ISO 27001 Implementation

1. Familiarise yourself with ISO 27001 and ISO 27002

The ISO/IEC 27001:2022, ISO/IEC 27002:2022 and ISO 27000:2018 standards will serve as your principal points of reference. We have all the resources you need to understand the Standard and its core requirements:

Solutions 

2. Assemble a project team and initiate the project 

You will first need to appoint a project leader to manage the project . Then you can embark on an information-gathering exercise to review senior-level objectives and set information security goals. Thirdly, you should develop a project plan and project risk register.

Solutions 

3. Conduct a gap analysis

A gap analysis helps you determine which areas of the organisation aren’t compliant with ISO 27001, and what you need to do to become compliant.

Solutions 

4. Scope the ISMS 

Scoping requires you to select which information assets to ring-fence and protect. This requires thought because a scope that’s too big will escalate the time and cost of the project, and a scope that’s too small will leave vulnerabilities untreated.

Solutions 

5. Initiate high-level policy development and other key ISO 27001 documentation

Set out high-level policies for the ISMS that establish roles and responsibilities and define rules for its continual improvement (clause 10). Additionally, you need to consider how to raise ISMS project awareness through both internal and external communication (clauses 7.3 and 7.4).

Solutions 

6. Undertake a risk assessment

Risk assessments are the core of any ISMS and involve five important aspects: establishing a risk management framework, identifying, analysing and evaluating risks, and selecting risk treatment options.

The risk assessment also helps identify whether your organisation’s controls are necessary and cost-effective. 

Solutions 

7. Select and apply controls

Controls should be applied to manage or reduce risks identified in the risk assessment. ISO 27001 requires organisations to compare any controls against its own list of best practices, which are contained in Annex A. Creating documentation is the most time-consuming part of implementing an ISMS.

Solutions 

8. Develop risk documentation

The risk treatment plan (RTP) and Statement of Applicability (SoA) are key documents required for an ISO 27001 compliance project. 

The SoA lists all the controls identified in ISO 27001, details whether each control has been applied and explains why it was included or excluded. The RTP describes the steps to be taken to deal with each risk identified in the risk assessment. 

Solutions 

9. Conduct staff awareness training

Human error has been widely demonstrated as the weakest link in cyber security. Therefore, all employees should receive regular training to increase their awareness of information security issues and the purpose of the ISMS.

Solutions 

10. Assess, review and conduct an internal audit

ISO 27001 requires regular audits and testing to be carried out. This is to ensure that the controls are working as they should be and that the incident response plans are functioning effectively. Additionally, top management should review the performance of the ISMS at least annually.

Solutions 

11. Opt for a certification audit

If you opt for certification, the certification body you use should be properly accredited by a recognised national accreditation body and a member of the International Accreditation Forum. 

Your chosen certification body will review your management system documentation, check that you have implemented appropriate controls and conduct a site audit to test the procedures in practice. 

Solutions