Home » Security Bloggers Network » A Detailed Guide to Achieving ISO 27001 Certification

A Detailed Guide to Achieving ISO 27001 Certification

by Jingcong Zhao on January 13, 2020

Editor’s note: This blog post is an excerpt from our ebook The Basics of ISO 27001 Compliance: Critical Questions and Crucial Steps.

ISO/IEC 27001 is an information security standard designed and regulated by the International Organization for Standardization, and while it isn’t a legally mandated framework, it is the price of admission for many B2B businesses and is key to securing contracts with large companies, government organizations, and companies in data-heavy industries.

ISO 27001 is notable because it is an all-encompassing framework. It’s not restricted to one type of personal data or even to electronic data; it includes standards for everything from HR data security to client data to physical entry controls and security of loading and delivery areas.

Here is what makes ISO 27001 certification compelling and desirable: a business that is ISO 27001 certified has invested significant time and resources in information security, and their clients and partners can be certain they’re doing business with an organization that takes security seriously.

Becoming ISO 27001 certified isn’t quick or easy; the length of time it takes varies from organization to organization and depends on a lot of different factors. Conservatively, businesses should plan on spending around a year to become compliant and certified. The compliance journey involves several key steps, including:

Develop a project plan. It’s important to treat your ISO 27001 initiative as a project that needs to be managed diligently.
Perform a risk assessment. The objective of the risk assessment is to identify the scope of the report (including your assets, threats and overall risks), build a hypothesis on whether you’ll pass or fail, and build a security roadmap to fix things that represent significant risks to security.
Design and implement controls based on your security roadmap.
Document what you’re doing. During an audit, you will need to provide your auditor documentation on how you’re meeting the requirements of ISO 27001 with your security processes, so he or she can conduct an informed assessment.
Monitor and remediate. Monitoring against documented procedures is especially important because it will reveal deviations that, if significant enough, may cause you to fail your audit. Monitoring gives you the opportunity to fix things before it’s too late. Consider monitoring your last dress rehearsal: Use this time to finalize your documentation and make sure things are signed off.

Sponsorships Available

Once you have gone through these key steps, it is time to go through the audit itself. There are three parts to an ISO 27001 compliance audit:

Stage 1: A review of the information security management system (ISMS) that makes sure all of the proper policies and controls are in place.
Stage 2: A review of the actual practices and activities happening inside your business that ensures they’re in-line with ISO 27001 requirements and the written policies.
Stage 3: Ongoing compliance efforts, which include periodic reviews and audits to ensure the compliance program is still in force.

In this guide, we will help you understand the requirements within ISO 27001 as well as the controls you need to implement to satisfy those requirements. You can use this guide as a tool to understand what controls you already have within your organization and identify the additional controls you’ll need to create and implement to become fully compliant and achieve the ISO 27001 certification. Download your copy here.

Determining ISO 27001 Scope

Before you begin putting controls into place, you need to determine which areas of your business will be within the scope of your Information Security Management System (ISMS). Each business is unique and houses different types and amounts of data, so before building out your ISO 27001 compliance program, you need to know exactly what information you need to protect.

Information security should be about doing business more securely, not simply ticking boxes. You want to understand the internal and external issues that affect the intended outcome of the information security management system and what the people invested in your ISMS want and need from ISO 27001 compliance. The first control domains in ISO 27001—4.1 and 4.2—outlines your ISMS’ scope, which we’ll discuss more in the next section.

Once you’ve determined the relevant issues and interested parties, you have the building blocks to address clauses 4.3a-c: recording the scope of your ISMS. This is a crucial first step, because it will tell you exactly what you need to spend time on and what isn’t necessary for your business.

ISO 27001 Control Families

4. Context of the organization

The first requirements you will encounter when reading ISO 27001 are in clause 4. Context of the Organization.

Clause 4.1 is about relevant internal and external issues. Because ISO 27001 doesn’t offer a lot of information about what exactly constitutes an internal or external issue, this can be a tricky first step for businesses that are totally new to compliance.

Some examples of internal issues might include things such as internally stored or managed information assets, personnel issues such as high turnover rates or difficulty recruiting qualified individuals, or current compliance processes that are causing issues.

What are the issues, both internal and external, that will affect the success of your ISMS?

Clause 4.2 has to do with the “interested parties,” and their requirements. These interested parties do include customers and partners, but they also include employees, management, suppliers, and regulators. Anyone who has a say or an interest in your data security should be considered here. Once you’ve identified all of the stakeholders, you can identify which of those parties has the most influence on your compliance program and begin to pare down that list to the most inclusive and realistic list of requirements.

Who are the stakeholders who will have input into or benefit from your ISMS?
What do stakeholders need from your ISMS, and how do those requirements overlap and intersect?

Clause 4.3 requires the establishment of the scope of your eventual ISMS and states that you must consider the issues and interested parties you identified and the interfaces and dependencies between those issues and interested parties while developing this scope.

What issues will be specifically addressed within the scope of your ISMS?
What requirements of your stakeholders will you address with your ISMS?
How do these requirements intersect with each other, and how will that affect how your ISMS operates?

Finally, clause 4.4 requires the establishment, implementation, and maintenance and improvement of an ISMS. Ultimately, the evidence you use to prove compliance with this clause will be the culmination of the rest of the controls that you will develop, which will all be informed by clauses 4.1 through 4.3.

Is your ISMS fully established and implemented, and are you continually working to improve it?

Want to learn more about ISO 27001’s requirements and what it takes to be prepared for a formal audit? Download our guide The Basics of ISO 27001 Compliance: Critical Questions and Crucial Steps to get the information you need to jumpstart your ISO 27001 certification process.

The post A Detailed Guide to Achieving ISO 27001 Certification appeared first on Hyperproof.