Wednesday, December 04 2024

G 24 IZOGOOD 27001 - Decrypt the information security standard ISO 27001 while having fun - Online game

Online game IZOGOODŽ 27001 - Decrypt, understand and assimilate the requirements of your ISO 27001 information security management system while having fun

 
$78.82
Ex. VAT
G 24 IZOGOOD 27001 - Decrypt the information security standard ISO 27001 while having fun - Online game
See other games

See the online course T 24v22 ISO 27001 Readiness

See the online course T 44v22 ISO 27001 Internal audit

See the online training package T 84v22 ISO 27001
 

WHY NOT ENRICH YOUR KNOWLEDGE OF THE ISO 27001 STANDARD WHILE HAVING FUN?

THE GAME

 
The G 24 IZOGOOD® 27001 online game is aimed at:
 
  • anyone who wants to discover the ISO 27001 standard
  • anyone who wants to improve their knowledge of the ISO 27001 standard
 
 
The IZOGOOD® 27001 online game allows you to explore the different aspects of the ISO 27001 standard through more or less difficult questions by addressing:
 
 
  • threats or opportunities by the 50 RISK cards
  • requirements of the standard by the 50 MCT (multiple choice test) cards
  • good or bad  practices by the 50 PRACTICE cards
  • case examples by the 50 CASE cards
 
Each card includes a commentary with explanations of the relevant paragraph.
 
The G 24 IZOGOOD® 27001 online game will help you gain a better understanding and in-depth knowledge about the ISO 27001 standard while having fun.
 
The clauses and main paragraphs (sub-clauses) of the ISO 27001 standard will be more understandable and the requirements easier to assimilate and apply.
 
Whatever the function of the player, his responsibility and his level of knowledge of the standard, he will deepen his discernment of the essential points of the quality management system.
 
The benefits of an online game are, among other things, to allow:
 
  • the assimilation of knowledge related to the ISO 27001 standard
  • a more homogeneous understanding of:
    • content
    • specificities and
    • requirements of the ISO 27001 standard
  • verification of achievements
  • playful learning of the standard
  • better prepare for certification or follow-up audit
 

CONDITIONS

 
You have access to the game for two months and to the annexes for one year.
 
You can play as many times as you want.
 
You can download and read the documents. You can print the annexes, it can help you.

Read more

Public

 Anyone involved in introducing, implementing, maintaining, consulting, training and improving an information security management system based on ISO 27001:

  • leader of the ISO 27001 certification project
  • director
  • information security manager
  • quality manager
  • metrology manager
  • maintenance manager
  • project manager
  • quality technician
  • IS technician
  • quality assistant
  • quality operator
  • quality manager
  • internal auditor
  • worker
  • operator
  • technician
  • consultant
  • trainer
  • adviser
  • student
Gamer's booklet

 iso 27001

 

 

 

 

GAMER’S BOOKLET

 


Table of contents

 

1. Rules of the game
2. Glossary
3. Cards

 


 
1. RULES OF THE GAME

The game is intended for one person, but nothing prevents playing in a small group, it will be much more fun.
 
The game is compatible with recent versions of web browsers. Otherwise the game can be slow.
 
A game session typically lasts between half an hour to 2 – 3 hours. You can play as many times as you like during your 60-day access and learn a lot about the ISO 27001 standard.
 
The goal of the game is to reach the final space (Finish) as quickly as possible. arrival
 
The standard's requirements and comments are on this page. A free quiz on the ISO 27001 requirements is provided at the beginning. This allows you to discover, decrypt and become familiar with the requirements of the standard.
 
Having a copy of the ISO 27001 standard at hand (not supplied with the game) is a prerequisite.
 
The board of the game is a city with a car's journey.
 
In the top left, there is a clock showing elapsed time. In the top right,  you have a help button and option to exit the game.
 
At the bottom left, there's a button to mute the sound. In the bottom enter, you can see the total stars you've earned. bleu At the bottom right, there's a button linkng to the ISO 27001 standard requirements page.
 
At the beginning, the car is parked at the Start space.  
 
Click on the "START GAME" button to begin.
 
The sequence of spaces (types of cards) is as follows:
 
  • RISK - threat or opportunity - silver
  • MCT - multiple choice test - green
  • PRACTICE - good or bad practice - orange
  • CASE – situation, challenge and solutions - blue
 
You also have special Maintenance maintenance  and Padora’s box spaces Pandora .
 
Each card type includes 50 questions, and each answer is linked to a paragraph of the ISO 27001 standard version 2022.
 
Each card is shown with the following steps:
 
  • step 1: The back of the card showing the card type, number (from 1 to 50) and the number of stars (from one to three) in blue, white and red  bleu, blanc, rouge
  • step 2: The card type, its number, the question (e.g., "Is the following statement more of a threat or an opportunity?"), the statement (e.g., "The scope of the ISMS describes the main company's activities") and the star(s)
  • step 3: The answers (one or more correct answers are possible) with a green emoji (for all correct answers) good and a red emoji (for a wrong answer) bad
  • step 4: The paragraph from the standard and a comment for the correct answer or incorrect answer
 
The car starts and arrives at the Risk space. risk
 
The card number is random. Depending on the question's difficulty, the stars are one, two or three.
 
If you guess the correct answer, the car moves forward as many spaces as there are stars on the question.
 
If you don't guess the correct answer (or answered partially) the car stalls on the same space, and the next card will be of the same type.
 
If you land on a Maintenance maintenance or a Pandora's box space Pandora , you may get lucky or unlucky. From the car's trunk or Pandora's box comes a random luck or misfortune card. If luck is on your side, you get Joker card joker, and your car moves forward 3 spaces. If misfortune strikes bad luck, your car moves back 3 spaces.
 
If a second person is with you and has printed this booklet, they can increase the game's difficulty by asking questions like:
 
  • What is the clause and sub-clause (paragraph) of the standard related to the question?
  • Can you provide an example from your department related to this question?
 
When you reach the Finish space for the first time, you can download your IZOGOOD® 27001 game participation Certificate. certificate 
 
You can also view your game results:
  • number of stars earned bleu
  • date and time each time you played date
  • time spent 
 
The educational objectives of the game are to allow each player to:
 
  • identify whether a risk is more of a threat or an opportunity
  • enhance their knowledge of the standard's requirements through multiple choice tests (MCTs)
  • guess whether a statement is a good or a bad practice
  • study each proposed case's situation, challenge, and to find the right solution (one or more correct solutions are possible)
  • decrypt the clauses and paragraphs of the standard and to assimilate the requirements
 
Some questions have a hint of humor (even if the boss forgot to say it).
Relax, it's just a game. smiley
 
A bias is inevitable regarding the “correct answers” to retain, especially for RISK or PRACTICE cards.
 
Here's an example:
 
RISK 01. Is the following statement more of a threat or an opportunity? "The most important thing is that the company's strategy was established in the past"
 
One could answer that it is a threat or an opportunity but it depends on when the strategy was defined.
 
If you answer that it is a threat, you're right because it's not specified when the previous strategy was developed (a year ago, 10 years ago). There's missing information. But you could answer that it's an opportunity because you think "in the past" means 2 to 3 years ago.
 
Thus, the presented answers and the relevance of the comments presented are debatable; in the end, the truth is sometimes relative.
 
The IZOGOOD games are created and developed with great care. Thank you in advance for communicating any potential improvement points you've identified via this link: https://www.pqbweb.eu/contact.php

 
 
2. Glossary


The beginning of wisdom is the definition of terms. Socrates

 

Some specific quality terms:

Audit: a systematic and independent survey to determine whether activities and results comply with pre-established measures and are capable of achieving the objectives

Audit evidence: demonstrably true data related to audit criteria

Concession (after production): written authorization to deliver a nonconforming product

Conformity: fulfillment of a specified requirement

Continual improvement: permanent process allowing the improvement of the global performance of the company

Corrective action: action to eliminate the causes of nonconformity or any other undesirable event and to prevent their recurrence

Customer: anyone who receives a product

Customer satisfaction: top priority objective of every quality management system related to the satisfaction of customer requirements

Document: any support allowing the treatment of information

Effectiveness: capacity to realize planned activities with minimum effort

Efficiency: financial relationship between achieved results and used resources

External provider (supplier): an entity that provides a product

Indicator: value of a parameter, associated with an objective, allowing the objective measure of its effectiveness

Inspection: the actions of measuring, testing and examining a process, product or material to establish whether requirements are met

Management review: a periodic survey carried out by top management of the management system for its continual improvement

Management system: set of processes allowing objectives to be achieved

Nonconformity: non-fulfillment of a specified requirement

Organization (company): a structure that satisfies a need

Performance: measurable and expected results of the management system

PEST: Political, Economic, Sociological, Technological. Analysis to identify the influence of external factors 

Process: activities which transform inputs into outputs

Process approach: management by the processes to better satisfy customers, improve the effectiveness of all processes and increase the global efficiency

Product (or service): every result of a process or activity

Quality: aptitude to fulfill requirements

Quality management: activities allowing the control of a company with regard to quality

Quality objective: quality related, measurable goal that must be achieved

Requirement: explicit or implicit need or expectation

Review: a survey of a file, product, process so as to verify if pre-set objectives are achieved

Risk: probability of occurrence of a threat or an opportunity 

Stakeholder: person, group or company affected by the impacts of an organization

SWOT: Strengths, Weaknesses, Opportunities, Threats. Tool for structuring a risk analysis 

Top management: group or persons in charge of the company’s control at the highest level

Traceability: the aptitude to memorize or restore all or part of a trace of executed functions

Validation: notice that the application of any process, product or material allows expected results to be achieved 

Verification: the periodic inspection survey of compliance of a process, product or material 

 

Remark 1: the use of ISO 27000 definitions is recommended. The most important thing is to determine a common and unequivocal vocabulary for everyone in the company.

Remark 2: a document can be presented as documented information ithat must be maintained (procedure procedure) or retained (record record). 

 

3. CARDS

 

Examples of the first 3 cards

 

first 3 cards

 

 

risk

RISKS

Recurring question: Is the following statement more of a threat or an opportunity?

 

RISK 01 Most important is that the organization's strategy has been established in the past

Threat

§ 4.1

 three

Every three years on average, it is necessary to check the adequacy of the strategy to the context of the organization, the expectations and the requirements of stakeholders

 

RISK 02 The context of the organization is something that can be taken into consideration (even if the boss forgot to say it)

Threat

§ 4.1

 two

This is a requirement of the standard and it is unavoidable. This is part of the first work to be done since the validation of the organization's strategy depends on it

 

RISK 03 Trying to anticipate the evolution of customer expectations is a waste of time (if the boss said so)

Threat

§ 4.2

 one

 

The objective of the organization is to satisfy its customers in the long term – to understand the evolution of their expectations is a key factor of success for the future

 

 

MCT

MCT'S (MULTIPLE CHOICE TESTS)

 

 

MCT 01 Which of the following statements is correct?

 

  1. A product can be certified ISO 27001
  2. A service can be certified ISO 27001
  3. The management system of an organization can be certified ISO 27001
  4. Any organization with more than 100 people shall be ISO 27001 certified
§ 0.1              one
 

 

A product is certified from a technical point of view according to a reference system, such as CE 023 for a medical device, for example. A service, in the sense of service delivery, cannot be ISO certified. Only the management system of an organization can be certified ISO 27001. Certification is voluntary for any organization, whatever the size

 

 

MCT 02 The first edition of ISO 27001 was published in:

 

    • 1995
    • 1996
    • 2005

Foreword     one

 

 

The 1995 saw the first version of BS 7799. 1996 saw the first version of ISO 13335
 

 

MCT 03 Confidentiality is the property of information to be (even if the boss has no opinion):

 

1. Accessible to authorized persons only

2. Usable at the right time

3. Unaltered

4. For internal use only

§ 3.10           two

In Definition of ISO 27000 version 2018. 2. Availability. 3. It's integrity. 4. It is a classification of information, see Annex A.5

 

 

Practices

PRACTICES

 

 

Recurring question: Is the following statement more a good or a bad practice?

 

 

PRACTICE 01 The diagnosis of the organization context includes the main external and internal issues (even if the boss doesn't know about it)

 

Good practice
§ 4.1   
one

 

 

To understand the context of the organization, top management must prioritize internal and external issues
 

 

PRACTICE 02 To determine the issues of the context, the analysis of the competitive environment is a priority

 

Bad practice
§ 4.1      
two
 

 

Top management must first determine internal and external issues
 

 

PRACTICE 03 The analysis of the needs and expectations of stakeholders is independent of the products and services of the organization

 

Bad practice
§ 4.2      
two

 

The organization's products and services must take into account the needs and expectations of stakeholders
 
 
 

cases

CASES

 

CASE 01 CONTEXT
 
Situation: external and internal issues influence the strategic direction and the overall performance of the organization
Challenge: how can we understand the influence of external and internal issues?
To understand the context of the organization, we must:
 
Solution 1: regularly monitor and review issues
Solution 2: determine the positive or negative influence of each issue
Solution 3: use SWOT and PEST tools
§ 4.1              three
 
All these activities are very useful for analyzing the context
 
 
CASE 02 CUSTOMERS AND NEEDS
 
Situation: for some months the organization has had stagnating sales. Nonconformities have begun to fill the prison
Challenge: what solution should be chosen to reverse the situation?
Solution 1: stand out from the competition with very low prices
Solution 2: recruit a marketing agent out of a top college
Solution 3: contact the customer and identify the problem
§ 4.2              one
 
Setting very low prices is daring but it is not a guarantee of success and can have disastrous financial consequences
A new marketing agent can bring profits but it is time consuming and requires a significant investment
Find the causes of the intolerable amount of nonconformities and quickly set up a plan of action. Then, openly discuss it with customers, as understanding their needs and expectations is a prerequisite for the recovery of the organization
 
 
CASE 03 SCOPE OF THE ISMS
 
Situation: we need to maintain the scope of the ISMS in the form of a document
Challenge: what must we do to determine the scope of the ISMS?
Solution 1: justify each non-applicable requirement in a document
Solution 2: maintain the scope of the ISMS (sites, processes, products and services) as a document
Solution 3: base the scope of the ISMS on the business context, the requirements of stakeholders and the products and services provided
§ 4.3            one  

 

 

 All these activities are useful for determining the scope of the ISMS

 

 

Certificate

 certificate