways to Simplify Your ISO Management System - Part VIII
Welcome back to the ISO Review Podcast, a production of Simplify ISO, where Howard Fox, business coach and host of the Success Insight podcast, ISO management system expert Jim Moran, explore the latest developments in international standards and provide practical tips to help you get the most out of your management systems. In this episode, Howard and Jim dive into the next segment of our ongoing
50 Ways to Simplify Your ISO Management System - Part VII
Welcome back to the ISO Review Podcast, your trusted source for the latest insights on international standards and management system best practices. In this episode, hosts Howard Fox and Jim Moran continue their exploration of "50 Ways to Simplify Your ISO Management System," diving into leadership and governance strategies that streamline operations and cut through unnecessary complexit
50 Ways to Simplify Your ISO Management System - Part VI
Welcome to another episode of the ISO Review Podcast, your trusted resource for the latest in international standards development and practical strategies to maximize your management systems. In today’s episode, Howard Fox and ISO expert Jim Moran continue their journey through "50 Ways to Simplify Your ISO Management System," diving deep into actionable techniques for integrating and ma
50 Ways to Simplify Your ISO Management System - Part V
Welcome back to the ISO Review Podcast, your go-to source for insights and practical advice on international standards and management systems. In this engaging episode, hosts Howard Fox and Jim Moran dive into part five of their popular series, “50 Ways to Simplify Your ISO Management System.”This segment focuses on risk-based thinking—providing practical advice on simple risk methods, assessing r
50 Ways to Simplify Your ISO Management System - Part IV
Welcome back to the ISO Review Podcast, your go-to source for insights and practical advice on international standards and management systems. In this engaging episode, hosts Howard Fox and Jim Moran dive into part four of their popular series, “50 Ways to Simplify Your ISO Management System.”You’ll hear Jim Moran reflect on his 34 years in the ISO world, sharing firsthand how standards have evolv
50 Ways to Simplify Your ISO Management System - Part III
Welcome to another episode of the ISO Review Podcast, brought to you by Simplify ISO! In this installment, hosts Howard Fox and Jim Moran dive deeper into their ongoing series, "50 Ways to Simplify Your ISO Management System." With Jim Moran sharing wisdom from over 34 years in ISO support, the conversation unpacks practical tips for streamlining management systems—whether you’re tacklin
50 Ways to Simplify Your ISO Management System - Part II
Welcome to another episode of the ISO Review Podcast, brought to you by Simplify ISO! In today’s show, Howard Fox sits down with ISO Management System veteran Jim Moran, who marks his incredible 34th year delivering ISO support. Together, they continue with Part II of their episode series, “50 Ways to Simplify Your ISO Management System.”This episode is packed with actionable advice—like documenti
50 Ways to Simplify Your ISO Management System - Part I
Welcome to another episode of the ISO Review Podcast, brought to you by Simplify ISO! In today’s show, Howard Fox sits down with ISO Management System veteran Jim Moran, who marks his incredible 34th year delivering ISO support. Together, they kick off an exciting new series focused on “50 Ways to Simplify Your ISO Management System.”You’ll hear Jim Moran reflect on the evolution of ISO 9001—from
ISO 27008: Preparing and Planning for IS Management System Assessments - Clauses 8.3 & 8.4
Welcome to the ISO Review Podcast! In this first episode of the New Year, hosts Howard Fox and ISO Management System professional Jim Moran dive into the guiding principles of ISO 27008, focusing on clauses 8.3 Conduction reviews and 8.4 Analysis and reporting results.Together, Howard Fox and Jim Moran unravel the best practices for conducting interviews, gathering and evaluating evidence, and ens
ISO 27008: Preparing and Planning for IS Management System Assessments - Clauses 8.1 & 8.2
Welcome to the ISO Review Podcast! In this year-end episode, hosts Howard Fox and ISO Management System professional Jim Moran dive into the guiding principles of ISO 27008, focusing on clause 8—the heart of assessing controls for information security.This episode explores the importance of thorough preparations and tailored planning for control assessments, drawing on real-world experience and hi
Assessing ISO 27001 Annex A Controls Using Practical Review Methods from Clause 7 in ISO 27008
Welcome to another episode of the ISO Review Podcast, brought to you by Simplify ISO! In this installment, hosts Jim Moran and Howard Fox dive deep into Clause 7 of ISO 27008, unpacking practical review methods for assessing the effectiveness of Annex A controls under ISO 27001.Whether you're an internal auditor looking to sharpen your skills or someone new to information security management,
Understanding ISO 27008: Effective Methods for Auditing Information Security Management Controls
Welcome back to another episode of the ISO Review Podcast, brought to you by Simplify ISO! This week, Howard Fox and Jim Moran kick off a brand new series diving deep into the world of ISO/IEC 27008—the essential guidelines for assessing information security controls. In today’s episode, we set the stage by exploring the structure and background of ISO 27008, including its key sections and practic
How to Assess Information Security Controls Using ISO 27008: Process, Scope, and Criteria
Welcome back to another episode of the ISO Review Podcast, brought to you by Simplify ISO! This week, Jim Moran and Howard Fox dive deep into the essentials of assessing information security controls in line with ISO 27008. Building on last week’s introduction, Jim Moran shares his expertise, highlighting the critical steps in reviewing and auditing controls from Annex A of ISO 27001, gathering ev
Leveraging AI Tools for Effective ISO 9001 Risk Analysis and Audit Preparation
Welcome back to another insightful episode of the ISO Review Podcast, brought to you by Simplify ISO! This week, Jim and Howard dive deeper into the intersection of artificial intelligence and ISO risk management, building on their previous discussion. With Jim sharing wisdom from over three decades in ISO support, and Howard adding his expertise with AI tools, the conversation explores practical
Using Artificial Intelligence to Strengthen Risk Identification in Your ISO Management Systems
Welcome back to the ISO Review Podcast, your trusted resource for the latest in international standards and maximizing your management systems. In this episode, hosts Jim and Howard dive into one of the most requested topics in the ISO world: risk and opportunity management. Jim draws from his 33 years of experience to share practical strategies for strengthening risk identification, sharpening ev
Sneak Peek at the ISO 9001 Draft Update: Changes, Clarifications, and Industry Impact
Click here to learn about our new DIY ISO 9001 program using AIWelcome to the ISO Review Podcast. In this episode, Jim and Howard chat about the upcoming changes to ISO 9001, offering listeners an exclusive sneak peek at the new Draft International Standard set to shape quality management systems worldwide.DISCUSSION00:00 Global Reach of ISO 900105:55 ISO 9001 Update Preview07:01 ISO Draft to Inte
Enhancing Information Security Management Systems with AI
Click here to learn about our new DIY ISO 9001 program using AI .Welcome back to the ISO Review Podcast. In this episode, hosts Jim Moran and Howard Fox are joined by special guest Dejan Kosutic, CEO of Advisera.Dejan is a renowned cybersecurity expert for ISO 27001. He is passionate about making compliance accessible. Dejan and Jim discuss how to use Artificial Intelligence (AI) to enhance your I
How Positive Intention Can Transform Workplace Culture and Management Systems
Click here to learn about our new DIY ISO 9001 program using AI Welcome back to the ISO Review Podcast, your trusted source for the latest in international standards development and practical tips on getting the most out of your management systems. In this episode, hosts Jim Moran and Howard Fox are joined by special guest Michael Kent Hart, the founder and CEO of Human.ca, who brings over 40 year
Turn Root Cause Analysis on its Head...Use Intention and Positive Focus Instead
Click here to learn about our new DIY ISO 9001 program using AIWelcome to the ISO Review Podcast. In this episode, Howard and Jim discuss an innovative approach to traditional root cause analysis inspired by the work of Michael Kent Hart. In this approach, there is a shift in focus from traditional root cause analysis and blame to a more positive, future-focused strategy centered on “intention in
Build Your ISO 9001 QMS: Practical, DIY Approach Enhanced by AI Technology - Part III
Click here to learn about our new DIY ISO 9001 program using AIWelcome to the ISO Review Podcast. In this episode, Howard and Jim continue with a video series designed to help organizations simplify the process of ISO 9001 certification, using a do-it-yourself approach.Jim shares the journey behind creating the Simplify ISO platform—a user-friendly, cost-effective solution designed for small to mi
Build Your ISO 9001 QMS: Practical, DIY Approach Enhanced by AI Technology - Part II
Click here to learn about our new DIY ISO 9001 program using AIWelcome to the ISO Review Podcast. In this episode, Howard and Jim continue with a video series designed to help organizations simplify the process of ISO 9001 certification, especially if you're considering a do-it-yourself approach.With more than three decades of ISO consulting experience, Jim shares the journey behind creating
Build Your ISO 9001 QMS: Practical, DIY Approach Enhanced by AI Technology
Click here to learn about our new DIY ISO 9001 program using AIWelcome to the ISO Review Podcast. In this episode, Howard and Jim kick off a special new video series designed to help organizations simplify the process of ISO 9001 certification, especially if you're considering a do-it-yourself approach.With more than three decades of ISO consulting experience, Jim shares the journey behind cr
ISO/IEC 42001 AI management system standard, Annex C and Annex D
Howard and Jim discuss the ISO/IEC 42001 AI management system standard, Annex C (Potential AI-related organizational objectives and risk sources) and D (Use of the AI management system across domains or sectors).POINTS DISCUSSEDAnnex CExplanation of Annex CObjectivesRisk SourcesAnnex DExplanation of Annex DIntegration of AI management system with other management system standardsLooking Ahead Prev
ISO/IEC 42001 AI Management System Standard, Annex B.10 - Third-party and customer relationships
Howard and Jim chat about ISO 42001, the world's first artificial intelligence management system International standard. In this episode they discuss Annex B.10 - Third-party and customer relationships.POINTS DISCUSSEDExplanation of what Clause B.10 - Third-party and customer relationships coversObjectiveAllocating responsibilitiesSuppliersCustomersLooking Ahead - Preview of next episode focu
ISO/IEC 42001 AI Management System Standard, Annex B.9 - Use of AI systems
Howard and Jim chat about ISO 42001, the world's first artificial intelligence management system International standard. In this episode they discuss Annex B.9 - Use of AI systems.POINTS DISCUSSEDExplanation of what Clause B.9 covers: “Use of AI systems”Key Requirements and Concepts in Clause B.9Real-World Applications & AnalogiesInternal vs. External AI Models in OrganizationsHuman Overs
ISO/IEC 42001 AI Management System Standard, Annex B.8 - Information for interested parties
Howard and Jim chat about ISO 42001, the world's first artificial intelligence management system International standard. In this episode they discuss Annex B.8 - Information for interested parties.POINTS DISCUSSEDObjective of ISO 42001, Annex B.8 - Information for interested parties.System documentation and information for usersExternal reportingCommunication of incidentsInformation for inter
ISO/IEC 42001 AI Management System Standard, Annex B.7 - Data for AI systems
Howard and Jim chat about ISO 42001, the world's first artificial intelligence management system International standard. In this episode they discuss Annex B.7 - Data for AI systems.POINTS DISCUSSEDObjective of ISO 42001, Annex B.7 - Data for AI systemsData for development and enhancement of AI systemAcquisition of dataQuality of data for AI systemsData provenanceData preparationLEARN MORECli
ISO/IEC 42001 AI Management System Standard, Annex B.6 - AI system life cycle
Howard and Jim chat about ISO 42001, the world's first artificial intelligence management system International standard. In this episode they discuss Annex B.6 - AI system life cyclePOINTS DISCUSSEDOverview of ISO 42001, Annex B.6: Implementation Guidance for Artificial Intelligence ControlsManagement guidance for AI system developmentAI system life cycleAI system requirements and specificati
ISO/IEC 42001 AI Management System Standard, Annex B (Implementation Guidance for Artificial Intelligence Controls), Clause B5
Howard and Jim chat about ISO 42001, the world's first artificial intelligence management system International standard. In this episode they discuss Annex B (Implementation Guidance for Artificial Intelligence Controls), Clause B.5.POINTS DISCUSSEDOverview of ISO 42001, Annex B: Implementation Guidance for Artificial Intelligence ControlsClause B5 and Impact AssessmentsHigh-Level Management
ISO/IEC 42001 AI Management System Standard, Annex B (Implementation Guidance for Artificial Intelligence Controls), Clauses B.1-B.4
Howard and Jim chat about ISO 42001, the world's first artificial intelligence management system International standard. In this episode they discuss Annex B (Implementation Guidance for Artificial Intelligence Controls), Clauses B.1 - B.4.POINTS DISCUSSEDOverview of ISO 42001, Annex B: Implementation Guidance for Artificial Intelligence ControlsAnnex B, Clause B.1 – Implemenation GuidanceAnn
ISO/IEC 42001 AI Management System Standard - Annex A (Controls), A.7 - A.10
Howard and Jim chat about an exciting new frontier: ISO 42001, the world's first artificial intelligence management system International standard. In this episode we discuss Annex A (Controls), Claues A.7 - A.10POINTS DISCUSSEDOverview of ISO 42001 Annex A ControlsAnnex A Control A.7 – Data for AI SystemsAnnex A Control A.8 – Information for Interested Parties of AI SystemsAnnex A Control A.9
ISO/IEC 42001 AI Management System Standard - Annex A Controls, A.1 - A.6
Howard and Jim chat about an exciting new frontier: ISO 42001, the world's first artificial intelligence management system International standard. In this episode we discuss Annex A Controls, A.1 - A.6POINTS DISCUSSEDOverview of ISO 42001 Annex A ControlsAnnex A Control A.2 – Policies Related to AIAnnex A Control A.3 – Internal OrganisationAnnex A Control A.4 – Resources for AI SystemsAnnex A
ISO/IEC 42001 AI Management System Standard - Clause 10, Improvement
Howard and Jim chat about an exciting new frontier: ISO 42001, the world's first artificial intelligence management system International standard. In this episode we discuss Clause 10, ImprovementPOINTS DISCUSSEDDiscussion of Clause 10: ImprovementDetails on Continual Improvement ProcessesInternal Audit ProcessStakeholder and Interested Party InvolvementRisk-Based Thinking ApproachImplementat
ISO/IEC 42001 AI Management System Standard - Clause 9, Performance Evaluation
Howard and Jim chat about an exciting new frontier: ISO 42001, the world's first artificial intelligence management system International standard. In this episode we discuss Clause 9, Performance Evaluation.POINTS DISCUSSEDUnderstanding ISO 42001Artificial Intelligence and Risk AssessmentInternal Audits and ISO StandardsPerformance EvaluationImplementation ChallengesManagement Review Importan
ISO/IEC 42001 AI Management System Standard - Clauses 8.1 - 8.4
Howard and Jim chat about an exciting new frontier: ISO 42001, the world's first artificial intelligence management system International standard. In this episode we discuss Clauses 8.1 - 8.4.POINTS DISCUSSEDEvolutions in Standards - How the significant changes in the ISO 9001 standard over the years reflect the evolving needs of industries and technology.Harmonized Structure - The benefits o
ISO/IEC 42001 AI Management System Standard - Clauses 4-7
Howard and Jim chat about an exciting new frontier: ISO 42001, the world's first artificial intelligence management system International standard. In this episode we discuss Clauses 4-7.POINTS DISCUSSEDAI's Rapid Advancement and Implications for businesses.Importance of AI Standards and their value even if companies don't seek certification.ISO Standard Details, introduction to the
The Impact of ISO/IEC 42001:2023 on Artificial Intelligence Development
Howard and Jim chat about an exciting new frontier: the emergence of ISO 42001, the world's first artificial intelligence management system International standard. POINTS DISCUSSEDHow ISO/IEC 42001:2023 compares to other existing Harmonized Structure ISO standards like ISO 9001, ISO 27001 and ISO 14001 in terms of structure.The ways in which ISO 42001 standard addresses ethical considerations
ISO/IEC TS 27008:2019 - Clause 8.3: Conduction Reviews and Clause 8.4: Analysis and Reporting Results
Howard and Jim chat about ISO/IEC TS 27008:2019 - Clause 8.3 - Conduction Reviews and Clause 8.4 - Analysis and Reporting Results.POINTS DISCUSSEDThe key components of clauses 8.3 and 8.4 of ISO 27008, and why are they critical for conclusions about the effectiveness of your information security management system.The importance of why auditors should remain unbiased and provide factual reports, an
ISO/IEC TS 27008:2019 - Clause 8.2.9: Extended Review Procedures, 8.2.10: Optimization, and 8.2.11: Finalization
Howard and Jim chat about ISO/IEC TS 27008:2019, Clause 8.2.9: Extended Review Procedures, 8.2.10: Optimization, and 8.2.11: Finalization.POINTS DISCUSSEDInformation Assets and OrganizationExtended Review ProceduresOptimization StrategiesCase Study ReflectionInternal AuditingOrganization-Specific ConditionsWorkflow AuditingImpact of Unexpected EventsPreparations for Conducting InterviewsAnticipat
ISO/IEC TS 27008:2019 - Clauses 8.2.6 Work Assignments, 8.2.7 External Systems, and 8.2.8 Information Assets and Organization
Howard and Jim chat about ISO/IEC TS 27008:2019 - Clauses 8.2.6 Work Assignments, 8.2.7 External Systems, and 8.2.8 Information Assets and Organization.POINTS DISCUSSEDThe importance of thinking about information as an asset, and how can this mindset shift impact the effectiveness of an organization's information security management system .The inevitability of cyberattacks, and how ISO 270
ISO/IEC TS 27008:2019: Clause 8.2.4 - Object-Related Procedures, and 8.2.5 - Previous Findings
Howard and Jim chat about ISO/IEC TS 27008:2019 - Clause 8.2.4 - Object-Related Procedures, and 8.2.5 - Previous FindingsPOINTS DISCUSSEDHow has the role of information security management systems evolved over time, and what key changes have occurred in the past few years?What are some specific methods organizations can use to review their information assets, and how do these methods ensure the v
ISO/IEC TS 27008:2019 - Clause 8.2 - Planning the Assessment
Howard and Jim chat about ISO/IEC TS 27008:2019 - Clause 8.2 - Planning the Assessment: Clauses 8.2.1, 8.2.2 and 8.2.3POINTS DISCUSSED ISO/IEC TS 27008:2019 - Clause 8.2 - Planning the Assessment clauses 8.2.1, 8.2.2 and 8.2.3.Some common misconceptions people have about ISO standards. The importance of planning when assessing controls. How the "Plan, Do, Check, Act" methodology fits i
ISO/IEC TS 27008:2019 - Clause 8.0 - Control Assessment Process: Clause 8.1 - Preparation
Howard and Jim chat about ISO/IEC TS 27008:2019 - Clause 8.0 - Control Assessment Process: Clause 8.1 - Preparation.POINTS DISCUSSEDWhy is a thorough preparation essential for a successful ISO 27001 Annex A audit?How can management support and engagement influence the outcome of an ISO 27001 Annex A audit?What are the critical steps that organizations must complete before an ISO 27001 Annex A aud
ISO/IEC TS 27008:2019 - Assessing Information Security Controls, Sampling Techniques - Clause 7.5
Howard and Jim chat about ISO/IEC TS 27008:2019 - Assessing Information Security Controls, Sampling Techniques - Clause 7.5.POINTS DISCUSSEDIntroduction and ContextThe importance of neutrality and objectivity in selecting sample items for an audit.The criteria used to determine samples.The steps that should be taken after an audit to ensure effective communication of results and implementation of
ISO/IEC TS 27008:2019 - Assessing Information Security Controls - Clauses 7.4.4 - 7.4.7
Howard and Jim chat about ISO/IEC TS 27008:2019 - Assessing Information Security Controls, Testing and Validation Techniques - Clauses 7.4.4 - 7.4.7.POINTS DISCUSSEDIntroduction and ContextTesting Techniques for ISO 27001 Systems - Annex A ControlsThe Importance of Information Security TestingTesting and Validation Techniques - Clauses 7.4.4 - 7.4.7 Grey Box Testing, Double Grey Box Testing, Tande
ISO/IEC TS 27008:2019 - Assessing Information Security Controls - Clauses 7.4.1 - 7.4.3
Howard and Jim chat about ISO/IEC TS 27008:2019 - Assessing Information Security Controls, Testing and Validation Techniques - Clauses 7.4.1 - 7.4.3POINTS DISCUSSEDIntroduction and ContextTesting Techniques for ISO 27001 SystemsTesting and Validation Techniques - Clause 7.4.The Importance of Information Security TestingBlind Testing & Double Blind TestingPreparations an auditor make prior to c
ISO/IEC TS 27008:2019 - Review Methods, Overview, and Process Analysis - Clauses 7.1-7.3
Howard and Jim chat about ISO/IEC TS 27008:2019 - Review Methods, Overview, and Process Analysis - Clauses 7.1-7.3.POINTS DISCUSSEDWhat are the key takeaways from Jim's explanation of ISO 27008 and the review methods overview and process analysis discussed in the episode?How do you think the use of flowcharts to document procedures and audit controls can benefit organizations in assessing th
Guidelines For The Assessment of Information Security Controls - Clause 6.2 Resourcing and Competence
Howard and Jim chat about ISO/IEC TS 27008:2019 - Guidelines for the assessment of Information Security Controls - Clause 6.2 Reourcing and Competence.POINTS DISCUSSEDWhat are the key takeaways from the discussion on clause 6.2, resourcing and competence?How does this standard help organizations to assess the effectiveness of their information security controls?What are the skills and competencies
ISO/IEC TS 27008:2019 - Overview of Information Security Control Assessments - Clauses 6.1.4 - 6.1.5.
Howard and Jim chat about ISO/IEC TS 27008:2019 - Overview of Information Security Control Assessments - Clauses 6.1.4 - 6.1.5.POINTS DISCUSSEDHow does the process of obtaining permission to access all areas and controls play into the effectiveness of an information security audit?Why is it crucial for auditors to create a review checklist, and what should typically be included in this checklist?I
ISO/IEC TS 27008:2019 - Overview of Information Security Control Assessments - Clauses 6.1.1 - 6.1.3
Howard and Jim chat about ISO/IEC TS 27008:2019 - Overview of Information Security Control Assessments - Clauses 6.1.1 - 6.1.3.POINTS DISCUSSEDWhat strategies can organizations employ to ensure that their procedures are not only being followed but are also working efficiently and effectively?How do supply chain contracts affect information security activities, and what role does software play in m
ISO/IEC TS 27008:2019 - Guidelines for the Assessment of Information Security Controls - Clause 5_Background
Howard and Jim chat about ISO/IEC TS 27008:2019 - Guidelines for the Assessment of Information Security Controls - Clause 5_BackgroundPOINTS DISCUSSEDWhat are the key takeaways from the discussion on ISO 27008 and its significance for organizations in terms of information security controls and guidelines?How do information security controls play a vital role in managing unacceptable risks and prom
ISO/IEC TS 27008:2019 - Guidelines for the Assessment of Information Security Controls
Howard and Jim chat about ISO/IEC TS 27008:2019 - Guidelines for the Assessment of Information Security Controls.Points discussed include:How do the ISO 27008 and ISO 27001 standards work together to enhance information security within organizations?Why is it important for organizations to have good monitoring systems in place, and what are some key considerations for setting up effective monitori
Additional Observations and Benefits of Integrating an ISO 27001 Into an Existing ISO 9001 Quality Management System
Howard and Jim chat about "Additional Observations and Benefits of Integrating an ISO 27001 Into an Existing ISO 9001 Quality Management System."Points discussed include: How can integrating ISO 27001 into an existing ISO 9001 system benefit an organization?What are the key differences between ISO 9001 and ISO 27001 in terms of structure and requirements?How can organizations effectively
Information Security in Supplier Contracts: ISO 27036 Part 2, Clause 7.5 - Supplier Termination Process
Howard and Jim chat about ISO 27036-2, Clause 7.5 - Supplier Termination Process.Points discussed include: How important is it for organizations of all sizes to prioritize information security? What are some challenges organizations face when it comes to supplier relationship termination? How can ISO standards help organizations in managing their supplier relationships and information security? W
Information Security in Supplier Contracts: ISO 27036 Part 2, Clause 7.4 - Supplier Relationship Management Process
Howard and Jim chat about ISO 27036-2, Clause 7.4 - Supplier Relationship Management Process.Points discussed include: The importance for organizations to have a process for managing supplier relationships in terms of information security. The potential risks or vulnerabilities that organizations may face when it comes to information security in the supply chain. What organizations can do to ensu
Information Security in Supplier Contracts: ISO 27036 Part 2, Clause 7.3 - Supplier Relationship Agreement
Howard and Jim chat about ISO 27036-2, Clause 7.3 - Supplier Relationship Agreement Process.Points discussed include: How important it is for businesses to have supplier contracts that address information security? The key elements that should be included in an agreement to ensure information security. How can businesses effectively measure their suppliers' compliance with information securi
Cybersecurity in Supplier Relationships: ISO 27036 Part 2, Clause 7.2 - Supplier Selection Process
Howard and Jim chat about ISO 27036-2, Clause 7.2 - Supplier Selection Process.Points discussed include: How can organizations effectively plan their supplier relationships to mitigate information security risks? What are some real-life examples of information security breaches and their impact on organizations? Why is it important for organizations to communicate the importance of information s
Cybersecurity in Supplier Relationships: ISO 27036 Part 2, Clause 7.1 Supplier Relationship Planning Process
Howard and Jim chat about ISO 27036-2, Clause 7.1 - Supplier Relationship Planning Process. Points discussed include: How do the ISO 27036 standards help protect against potential risks and ensure personal safety? What are some potential legal and regulatory issues that suppliers should be aware of in relation to information security impacts? Why is it important for requirements and agreements wi
ISO 27036 Part 2 - Clause 6 Unpacked: Information security in supplier relationship management
Howard and Jim chat about ISO 27036 Part 2 - Clause 6 - Information security in supplier relationship managementPoints discussed include: How does the ISO Review podcast contribute to the understanding and implementation of ISO standards in various industries? What are some practical steps that companies can take to ensure information security in supplier relationships? How has the globalized sup
Protecting Your Data: ISO 27036-1: Overview of Risks and Best Practices - Guidance for Supplier Relationships
Howard and Jim chat about ISO 27036 Part I - Protecting Your Data: Overview of Understanding the Risks and Best Practices Guidance for Supplier Relationships.Points discussed include: Why is due diligence important when choosing suppliers? Why it's important to evaluate the security practices and capabilities of suppliers to make sure that they meet your information security requirements.Wha
ISO 27008 Guidelines for Assessing Annex A Controls
Howard and Jim chat about ISO 27008 Guidelines for Assessing Annex A Controls.Points discussed include: How many controls are required in ISO 27008? What are the seven steps outlined in ISO 27008 for measuring and assessing controls? How can ISO 27008 help organizations improve information security? What is the significance of continual improvement in information security controls?On Our Next Epi
Competence Requirements For Information Security Management Systems Professionals
Howard and Jim chat about Competence Requirements For Information Security Management Systems Professionals.Points discussed include: What is the importance of communication and documentation in auditing firms for ISMS professionals? How can auditors prepare for an audit, and what information should they request from the organizations being audited?What ethics are involved in auditing and what is
Achieving ISO 27001 Certification: The Path to Success
Howard and Jim chat about the Path to ISO 27001 Certification.Points discussed include:What is ISO 27001 and why do some organizations need certification in it?Do most organizations need to be certified in ISO 27001 to bid on projects in the future? What is the process for achieving ISO 27001 certification?Why is formalizing and structuring information management important for organizations?What a
ISO 27001:2022, Annex A - Clause 8: Technical Controls
Howard and Jim chat about ISO 27001, Annex A - Technical Controls.Points discussed include a review of the 14 controls in Clause 8:Annex A, Clause Eight, Technical ControlsNumber of controls:34 (8.1 to 8.34)On Our Next EpisodeThe Path to ISO 27001 Certification - Find out the steps you'll need to take to become Certified to ISO 27001:2022!Next Steps - review your current situation against
ISO 27001:2022, Annex A - Clause 7: Physical Controls
Howard and Jim chat about ISO 27001, Annex A - Physical Controls.Points discussed include a review of the 14 controls in Clause 7:Annex A, Clause Seven, Physical ControlsNumber of controls:14 (7.1 to 7.14)On Our Next EpisodeISO 27001, Annex A - Clause 8 - Technology Controls.Next Steps - review your current situation against these controls to see if you can find a way to improve your Physical Co
ISO 27001:2022, Annex A - Clause 6: People Controls
Howard and Jim chat about ISO 27001, Annex A - People Controls.Points discussed include a review of the 8 controls in Clause 6:Annex A, Clause Six, People ControlsNumber of controls: 8 (6.1 to 6.8)On Our Next EpisodeISO 27001, Annex A - Clause 7 - Physical Controls.Next Steps - review your current situation against these controls to see if you can find a way to improve your People controls for be
ISO 27001:2022, Annex A - Clause 5: Organizational Controls
Howard and Jim chat about ISO 27001, Annex A - Organization Controls.Points discussed include a review of the 37 controls in Clause 5:Annex A, Clause Five, Organizational ControlsNumber of controls: 37 (5.1 to 5.37)On Our Next EpisodeISO 27001, Annex A - Clause 6 - People Controls.Next Steps - review your current practices against these controls required to see if you can find a way to improve yo
Root Cause Analysis Considerations For Your ISO 27001 Information Security Management System
Howard and Jim chat about Root Cause Analysis Considerations For Your ISO 27001 Information Security Management System.Points discussed include:Root Cause Analysis ConsiderationsDetermine the Cause of the NonconformanceContributing IssuesIshikawa Fishbone Diagram Integration With Annex A4-Column Integration Table showing the Ishikawa Fishbone and the 4 Annex A Clauses (See Link)Our Gift To You4-Co
Integration of an ISO 27001 into an existing ISO 9001 QMS
Howard and Jim chat about the integration of an ISO 27001 into an existing ISO 9001 QMS.Points discussed include:ISO 9001 Quality Management Standard is the most prevalent in the world. It's been around since 1987 and there are over 2 million certificates worldwide in over 170 countries.Best Practice would be to integrate ISO 27001 into your existing ISO 9001 system (or any other Harmonized S
ISO 27001 Statement of Applicability Document
Howard and Jim chat about the ISO 27001:2022 - Statement of Applicability (SoA)Items discussed include:The Statement of Applicability is required for ISO 27001 certification. It’s a statement that explains which Annex A security controls are — or aren’t — applicable to your organization’s Information Security Management System (ISMS).You can update your current ISO 27001 Statement of Applicability
