{"id":91242,"date":"2020-08-10T13:42:09","date_gmt":"2020-08-10T11:42:09","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/5-stadij-neizbezhnosti-prinyatiya-iso-iec-27001-sertifikaczii-depressiya"},"modified":"2020-08-10T13:42:09","modified_gmt":"2020-08-10T11:42:09","slug":"5-stadij-neizbezhnosti-prinyatiya-iso-iec-27001-sertifikaczii-depressiya","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/administrirovanie\/5-stadij-neizbezhnosti-prinyatiya-iso-iec-27001-sertifikaczii-depressiya","title":{"rendered":"5 faser af den uundg\u00e5elige accept af ISO\/IEC 27001 certificering. Depression","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Den fjerde fase af den f\u00f8lelsesm\u00e6ssige reaktion p\u00e5 forandringer er depression. I denne artikel vil vi dele vores erfaring med at gennemg\u00e5 den mest langvarige og ubehagelige fase \u2013 \u00e6ndringerne i virksomhedens forretningsprocesser med henblik p\u00e5 at opn\u00e5 overensstemmelse med ISO 27001-standarden.<\/p>\n

\"5
\n<\/p>\n

Forventning<\/b><\/h2>\n

\nDet f\u00f8rste sp\u00f8rgsm\u00e5l, vi stillede os selv efter valg af certificeringsorgan og konsulent, var \u2013 hvor lang tid vil vi reelt have brug for til alle n\u00f8dvendige \u00e6ndringer?<\/p>\n

Den oprindelige handlingsplan var lagt s\u00e5dan, at vi skulle n\u00e5 det p\u00e5 3 m\u00e5neder.<\/p>\n

\"5
\n
\n<\/a><\/noindex>Alt s\u00e5 simpelt ud: det var n\u00f8dvendigt at skrive et par dusin politikker og lave nogle sm\u00e5 \u00e6ndringer i vores interne processer; derefter tr\u00e6ne kollegerne i \u00e6ndringerne og vente yderligere 3 m\u00e5neder (for at sikre 'optegnelser', det vil sige beviser for politikernes funktion). Det s\u00e5 ud til, at det var det \u2013 og certifikatet ville v\u00e6re i vores h\u00e6nder.<\/p>\n

Desuden havde vi ikke t\u00e6nkt os at skrive politikkerne fra bunden \u2013 vi havde en konsulent, som skulle \u2013 som vi troede \u2013 give os alle de 'korrekte' skabeloner.<\/p><\/blockquote>\n

Som f\u00f8lge af disse overvejelser planlagde vi 3 dage til forberedelse af hver politik. <\/p>\n

De tekniske \u00e6ndringer virkede heller ikke skr\u00e6mmende: det var n\u00f8dvendigt at konfigurere opsamling og opbevaring af h\u00e6ndelser, kontrollere om backup'en overholdt den politik, vi havde skrevet, opgradere, hvor det var n\u00f8dvendigt, kontorerne i SKUDom og lidt af hvert andet.
\nTeamet, der forberedte alt n\u00f8dvendigt til certificeringen, bestod af to personer. Vi planlagde, at de ville arbejde med implementeringen parallelt med deres prim\u00e6re opgaver, og at hver is\u00e6r ville bruge maksimalt 1,5-2 timer om dagen.
\nSammenfattende kan man sige, at vores syn p\u00e5 den kommende arbejdsbyrde var ret optimistisk. <\/p>\n

Virkelighed<\/b><\/h2>\n

\nI virkeligheden var alt naturligvis anderledes: de skabeloner til politikker, der blev givet af konsulenten, viste sig for det meste at v\u00e6re uanvendelige for vores virksomhed; der var n\u00e6sten ingen klar information p\u00e5 internettet om, hvad og hvordan man skulle g\u00f8re. Som I kan forst\u00e5, fejlede planen 'at skrive en politik p\u00e5 3 dage' kolossalt. S\u00e5ledes begyndte vi at miste tidsplanen n\u00e6sten fra projektets begyndelse, og stemningen begyndte langsomt at dale. <\/p>\n

\"5
\n
\nTeam expertise was catastrophically lacking \u2013 so much so that there weren't even enough questions to ask the consultant (who, by the way, did not show much initiative). Progress became even slower, as three months after the implementation started (i.e., by the time everything should have been ready), one of the two key participants left the team. A new head of the IT department was appointed, who had to complete the implementation process quickly and ensure the information security management system was technically equipped as needed. The task seemed complex\u2026 The responsible individuals began to fall into depression.<\/p>\n

Moreover, the technical side of the issue also turned out to have \u2018nuances\u2019. We faced the challenge of a global modernization of software both on workstations and on server equipment. During the system configuration for event (log) collection, it became clear that we lacked the hardware resources for the system to function properly. Additionally, the backup software also required modernization.<\/p>\n

Spoiler: Ultimately, the ISMS was heroically implemented in 6 months. And surprisingly, no one died! <\/p><\/blockquote>\n

<\/p>\n

What has changed the most?<\/b><\/h2>\n

\nUndoubtedly, during the implementation of the standard in the company\u2019s processes, a significant number of small changes occurred. We have highlighted the most significant changes for you:<\/p>\n