Appendix A: ISMS Assessment

896 Words4 Pages
Experience shows that people have little tolerance for extensive question sets for either in-person questioning or by way of survey. A more successful approach is to develop an interview process for an assessor (e.g., security professional) to discuss security issues with the appropriate person with knowledge of that particular area. The interview process discerns all the details of the question set without necessarily asking each and every question. In support of this interview process, consider the following interview guide to engage people in discussions about security in a conversational manner. This conversational manner obtains better cooperation than clinically going through each individual question. The interview guide aligns with the full discovery question set and permits the assessor to engage the interviewees in conversation. As key points are covered, the assessor may mark down cues to responses. The assessor may then complete the full question set on his or her own. This may seem somewhat labor intensive on the part of the…show more content…
If so, does X contain features Y1, Y2, Yn? As an assessor, ask open-ended questions to the effect of does your organization have a security policy? Tell me about it. As the conversation entails, prompt for additional detail not covered by the initial description. Check off key points as they are covered by noting a "Y" for yes, this feature is present, or, "N" for no, this feature is missing. Other useful notations may be "U" for unknown by this interviewee or "NA" for not applicable. Also, as an assessor, note a confidence level in the interviewee's response. If the interviewee conveys himself or herself as an unreliable source, by all means be polite and attentive, but note a low confidence in the details. Sometimes taking information at face value leads to
Open Document