Aardvarks to Zorillas - Anything goes

Am asked many a times , hey, we need to get ISO 27001 certified and then asked to make themselves compliant within a few weeks. I go through the long process of explaining the steps required and the terminology that is often used as part of the compliance exercise. In this ramble, I will try to capture the salient requirements as to what constitutes the process and the time lines generally applicable (I am generalizing here) to get compliant or to go for certification. Before taking it further, I will say this " YOU CANNOT GET ISO 27002 certified" ISO 27001 is the management standard that details on the processes - THE ISMS - and you certify against this standard. The Annexure to the standard details the controls that are recommended to achieve the objective. These are brief details as to the nature of controls required. However, a detailed version of the controls in the ISO 27001 annexure is found in ISO 27002. ISO 27002 can help the organization to achieve ISO 27001 certif...

I was one of the first takers for the exam, though I did not qualify for the fifty percent discount by a day. Took the exam in early November and it was quite an experience considering the fact there is very little information available as to the content and nature of the exam. With the experience of having taken the PMP exam, comes in handy as the jargon used in the exam is very much in line with the PMI-PMP speak. It is imperative to note that though the exam was very much in line with the draft documentation on the Risk Management Process thats been published, it had a few elements of surprise as well. As a risk manager, having been accustomed to taking risk in the negative connotation, it needs to be noted that RISK is considered positive as well as negative. This being the rule of the thumb, it facilitates in understanding the questions properly and to subsequently answer them. The approach that I took to address the examination was to ensure that I run through the glossary from ...