ISO17799 Toolkit - Worth the Price?

I'm considering buying the ISO17799 toolkit being sold by
iso17799-made-easy.com. Is there anyone out there who
has purchased the toolkit and would care to comment on
the quality of the materials included?

TIA

Jim Garrison

Jim Garrison

Jim Garrison wrote:
> I'm considering buying the ISO17799 toolkit being sold by
> iso17799-made-easy.com. Is there anyone out there who
> has purchased the toolkit and would care to comment on
> the quality of the materials included?
>
> TIA
>
> Jim Garrison
>

I don't know, I have mixed feelings about to be honest with you. It
saves a bit of time, comes with proforma templates for doing all the
basic record collection and asset tracking etc.

The implementation guide that comes with it is probably the most
valuable thing in there, is it worth $1000 I'd say not, is it worth $500
probably. YMMV of course. It helped, but not all that much.

Martin

By "implementation guide" are you referring to the BS7799 document?

Were the predefined policy templates of any use?

Can you enumerate the contents of the toolkit (without violating
copyrights

Martin wrote:
>
> I don't know, I have mixed feelings about to be honest with you. It
> saves a bit of time, comes with proforma templates for doing all the
> basic record collection and asset tracking etc.
>
> The implementation guide that comes with it is probably the most
> valuable thing in there, is it worth $1000 I'd say not, is it worth $500
> probably. YMMV of course. It helped, but not all that much.

Jim Garrison

Jim Garrison wrote:
> By "implementation guide" are you referring to the BS7799 document?

Bearing in mind I'm not at that company anymore and this is from memory
of a couple of years ago...

It comes with a copy of 7799 and also an implementation guide which is
supposed to give best practice guidlines for implementing 7799. To be
honest with you it would have more than doubled my IT budget for a year
implementing their full guidlines.

In the end use it as part of the risk assessment to justify why you're
not putting in place the full guides. They are guides, you don't have to
follow them, but I suppose the auditors would want to know why you're
not so it's usefull for that.

There's a whole bunch of check-sheets for ticking off that each clause
in 7799 has been addressed and where it's addressed in the documentation

> Were the predefined policy templates of any use?

They are very general (as you'd expect) and by the time they had been
customized for the company it would probably have been quicker just to
do them from scratch. It's a jump start I suppose.

> Can you enumerate the contents of the toolkit (without violating
> copyrights

ok, you get a copy of 17799, the implemetation guide, templates to send
round all your managers to record all their data and processing assets,
templated to go through and do a FMEACA, templates to fill in for risk
mitigation and a whole bunch of other stuff i've forgotton.

The templates for asset recording, risk assessment and mitigation were
usefull. It gives the managers a chance to see what they have, how they
use it, and why IT costs so much It also concentrates their minds
about that little database that is ever so usefull but only kept on old
Joe's machine because it doesn't work over the network and they haven't
told IT about it yet.

For most of the work I went through the Baseline Protection Model which
I found covered everything in 7799 including the extras in the $1000 pack.

Only trouble is their templates are only in German - reasonable I
suppose seeing as they are a German certification authority.

http://www.bsi.bund.de/english/index.htm
http://www.bsi.bund.de/gshb/english/...tenmodell.html

I think this is superb, or maybe it just fits better with the way I think.



> Martin wrote:
>
>>
>> I don't know, I have mixed feelings about to be honest with you. It
>> saves a bit of time, comes with proforma templates for doing all the
>> basic record collection and asset tracking etc.
>>
>> The implementation guide that comes with it is probably the most
>> valuable thing in there, is it worth $1000 I'd say not, is it worth
>> $500 probably. YMMV of course. It helped, but not all that much.

Martin