Security

Management
System
Implementation & Process

By:
Anshul Gupta
Vikramaditya
Gurjot
Ashok
Dilpreet Kaur

Structure of ISMS Series

27000 Fundamentals & Vocabulary
27001:ISMS
27005
Risk
Management

27002 Code of Practice for ISM

27003 Implementation Guidance
27004 Metrics & Measurement

27006 Guidelines on ISMS accreditation

ISO 27001
ISO27001 formally specifies how to establish an Information Security
Management System (ISMS).
The adoption of an ISMS is a strategic decision.
The design and implementation of an organizations ISMS is influenced
by its business and security objectives, its security risks and
control requirements, the processes employed and the size and
structure of the organization .
The ISMS will evolve systematically in response to changing risks.
Compliance with ISO27001 can be formally assessed and certified. A
certified ISMS builds confidence in the organizations approach to
information security management among stakeholders.

ISO 27002
ISO27002 is a Code of Practice recommending a large number of
information security controls.
Control objectives throughout the standard are generic, high-level
statements of business requirements for securing or protecting
information assets.
The numerous information security controls recommended by the
standard are meant to be implemented in the context of an ISMS, in
order to address risks and satisfy applicable control objectives
systematically.
Compliance with ISO27002 implies that the organization has adopted a
comprehensive, good practice approach to securing information.

Content of the ISMS Standards

Plan
Establish
Establishthe
the
ISMS
ISMS

Foundations (ISO/IEC 27001):

Establishing, implementing, operating,
maintaining and improving an ISMS
Documentation requirements
Management responsibilities
Internal audits and management reviews

Do

Implement
Implementand
and
operate
the
ISMS
operate the ISMS

Supporting Standards:

Monitor
Monitorand
and
review
the
ISMS
review the ISMS

Check

ISO/IEC 27002 - Code of practice for information security management

(controls(ISO/IEC 17799 to be renumbered next year)
ISO/IEC 27003 - ISMS implementation Guide (under development)

ISO/IEC 27004 Measurement and metrics (under development)

ISO/IEC 27005 Risk management (under development)

ISO/IEC 27006 Requirements for the accreditation of bodies providing

certification of ISMS (under development)

Maintain
Maintainand
and
improve
the
ISMS
improve the ISMS

Act

Implementation Steps

Decide on the ISMS scope.

Approach to risk assessment.

Perform GAP Analysis.

Selection of controls.

Statement of Applicability.

Reviewing and managing the Risks.

Ensure mmanagement commitment.

ISMS internal audits.

Measure effectiveness and performance.

Update risk treatment plans, procedures and controls .

ISMS Scope

Business security policy and plans

Current business operations requirements

Future business plans and requirements

Legislative requirements

Obligations and responsibilities with regard to security contained in

SLAs

The business and IT risks and their management

Inventory of Assets

An inventory of all important information assets should be developed and

maintained, recording details such as:

Type of asset;

Format (i.e. software, physical/printed, services, people, intangibles)

Location;

Backup information;

License information;

Business value (e.g. what business processes depend on it?).

Risk Assessment
Risk assessments should identify, quantify, acceptance and prioritize information
security risks against defined criteria for risk and objectives relevant to the
organization.
The results should guide and determine the appropriate management action and
priorities for managing information security risks and for implementing controls
selected to protect against these risks.
Assessing risks and selecting controls may need to be performed repeatedly across
different parts of the organization and information systems, and to respond to changes.
The process should systematically estimate the magnitude of risks (risk analysis) and
compare risks against risk criteria to determine their significance (risk evaluation).
The information security risk assessment should have a clearly defined scope and
complement risk assessments in other aspects of the business, where appropriate.

Prepare Statement of Applicability

The Statement of Applicability (SOA) is a key ISMS document listing the

organizations information security control objectives and controls.

The SOA is derived from the results of the risk assessment, where:
Risk treatments have been selected;

All relevant legal and regulatory requirements have been identified;

Contractual obligations are fully understood;

A review the organizations own business needs and requirements has been
carried out.

Prepare Risk Treatment Plan

The organisation should formulate a risk treatment plan (RTP)

identifying the appropriate management actions, resources,
responsibilities and priorities for dealing with its information security
risks.

The RTP should be set within the context of the organization's

information security policy and should clearly identify the approach to
risk and the criteria for accepting risk.

The RTP is the key document that links all four phases of the PDCA cycle
for the ISMS.

Plan-Do-Check-Act (PDCA)

The ISO 27001 adopts the Plan-Do-Check-Act (PDCA)

Applied to structure all ISMS processes

Plan

Act

Do

Check

PDCA Model
PDCA Model
Plan

Establish
ISMS

Do

Implement
and operate
ISMS

Establish ISMS policy, objectives, processes and

procedures relevant to managing risk and
improving IS to deliver results in accordance with
an organizations overall policies and objectives
Implement and operate ISMS policy, controls,
processes and procedures
Asses, and where applicable, measure process
performance against ISMS policy, objectives and
practical experience and report the results to
management for review

Che
ck

Monitor and
review ISMS

Act

Take corrective actions, based on the results of

Maintain and
the internal audit and management review or
improve
other relevant information, to achieve continual
ISMS
improvement of ISMS

PDCA Approach
Plan:

Study requirements

Draft an IS Policy

Discuss in IS Forum ( Committee )

Finalize and approve the policy

Establish implementation procedure

Staff awareness/training

Do:

Implement the policy

Check:

Monitor, measure, & audit the process

Act:

Improve the process

ISO 27001 (Requirements) Standard Content

Introduction
Section 0

Scope
Section 1

Normative references
Section 2

Terms and definitions

Section 3

Plan
Section 4 to plan the establishment of your organizations ISMS.

Do
Section 5 to implement, operate, and maintain your ISMS.

Check
Sections 6 and 7 to monitor, measure, audit, and review your ISMS.

Act
Section 8 to take corrective and preventive actions to improve your
ISMS.

Annexe A (Clauses A.5 to A.15)

Compliance Review and Corrective Actions

Management must review the organizations ISMS at least once a year to

ensure its continuing suitability, adequacy and effectiveness.
They must assess opportunities for improvement and the need for
changes to the ISMS, including the information security policy and
information security objectives.
The results of these reviews must be clearly documented and maintained
(records).
Reviews are part of the Check phase of the PDCA cycle: any corrective
actions arising must be managed accordingly.

Pre-Certification Assessment

Prior to certification, the organization should carry out a comprehensive

review of the ISMS and SOA.

The organization will need to demonstrate compliance with both the full
PDCA cycle and clause 8 of ISO27001, the requirement for continual
improvement.

Certification auditors will seek evidence (in the form of records of

processes such as risk assessments, management reviews, incident
reports, corrective actions etc.) that the ISMS is operating and
continually improving.

The ISMS therefore needs a while to settle down, operate normally and
generate the records after it has been implemented.

Certification Audit
Certification involves the organizations ISMS being assessed for
compliance with ISO27001.
The certification body needs to gain assurance that the organizations
information security risk assessment properly reflects its business
activities for the full scope of the ISMS.
The assessors will check that the organization has properly analysed and
treated its information security risks and continues managing its
information security risks systematically.
A certificate of compliance from an accredited certification body has
credibility with other organizations

Certification Audit( Cont )

The organization shall continually improve the effectiveness of the ISMS through
the use of:

The information security policy;

Information security objectives;

Audit results;

Analysis of monitored events;

Corrective and preventive actions;

Management review.

References

ISO/IEC 27001:2005. Information Technology - Security Techniques

Information Security Management Systems Requirements. Known as
ISO 27001.

ISO/IEC 27002:2005. Information Technology - Security Techniques Code of Practice for Information Security Management. Known as ISO
27002.

Alan Calder & Steve Watkins (2012). IT Governance: an International

Guide to Data Security and ISO27001/ISO27002. 5th edition. Kogan Page
Publishing.

Thank You