ISO 27001 is an industry standard that specifies the best practices for an ISMS (Information Security Management System). The standard approaches information security from a risk-based perspective. This necessitates organisations identifying information security threats and implementing suitable procedures to mitigate them.
The recommended practice strategy to information security management system in the standard assists organizations in managing their information security by taking into account people, processes, and technology.
Accreditation to the ISO 27001 standard is recognised globally as proof that company ISMS adheres to best practices in information security.
ISO 27001 is a framework that assists organisations in establishing, implementing, operating, monitoring, auditing, maintaining, and continually improving an ISMS. This is part of the ISO 27000 set of information security standards.
What is ISMS
An information security management system (ISMS) is a comprehensive strategy to ensuring the confidentiality, integrity, and availability (CIA) of company information. An ISO 27001 ISMS is made up of policies, procedures, and other controls that have an impact on people, processes, and technology. An ISMS is an effective, uncertainty, and innovation strategy to secure corporate information assets that is based on frequent information security risk assessments. The Cetbix ISO27001 ISMS SaaS offers all of the pre-written policies, procedures, and templates you'll need to develop an ISO 27001 information security management system.
The cornerstone of an ISO/IEC ISMS is risk management. Regular information security risk assessments are used in all ISMS initiatives to identify which security measures to adopt and maintain. Section 6.1.2 of the Standard provides the standards for the risk management process, including risk assessment and risk treatment.
ISO 27001 is one of the most widely used information security standards. Certification to the Standard by an independent qualified body is recognized internationally. Implementing the Standard assists organizations in meeting information security obligations imposed by regulations such as the EU GDPR (General Data Protection Regulation) and the NIS (Network and Information Systems) Regulations to aids in preventing data breaches.
ISO 27001 adheres to Annex SL, which provides a unified high-level framework that facilitates the implementation of integrated management systems that comply with different standards.
ISO/IEC 27701:2019 (ISO 27701) is a supplement to ISO 27001 that adds data protection management and handling of personal data/PII (personal information) to the list of requirements. You can meet the GDPR standards for the retention, processing and protection of personal data by implementing an integrated management system (IMS) that combines an ISMS with an ISO 27701-compliant PIMS (Privacy Information Management System).
The ISO 27000 set of information security management standards constitutes a set of complementary and supportive information security standards that can be incorporated to provide an internationally accepted framework for information security management according to best practice. The basis of the series of standards is the ISO 27001 standard, which sets out the requirements for an ISMS (information security management system).
The ISO 27000 set of standards covers a wide range of topics and is relevant to organisations of all sizes and in all industries. As technology advances, new standards are produced to accommodate the changing needs of information security in various businesses and situations.
Contact us and we'll walk you through the ISO 27001 standard, its advantages, and what it can entail for you and your organization's information security utilizing the Cetbix ISMS ISO 27001 SaaS.
We clarify what ISO 27001 involves in order to help you decide whether it is appropriate for your firm, whether you are searching for a solution to increase your company's cybersecurity posture, or whether you need assistance putting up an information security management system (ISMS).
We address information security management and the benefits of ISO 27001, such as operational security, asset management, personnel security, security controls, access control, increased customer confidence and risk exposure.
You require an ISMS that will function both today and as your company expands.
The Cetbix ISO ISMS comes with tools, frameworks and documentation that you can integrate, customise or extend. The Cetbix approach to quality assurance is straightforward. Designed to ensure certification on the first attempt. 100% success rate.
First get the support of your top management. They must demonstrate their commitment and determination to implement an ISO27001 information security management system in your organisation. No information security initiative can be successful without commitment from top management.
To demonstrate commitment to the development and implementation of an ISMS and to continuously improve its effectiveness, top management should:
Top management should appoint an Information Security Management Representative (ISMR) as the project leader to plan and oversee the implementation, and a supporting team that includes representatives from all corporate functions that fall within the scope.
The 'Information Security Management Representative' must become an expert in and committed to ISO27001, have the necessary attributes and authority to lead the implementation team and, if you choose to pursue third-party certification, represent your organisation to the certifier. The ISMR should:
ISO 27001 requires that the ISMR has a clear responsibility for:
It is important to inform all affected employees as early as possible that you are planning to implement an ISO 27001 ISMS. You need to explain the concept of ISO 27001 and how it will affect all employees to get them to adopt and support it.
Training programmes should be structured for different categories of staff - senior managers, mid-level managers, supervisors and employees. These training programmes should cover.
In addition, initial training on topics such as process mapping may also be required.
Top management needs to determine the scope of your ISMS implementation so that it matches the scope of the information the ISMS is designed to protect. It can be difficult to get the scope right for your purposes, so let's go into a little detail.
It doesn't matter how or where this information is stored, you want to protect this information no matter where, how or by whom it is accessed.
So if you have mobile devices, for example, even if they don't contain sensitive information, they fall within the scope if they can remotely access secure information stored on your network.
When you get certified, the auditor checks that all the elements of the ISMS are working well within your scope, he does not check the departments or systems that are not included in your scope.
Basically, ISO 27001 states that you must do the following when defining your scope:
Although it is not required by the standard, it is often helpful to include a brief description of your location (you could use floor plans to describe the site) and organisational units (e.g. organisation charts) in your documented scope.
To best visualise this, draw your processes (all business processes, not just security or IT processes) that are included in your ISMS scope, and then outside that circle, draw the processes that are provided from outside your scope.
Once you know the dependencies, you need to identify the interfaces. Once you have identified the interfaces and their inputs/outputs, you can include them in the scope if they have an impact on information security.
The first major task of the ISMR is to conduct a comparison of your existing ISMS with the requirements of the ISO27001 standard. This is often referred to as "gap assessment" and should determine:
This can be done using the Cetbix ISO27005 questionnaires or the BSI questionnaires on your ISMS dashboard under "Situational".
ISO/IEC 27005 deals exclusively with information security risk management. It describes the procedures for conducting an information security risk assessment in accordance with ISO 27001. The ISO 27005 guidelines are a subset of a broader set of best practices for preventing data breaches in your organisation. The specification provides guidance for formally identifying, assessing, evaluating and addressing information security vulnerabilities - procedures that are central to an ISO27k Information Security Management System (ISMS). Its aim is to ensure that organisations rationally plan, execute, administer, monitor and manage their information security controls and other arrangements related to their information security risks. Like the other standards in the series,
ISO 27005 does not set out a clear path to compliance. It merely recommends best practices that can be incorporated into any standard ISMS. The other alternative to the ISO27005 risk assessment is the BSI questionnaire.
Cetbix ISO ISMS also offers the option for organisations to enter their own questionnaires into the platform without using ISO27005. This option can be achieved by activating "Self Assessment" under "User Dashboard".
At this phase, you need to start determining your assets. While this step isn't absolutely necessary, it is often useful, in that you will better understand the task ahead and better able to predict timescales, to do an initial scan of assets and their associated risks before drawing up a detailed implementation plan.
Guided by the included Appendix A Controls 'Asset Management Controls' document, carry out an initial fist scan of information assets:
Firstly, list out those information processing facilities that are used by more than one department, such as:
All these assets can be inventoried using the Cetbix Asset Inventory on your dashboard.
Then look at information assets within each department (both electronic and hardcopy), such as:
All these assets can be inventoried using the Cetbix Asset Inventory on your dashboard.
ISO 27001 sets out the process you should adopt to identify, analyse, evaluate and treat the risks to your information assets: Guided by the Control of Risks and Opportunities Procedure, conduct an initial risk assessment for each functional area to:
If the same risk applies to more than one area, you may put them together when treating the risk.
In addition to the simple risk assessment approach that we have included, there are plenty of mature, risk management frameworks, such as : ISO/IEC 27005, ISO 31000, NIST SP800-37 (RMF)
Risks arise from your existing assets, so consider;
All this is assessed on the Cetbix asset inventory on your dashboard - when you click on an asset, you are taken to the "audit page"
In your considerations:
Considering the list of identified risks, go through the control checklist (based on Annex A of the standard) and identify the control objectives and controls that are applicable and why, and also record those that you think are not applicable and why. 'Cetbix will automatically generate your SOA report for you. To create your SOA in Cetbix, follow these steps.
Review the findings of the initial risk assessment and prepare an initial risk treatment plan. Remember, only risk owners can accept risks and their treatment! Cetbix automatically generates your RTP report for you. Other reports such as Risk Register, Asset Register and other reports are generated automatically on Cetbix.
At this stage 7, you have been able to verify both issues in your ISO27005 assessment and your "Assets" assessment. That was your gap assessment phase. Now you should have a clear picture of how your existing ISMS compares with the ISO 27001 standard.
A detailed implementation plan should then be developed that identifies and describes the tasks required to make your ISMS fully compliant with the standard. This plan needs to be both thorough and specific, including the:
Cetbix automatically generates your implementation plan for you if you have already activated that feature. You could also use your own local system to get this done.
The time required to get from a decision to implement to final certification depends on many factors. It is essential that the plan is neither rushed, nor so slow that energy and momentum are lost. You need a high-level implementation action plan, for a modest implementation.
Congratulations - with the acquisition of the Cetbix licence, you will be provided with all documents and forms digitally and manually, which will be much easier than it would have been otherwise!
The newly documented ISMS is now ready to be implemented throughout your organisation. Management and staff should be trained in the new or revised work processes, procedures and record keeping as set out in the ISMS.
ISO 27001 requires that you periodically perform an internal audit to evaluate the effectiveness of your ISMS and check that it complies both with ISO 27001 requirements and your organisation's documented work practices.
An audit is a 'systematic, independent and documented process for obtaining audit evidence and evaluating it objectively to determine the extent to which audit criteria are fulfilled'
Internal audits help with the implementation of your ISMS and a complete internal audit is also required before you can pass your certification audit.
Your internal audit program should be planned taking into consideration the status and importance of the different processes making up your operations.
At least two of your employees will need to be trained as internal auditors. Internal auditors should be able to be objective and impartial and may not audit their own work.
Management reviews are conducted to ensure the continuing suitability, adequacy and effectiveness of your ISMS. The review should include assessing opportunities for improvement and the need for changes to the ISMS, including the information security policy and objectives. Management Reviews should consider all aspects of the performance of the ISMS, including:
It is useful to hold management reviews fairly frequently once the ISMS becomes operative and to only lengthen the periods between each review once you are confident the ISMS is operating satisfactorily as confirmed by both internal and external audits.
A certification body is an independent organisation that is officially accredited to issue ISMS certifications. If you intend going for certification, It is advisable to select a certification body that is suited to your organisation relatively early in your implementation program. The certifier will audit your company's ISMS and, if the audit is successful, issue a certificate confirming that your ISMS meets the requirements of ISO 27001:2022.
When choosing a certification body to carry out your ISO 27001 certification audit, consider the following:
can they provide reference sites?
ISMS motto: 'the less you {own, do, manage, keep...}, the easier to comply!'
KISS
Statement of Applicability (SoA)
When your ISMS has been in operation for a few months and has stabilised, you can schedule an initial 'Pre-Assessment' certification audit to be undertaken by your selected certification body.
Your selected certification body will first carry out an audit of your documentation and then, if your documents meet the requirements of the standard, the certifier will visit your facility and perform a pre-assessment audit to ensure all applicable ISO 27001 requirements have been met.
Following your pre-assessment audit, you need to review the results and take any necessary corrective actions to correct any non-conformances (activities that are not in compliance with the requirements of the standard and/or your own documented work practices) flagged by the certification auditors during the pre-assessment audit.
One you are satisfied that all non-conformances flagged during your pre-assessment have been addressed, ask your selected certifier to perform a full certification audit to ensure all applicable ISO 27001 requirements have been met.
Following the successful completion of a full certification audit you will be awarded an ISO 27001 Certificate, generally for a period of three years. During this three‐year period, your certification body will carry out periodic surveillance audits to ensure that the system is continuing to operate satisfactorily.
Certification to ISO 27001 is not the end of the story. As required by the standard, you should continually seek to improve the effectiveness and suitability of your ISMS through the use of your:
Cetbix helps you to create and maintain the accompanying reports and records to demonstrate your compliance with the standard. Your certification body will probably need to see each report:
Cetbix has all the documentation you need for your ISO27001 certification and other compliance issues.
Audits should be performed using a “Process Approach” where they do more than check whether people “are following their procedures / work instructions”. Each process making up your ISMS must be scheduled for audit.
Clause 9.2 of ISO 27001:2013 sets out the objectives for your internal auditing:
“The organisation must conduct internal audits at planned intervals to provide information on whether the environmental management system:
Information security is a particularly dynamic field with frequent changes to the risks (i.e. the threats, vulnerabilities and/or impacts), controls and environment. It is therefore important that auditors auditing information security controls should maintain knowledge of the state of the art (e.g. emerging information security threats and currently-exploited vulnerabilities) and the organisational situation (e.g. changing business processes and relationships, technology changes).
A risk-based internal audit approach allows the internal audit to concentrate on reviewing all significant risks to your organisation so as to ensure that they are well controlled.
Ratings range from “compliant” to “major non-conformance” to convey a concise and consistent method for rating each audit finding.
Auditing has two, related, key objectives:
To achieve these objectives, it is necessary to adhere to the following principles, if the conclusions derived from the audit are to be accurate, objective and sufficient.
Just like the internal audit process required by ISO 9001 and other management standards, the main steps required for an ISO 27001 audit are to plan, perform, and follow up on internal audits for the processes. This methodology of internal audit works equally well when applied to the ISO 27001 environmental management system (ISMS), but the focus is slightly different.
Just as with any good internal audit process for any management system, the first important thing is to have an overall schedule of when you are planning to audit each process that will be audited for system conformance. The cycle for this is often a year, but can be whatever you like, and the frequency of audits on any given process is linked to criteria like the information security importance of the process and past audit conformance. If you have a process that has critical information security aspects associated with it, you may want to look at this process more often than one that can have only minor impact on the environment. The audit schedule should be available to employees and managers, because you don’t want to have surprise audits.
Review of the process is critical for this – in particular, understanding the information security risks associated with the process.
As part of the process approach, process audits must be scheduled in accordance with your ISMS.
The audit should be based on a three stage process:
Thorough preparation is essential to an efficient and accurate audit!
Gather all relevant documents and records for the process you are auditing and review these documents thoroughly, and mark what you plan to audit. By marking directly on the documents, they become audit records.
Also, review relevant sections of the ISO standard. Your organisation’s documents may not include all the ISO requirements, and this is how you would discover that. If certain information is not available, it may become an audit finding, even during the preparation stage.
Remember that in performing the audit is that you are not using the internal audit to judge the legal compliance of the process.
ISO requires that this information is defined and documented. Often this is routine information, but when there are exclusions or unique situations, it can be significant.
Verify that previous corrective actions remain effective. Past areas of concern may yield more opportunities for improvement or may require re-auditing.
Identify those sections in the applicable ISO Standard that are relevant to the process. Print those pages and mark significant requirements to ensure they are documented correctly within the ISMS, and that they get audited.
Skill requirements should be documented. Review skill lists for the process being audited. Are there clear lists of skills, with sufficient detail, for each position? This is a common failure where lists are generic and the detail is inadequate. Training is a key process of any system. Are there specific people or new members of staff that you wish to review? Are there particular skills you wish to evaluate? Identify the names of those you wish to review later.
Prepare these documents and audit materials carefully as it is faster and easier to audit if you have well organised and marked up information at hand. A well prepared auditor is a confident and authoritative auditor. Using the documented information in this way ensures they become audit records.
Use your preparatory work to develop an audit checklist for use in the future.
An audit checklist is just one of the various tools available to help ensure that your audits address the necessary requirements. The checklist creates a basic reference point before, during and after the audit process and provides the following benefits:
Your organisation’s documented information may not cover all of the requirements that may be relevant to the process. If certain information is not available, it may become your first audit finding, not bad for the pre-audit review!
Probably the first thing to remember about performing the ISMS audit is that you are not using the internal audit to judge the legal compliance of the process. While a compliance audit is a good idea, and sometimes a legal requirement, this is not the goal of the internal audit programme. The internal audit is looking at the process in the context of the information security controls that the company identified for the process.
Technical compliance tests may be necessary to verify that IT systems are configured in accordance with the organisation’s information security policies, standards and guidelines. Automated configuration checking and vulnerability assessment tools may speed up the rate at which technical compliance checks are performed but potentially introduce their own security issues that need to be taken into account*.
Mark findings and issues as you go. When you finish auditing, you should have a collection of various findings to review. Organise the notes you made, these findings need to be reported to management. As you audited, you should have noted the issues and potential improvements you observed. These should have been marked clearly so you are now able to quickly review and capture them as you write the report. When you have completed the audit, you will usually have “findings”. Findings can be both problems and opportunities for improvement. Review your notes and collect the findings into the audit report. Audit teams should review findings with the lead auditor and/or management representative as it important to calibrate the findings and the review also acts a learning process. If there is disagreement over some findings, the Lead Auditor has the final vote!
A good summary report is the output which is the value of the audit. It deserves an appropriate amount of attention and effort. Your summary report should describe findings objectively, provide objective evidence to support the findings, and determine whether they should be classified as Corrective Actions, Preventive Actions, or Opportunities for Improvement.
Too often, the audit report only recites back facts and data the managers already know. The value is in identifying issues and opportunities they don’t know! This summary should be reviewed first with the Lead Auditor, then the Process Owner and Management Team. Make final revisions, and file the final audit report and all supporting audit materials and notes.