A Guide to Implementing the ISO/IEC 27001 Standard
1 Introduction This concise guide takes you through the process of implementing the ISO/IEC 27001 international standard for information security. It provides a recommended route to certification against the standard starting from a position where very little is in place. Of course, every organization is different and there are many valid ways to embed the disciplines of information security. The best way for you may well depend upon a number of factors, including:
The size of your organization The country or countries in which you operate The culture your organization has adopted The industry you operate within The resources you have at your disposal Your legal, regulatory and contractual environment
So view this guide simply as a pointer to where you could start and a broad indication of the order you could do things in. There is no single “right way” to implement information security; the important thing is that you end up with an Information Security Management System (ISMS) that is relevant and appropriate for your specific organization’s needs. Good luck!
1.1
The ISO/IEC 27001 standard
The ISO/IEC 27001 international standard for “Information technology — Security techniques — Information security management systems — Requirements” was originally published by the ISO and IEC in 2005 and is based upon the earlier British standard BS7799. Revised in 2013, ISO/IEC 27001 specifies the requirements that your ISMS will need to meet in order for your organization to become certified to the standard. The requirements in ISO/IEC 27001 are supplemented by guidance contained in ISO/IEC 27002 which was also revised in 2013. ISO/IEC 27002 is well worth reading as it fills in some of the gaps in understanding how the requirements in ISO/IEC 27001 should be met and gives more clues about what the auditor may be looking for. There are a number of other documents published within the ISO/IEC 27000 series and many of them provide useful supporting information for organizations going for ISO/IEC 27001 certification (or simply using it for guidance). Some of the commonly-referenced ones are:
ISO/IEC 27000 — Information security management systems — Overview and vocabulary ISO/IEC 27003 — Information security management system implementation guidance ISO/IEC 27004 — Information security management — Measurement
V7 Copyright CertiKit 2016
Page 3