ISO 27001 ConsultingReadiness, Implementation, Audit and Program Management

• ISMS is an organisation program, framework and a set of rules, policies, and procedures that ensures protection of information.
• ISMS is a management program driven by a management representative such as Chief Information Security Officer (CISO).

• ISO 27001 is the certification that the organisation achieves upon demonstrating that they have implemented the ISMS.
• ISO 27001 is a certificate issued by a certification body upon completing a 2- phase audit.
• An ISO 27001 certification is valid for three years subject to annual surveillance.
• ISO 27001 certificate provides assurance to your customers that you have implemented 'optimum-security' in all processes that handles sensitive data

• Implementing ISMS helps an organisation to protect their information and digital assets, proactively.
• Additionally, it reduces the opportunity of being hacked as systems and processes are designed to ensure that the organisation and its information assets are secure.
• Processes such as risk assessment ensure all changes in the organizations consider security as part of the implementation.
• Controls such as threat intelligence ensures you are proactive as new threats develop in the wild.
• An annual calendar of 'management system' activities ensures that ensures there is an overarching role that is guiding the organisations security related decisions.

• Scope of business, and information systems involved
• Number of business locations
• Number of networks including cloud service provider
• Presence of application development in scope
• Identified gaps or risks

• A range of factors apply to determine the consultant efforts and the fee.
• Key factors includes scope in terms of business services, applications, networks, physical locations, applicable controls and the target dates.
• ISO 27001 consulting fee can vary from as low as $7000 to $50000 based on the above factors.

The phases of implementing include understanding the business, listing all information assets, conducting gap analysis, risk assessment and risk management, policy documentation, testing and measurement of controls, audit, and awareness of all stakeholders.

ISO 27001 certification consultant has the following skills:

• Ability to make an organisation iso 27001 certified through a formal process of gap analysis, documentation, process measurements technical implementations, internal audit and measurement
• Ability to explain the iso 27001 requirements to the organisation that includes management, functional owners, and employees, and enable them to implement secure practices
• Ability to perform security risk assessment and risk remediation
• Awarenss of latest changes in technology, and risk management practices
• Knowledge of latest security breaches
• Ability to draft company policies, and procedures that drive security managemeent in the organisation.
• Ability to communicate risk to the mnagement that elicit risk mitigation decision
• Manage an isms compliance program that has standard and dynamic activities as relevant to business and security incident management

ISO 27001 certification steps are as follows:

• Understanding the main business and information security context
• Listing business information and inventory fof assets
• Determinatin of applicable ISO 27001 control requirements
• Detail gap analysis, and risk assessment
• Enabling risk relatd decision making and ensuring successfu implementtain thereby ensuring risk reductioon
• Draftung plicies, procedures and metrics
• Awarenss to all staff
• Internal Audit
• Maintiain an annual program f gvernance that ensures that all relevant cmpany prcsses fllow the standadr to reduce any new opportunities of incients

ISO 27001 checklist creation is a challenging but interesting task that includes on one hand, understanding of iso 27001 requirements, and on the other an organization’s business, strategic information risks, and their information assets.

ISO 27001 has control requirement covering several domains that includes the following domains.

• Strategic
• Technical
• Physical
• Personnel
• Suppliers
• Process

Phase A – ISO 27001 requirement checklist

The journey starts with getting a copy of the iso 27001 controls, and using the same to create a meta templete in which against each rquirement one should prepare the iso 27001 questions using one or more of the follwings:

• What to ask?
• What to check?
• Whom to ask?

Phase B – Business requirement checklist

In the organistaion context, each business is sometwhat unique, so the next step is to gather enough infrmation about the organisations, such as:

• Main Business
• Products and Services
• Information to be secured
• Information Systems in Use
• Number and location of Users
• Applications develped
• Network locations
• Office locations
• Supplier List and their services
• Individual roles and nominations

With this, one has created the organisation context necessary to apply the qustions from the phase A.

ISO 27001 checklist is incomplete with just the standard questions, there is always a need to prepare the question in the context of the organisation for which this is applied.

A complete iso 27001 checklist strategy threfore needs to have both the iso 27001 control checklist as well as organisatial checklist.

ISO 27001 certification audit is valid for three years subject to fulfilment of the standard requirements by the organization. ISO 27001 certificate is issued by the certification bodies.

In the first year they perform two stages of the audit, namely stage 1, and stage 2.

Stage 1 audit is the documentation audit, where they look for documentation alignment with the applicable requirements as per the organizations Statement of Applicability (SOA).
Stage 1 questions are centered around company policies and procedures and demonstrate an organizations’ ‘intent’.

Stage 2 assessment aims at verifying the ‘implementation and effectiveness’. This phase is much more comprehensive where the iso 27001 certification body auditor looks for evidence of implementations across all domains and controls that are applicable to the organization.

Stage 2 focuses on the technical side of the implementations that includes the followings:

• Cloud security controls,
• Network security controls,
• Application development security lifecycle controls
• Human resource controls
• Physical security controls
• Supplier management controls
• Other ‘security management’ processes

Upon assured of the ‘intent, implementation and effectiveness’ the iso 27001 certificate is issued by the certification body to the Organisation.

• As the name suggests, it is a document created by the organization to demonstrate its alignment with the standard list of controls
• It defines the justification for not applicable controls, and applicable controls.
• It is the basis on which a company gets certified. SOA is used by the certification body auditor to make their judgment on compliance
• It is a document using an organization demonstrate their ‘control design’ – a term generally used in SOC 1/SOC 2.
• As a best practice, we advise clients to add more columns in the SOA such as documentation and risk owner, a term to associate a control with a team, responsible for enforcement of the control in the organization.