ISO 27001 & 22301 - Expert Advice Community

ISMS Implementation Flow

I would like to take this opportunity to thank you for your webinar yesterday.

I would request you to please share some ideas / opinion on the below mentioned ISMS implementation flow in chronological order. Your opinion or suggestion will be a great help for me.

STEPS INVOLVED IN ISMS IMPLEMENTATION

01) Discussion with the top management for implementation of ISMS

02) Planning of awareness programme

03) Define of scope

04) Discuss & document the statutory & regulatory requirements (security) applicable to organisation

   4a) Risk identification (HAPPENS PARALLEL)

       1) Identification of assets

       2) Risk assessment & treatment plan

   4b) Scope of applicability

       1) Discussion & Understanding of the controls & applicability to organisation

05) Discuss & document the internal & external issues

06) Define & discuss the interfaces & dependencies within the processes in the organisation

07) Awareness training on ISMS certification  across the organisation staff

08) Define document applicable ISMS documents, Roles & responsibilities

09) Implementation of controls within the organisation

10) Monitor implementation progress

11) Internal Audit after implementation

12) Management Review meeting

13) MRM outcome implementations & improvements

14) Preparation for external (certification) Audits

Integration of 27001 and 27002 in establishment of guidance

To what extent would you integrate 27001 and 27002 in the establishment of guidance to Controls?

Risk Assessment Matrix

Attached is the risk assessment matrix we chose to use for our organization when doing ISO 27001 implementation. We think this will make more sense for us than multiplication or addition of 'Impact' and 'Likelihood'. Will there be any issue of using it, does ISO specify a set of matrixes so we cannot use anything else?

27001 questions

1. Please confirm the following versions of the Mandatory Documents the latest/current versions: ISO 27001 – ver 3.9, 2020-02-10

2. Within the ISO 27001 Documentation Toolkit List See attachment 27001A

• No. 57, Doc Code 10, Internal Audit Procedure: This does not have a green check mark as a Mandatory Document, however No. 58 and 59 Appendix 1 and 2 has a green check mark for a mandatory document.  Should the Procedure for Internal Audit be checked as a mandatory document?  See attachment 27001A Screenshot 1.
• No. 21 – 25, although these are not checked as a Mandatory Document, do we still need to create policies for them and all other documents/appendixes that are not checked as well?  See screenshot 2. This question would apply to ISO 20000 Document Toolkit as well?

Relation between ISO 27001 and the IS strategy

I hope to know the relation between iso 27k and the IS strategy is it part of it or is it considered as tactical process.

ISO 27001, ISO 20000, ISO 9001 question

1. Is there a possibility to integrate ISO 9001 with 20000 or this is not recommendable? If this is not recommendable, how will the usage of the three management systems according to the three standards (9001, 20000, 27001) be facilitated?

2. What outcomes could be expected within the certification process provided that we have developed the systems in compliance with the applicable standards:

       a. One integrated management system?

       b. Separate systems for each of the three standards?

       c. One system for 27001 and one system integrating 9001 and 20000, each of them with different scope?

Describing assessment of confidentiality

1 - Doesn't ISO 27001 have to describe an assessment of confidentiality, integrity and availability? In the risk analysis, I only evaluate according to threat and weakness. These have an effect on confidentiality, integrity and availability.

2 - For example, I find the Business Impact Analysis at the BSI. Don't I have to do this in ISO 27001 as well?

Interested parties, external and internal

As part of Iso27001 I know we are required to gather context of interest parties identify external and internal context. To satisfy auditors does this have to be in a document format like a policy?

Assessing maturity level of ISO/IEC 27001 implementation

Are there models to assess the maturity level of ISO/IEC 27001 implementation? Kindly recommend some.

Defining an ISMS scope

A client wishes to become ISO 27001 certified. My company is a very small ICT firm working in the same building and on the same network as this client (same ip-scope). How should I define their scope?