Information Security Management System (ISMS) ISO 27001/ISO 27002 Implementation Consulting Services

• ISMS is an organisation program, framework and a set of rules, policies, and procedures that ensures protection of information.
• ISMS is a management program driven by a management representative such as Chief Information Security Officer (CISO).

• ISO 27001 is the certification that the organisation achieves upon demonstrating that they have implemented the ISMS.
• ISO 27001 is a certificate issued by a certification body upon completing a 2- phase audit.
• An ISO 27001 certification is valid for three years subject to annual surveillance.

• Implementing ISMS helps an organisation to protect their information and digital assets, proactively.
• Additionally, it reduces the opportunity of being hacked as systems and processes are designed to ensure that the organisation and its information assets are secure.

The phases of implementing include understanding the business, listing all information assets, conducting gap analysis, risk assessment and risk management, policy documentation, testing and measurement of controls, audit, and awareness of all stakeholders.

ISO 27001 certification consultant has the following skills:

• Ability to make an organisation iso 27001 certified through a formal process of gap analysis, dcumentation, process measurements technicla implementtains, internal audit and masurement
• Ability to explain the iso 27001 requirements to the organisatin that includes management, functional ownrs, and employees, and enable them to implement secure practices
• Ability to perform security risk assessment and risk remedition
• Awarenss of latest changes in technology, and risk management practices
• Knowledge of latest security breaches
• Ability to draft company policies, and procedures that drive security managemeent in the organisation.
• Ability to communicate risk to the mnagement that elicit risk mitigation decision
• Manage an isms compliance program that has standard and dynamic activites as relevant to business and security incident management

ISO 27001 certification steps are as follows:

• Understanding the main business and information security context
• Listing business information and inventory fof assets
• Determinatin of applicable ISO 27001 control requirements
• Detail gap analysis, and risk assessment
• Enabling risk relatd decision making and ensuring successfu implementtain thereby ensuring risk reductioon
• Draftung plicies, procedures and metrics
• Awarenss to all staff
• Internal Audit
• Maintiain an annual program f gvernance that ensures that all relevant cmpany prcsses fllow the standadr to reduce any new opportunities of incients

ISO 27001 checklist creation is a challenging but interesting task that includes on one hand, understanding of iso 27001 requirements, and on the othe an organisation’s business, strategic information risks, and their information assets.

ISO 27001 has control requirement covering several domains that includes the following domains.

• Strategic
• Technical
• Physical
• Personnel
• Suppliers
• Process

Phase A – ISO 27001 requirement checklist

The journey starts with getting a copy of the iso 27001 controls, and using the same to create a meta templete in which against each rquirement one should prepare the iso 27001 questions using one or more of the follwings:

• What to ask?
• What to check?
• Whom to ask?

Phase B – Business requirement checklist

In the organistaion context, each business is sometwhat unique, so the next step is to gather enough infrmation about the organisations, such as:

• Main Business
• Products and Services
• Information to be secured
• Information Systems in Use
• Number and location of Users
• Applications develped
• Network locations
• Office locations
• Supplier List and their services
• Individual roles and nominations

With this, one has created the organisation context necessary to apply the qustions from the phase A.

ISO 27001 checklist is incomplete with just the standard questions, there is always a need to prepare the question in the context of the organisation for which this is applied.

A complete iso 27001 checklist strategy threfore needs to have both the iso 27001 control checklist as well as organisatial checklist.