ISRA & Office Security Assessment
Conducting an ISRA is essential for managing your organization’s security, privacy, and quality risks. This process ensures that appropriate security measures are implemented to protect the confidentiality, integrity, and availability of information.
Key reasons for performing an ISRA:
- An ISRA helps uncover weaknesses in systems, processes, or controls that could be exploited, enabling proactive mitigation.
- Understanding the consequences of security breaches on operations, reputation, and finances allows organizations to prioritize risks effectively.
- Regular risk assessments ensure adherence to legal, regulatory, and contractual obligations, avoiding penalties and legal issues.
At Compleye, we integrate our risk assessments into a Continuous Improvement Cycle, connecting them with improvements and management reviews. This approach ensures that your framework remains dynamic and responsive to emerging threats. This iterative process not only addresses current vulnerabilities but also fosters a culture of proactive risk management and operational excellence.
Recognizing that assessment approaches can vary and may be subject to individual interpretation, Compleye has developed a validated ISRA template, which can be accessed in the Compleye Online Templates Section. This template, vetted by external auditors from various audit firms, includes both the risk assessment and the ISRA procedure.
In addition, the ISRA template includes the Statement of Applicability (SOA), which should also be completed by reviewing the controls and marking them as applicable or not, and providing justification. This is an important step, as the SOA will be shared with external auditors and customers upon request. The reason for maintaining the SOA within the ISRA as an embedded document is that the Annex A controls are linked to the risks assessed by ISRA as preventive measures. Therefore, it is practical to keep them together. You can easily extract the document whenever necessary and ensure it remains a valid reference
Approach to Performing ISRA:
Step 1: Component-Based Assessment: Conducting an ISRA for each component identified in your X-Ray analysis is advisable, as each may present unique risks requiring tailored mitigation strategies. Different components can involve distinct stakeholders and necessitate diverse approaches. However, merging components with similar risks and purposes is acceptable, provided there is reasonable justification and effective risk management. Not all suggested risks will apply to every component; therefore, applying certain risks or merging components is permissible, as long as compliance standards are met.
Step 2: Team Involvement: Initially, involve all relevant team members in the ISRA process to ensure an understanding of procedures and outcomes.
Step 3 Iterative Process: Recognize that conducting an ISRA is a complex task that may require multiple sessions and the involvement of various stakeholders. Do not be discouraged if the assessment extends over several meetings.
Step 4: Objective of ISRA: The primary goal of the ISRA is to evaluate potential risks, assess existing controls, and identify measures to mitigate these risks effectively. This process aims to derive actionable improvements, as outlined below:
Step 4: Findings Treatment: Once the ISRA has been completed and approved by C-level management, the next crucial step is to process the findings and transform them into actionable improvements. This final phase should be managed by the Compliance Officer.
To create a new ISRA in Compleye Online navigate to the ‘ISRA Section’ and click on the ‘Create New ISRA’ button located at the bottom-left corner of the page.
After uploading your ISRA document (typically an Excel file), please note that it cannot be deleted but can only be downloaded once attached. The ISRA card will be automatically named based on the upload date. If you have multiple documents, you can upload them; ensure that you upload the main document first.
After creating the ISRA, you can add findings by copying them directly from your Excel file. Additionally, you have the option to attach other relevant documents in the ‘Attachments’ tab; please note that this is not mandatory.
When adding a finding, an option to create an improvement will automatically appear in blue. It’s strongly recommended to create an improvement for each finding. Improvements become part of the Management Review process, highlighting your organization’s dedication to continuous improvement.
If you choose not to create an improvement for a finding, be prepared to justify this decision to external auditors. Perhaps you’ve already addressed the issue and provided evidence in the ‘Attachments Section’. In such cases, ensure that you reference this in the finding by adding a note like: ‘Already solved by [date]. Evidence can be found in attachment.’
When you create an improvement, a new pop-up screen will appear with the following pre-filled information:
- Finding: Automatically populated with the relevant finding details, tagged as ‘ISRA’ to indicate its origin. In this pop-up, you will need to:
- Assign an Owner: Designate the individual responsible for implementing the improvement.
- Set a Due Date: Specify the estimated date for achieving the first expected results.
Once all fields are completed, clicking the ‘Create Improvement’ button will generate a new improvement entry with a unique ID in the ‘Improvements Section’. This improvement will also be reflected in the current ‘ISRA Section’, marked as ‘Improvement has been created’. It’s important to ensure that the assigned owner has access to the board and that their email address is included in the ‘People Section@’. This ensures they receive timely notifications regarding improvement deadlines. The compliance officer should regularly review the progress of all improvements during monthly compliance meetings. Once an improvement is completed, it will be marked with a green check-box, displaying the completion date and the name of the person who closed it. Before starting a new ISRA, verify that the findings from previous assessments have been addressed and marked as closed.
After completing all required fields, clicking the ‘Create Improvement‘ button will automatically generate a new improvement entry with a unique ID in the ‘Improvements Section’. This improvement will also appear in the current ‘ISRA Section’, marked as ‘Improvement has been created’.
Once an improvement is completed, it will be marked with a green check-box, along with the completion date and the name of the person who closed it. It’s essential to review and ensure that all previous findings have been addressed during each new ISRA, therefore, before conducting a new ISRA, verify that all findings from the previous assessment have corresponding closed improvements.
Secure areas are a fundamental component in safeguarding an organization’s physical and informational assets. The need for secure areas arises from the critical requirement to protect sensitive data, intellectual property, and other valuable resources from potential threats that could compromise confidentiality, integrity, or availability of your information and data.
The Office Security Assessment serves as an assessment template to evaluate the security measures in place within your office environments on an annual basis. By regularly assessing the secure areas, your organization can identify potential vulnerabilities, address gaps, and ensure that both physical and information security protocols are continuously maintained and improved.
The goal is to create a secure environment where assets are protected against potential risks, ensuring the ongoing trust of employees, clients, and stakeholders.
The Office Security Assessment should be conducted annually, focusing on various key aspects of office security to ensure the protection of both physical and informational assets. The Office Assessment Template can be accessed in the Compleye Online Templates Section.
Assessment Process
Step 1: Assessment Date: Record the date the assessment is performed. This is crucial as the assessment should be carried out annually, or whenever significant changes are made to office arrangements or security measures.
Step 2: Performed By: Document the name(s) of the individual(s) conducting the assessment. Typically, this assessment is carried out by the Information Security Officer or any person with knowledge or expertise in office security protocols.
Step 3: Approved By: Include the name(s) of the person(s) who have reviewed and approved the findings and recommendations. The assessment and its findings should be formally approved by C-level management to ensure that necessary actions are taken.
Step 4: Upload the Document: After completing the assessment, upload the document to Compleye Online as a separate entry in the ‘ISRA Section’. Ensure that all findings are fully documented and then the improvements created, following the instructions provided for the ‘ISRA Section’. Use a separate table for each office facility to evaluate its security measures individually.
Additional Tips on how to Perform the Office Security Assessment:
Start by assessing the layout of the office. Identify all shared spaces (e.g., open workspaces, meeting rooms, kitchens) and private spaces (e.g., offices, server rooms, storage areas), check:
- Is there clear separation between shared and private areas to limit unauthorized access?
- Are security measures in place to protect private or sensitive areas (e.g., locked offices, restricted access to sensitive areas)?
Inspect all physical security measures in place, such as locks, key control, and CCTV monitoring systems. Check if access control systems are functioning and properly restricted. Check:
- Are locks in good condition? Is there a system in place for managing and tracking keys?
- Are CCTV cameras positioned in strategic areas (entrances, exits, sensitive locations)?
- Is there a centralized location for monitoring security footage?
- Are there access control systems (e.g., swipe cards, biometric scanners) for securing entrances?
Check the visitor management process and verify that rules are being enforced. Assess if visitors are properly logged, escorted, and given limited access to restricted areas. Check:
- Are visitor logs maintained, and is there a system to track the duration of their visit?
- Are visitors escorted or monitored during their time in the office?
- Are visitor badges or identification issued and displayed clearly?
- Are visitor entry points clearly designated, and is access to sensitive areas restricted?
If your office has a loading/unloading area, evaluate its security. This is often an entry point for unauthorized individuals or goods. Check:
- Is the loading area secure and restricted to authorized personnel only?
- Are deliveries checked and logged upon arrival?
- Are there security measures (e.g., CCTV, restricted entry) in place to monitor this areas.
Assess the security of the network infrastructure, including network cables and Wi-Fi access points. These are potential entry points for cyber threats. Check
- Are network cables securely hidden or protected from unauthorized access?
- Is the Wi-Fi network secured with encryption and are strong passwords used?
- Are access points (Wi-Fi routers) located in secure, restricted areas to prevent unauthorized acces
Evaluate the effectiveness of alarm systems and check whether regular emergency drills are conducted. Check:
- Are alarm systems tested regularly, and are employees familiar with emergency procedures?
- Are alarms connected to a monitoring service or internal team?
- Are emergency evacuation procedures clearly displayed, and is there signage for exits?
Assess if the office is prepared for environmental threats such as fire, flooding, or power outages. Check:
- Are fire alarms and extinguishers in place and regularly checked?
- Are emergency exits clearly marked and accessible?
Ensure that contact details for the emergency manager or person responsible for office security are easily accessible. Check:
- Are emergency contact numbers (e.g., Security Manager, Facilities Manager) posted in visible locations (e.g., near phones, emergency exits)?
- Are emergency contact details kept up-to-date and accessible to all employees?
- In the event of an emergency, is there a clear escalation procedure to ensure timely response?
