Steps to implement ISO 27001
- Context Setting
- Risk Assessment
- Gap Assessment
- Documentation
- Implementation
- Internal Audit
- Certification & Closure
Context Setting
What activities you should follow:
- Planning
- Scoping
- Organizational Context Study
- ISMS Objectives Definition
- ISMS Organizational definition
These activities should deliver the following:
- Project Plan
- ISMS scope
- Organizational Context
- Objectives
- ISMS Org Structure
The below templates can be used for documentation purposes:
Risk Assessment
- Risk is the ‘effect of uncertainty on objectives’
- Risk management involves identifying risks; analyzing, evaluating and treating them; and monitoring & measuring them in order to control and minimize their impact
- ‘Risk Owners’ their own the risks in functional areas, and need to apply management principles to address risk and mitigate those risks
Threats, Vulnerabilities & Risks
Threat: A potential cause of an unwanted Incident, which may result in harm to a System or Organization
Vulnerability: A vulnerability is a weakness of an asset or control that could potentially be exploited by one or more threats.
Risk: A combination of the probability of an Event and its Consequence
Risk Assessment is the total sum of
- Asset Assessment & Valuation
- ThreatAssessment & Valuation
- Vulnerability Assessment
Risk Analysis: A systematic use of information to identify sources and to estimate the Risk
Types of Risk Analysis – Quantitative & Qualitative
The below templates can be used for documentation purposes:
Gap Assessment
- Assessment Planning
- Gap Assessment vis-a-vis ISO 27001:2022
- Documents Audit
- Practice Audit
- Reporting & Presentation
- Gap Assessment plan (.ppt/.doc)
- Gap Assessment Report (.ppt/.doc)
Documentation
Development of applicable documents like Policies, Procedures, Templates and Manuals.
Implementation
What activities you should follow:
- R&R Assignment
- Role Based Trainings
- RTP Implementation
- Go-Live
- Performance Monitoring of performance
- Regular mentoring
These activities should deliver the following:
- Role Based Trainings
- Go Live of the ISMS
Internal Audit
- Planning
- Audit Team Training
- Documents & Practice Audits
- Management Reporting
- Corrective & Preventive actions planning
- Actions closure coordination
The below templates can be used for documentation purposes:
Certification and Closure
- Coordination of External Audit by an RCB
- Corrective actions planning for identified non-conformances
- Achievement of certification
- Closure
Discover more from Information Security Blogs
Subscribe to get the latest posts sent to your email.
