Iso27001

ISO 27001 Implementation Guide

Disclaimer: This is informational only and does not constitute legal or audit advice. Engage accredited certification bodies and qualified consultants for your implementation.

Overview

ISO/IEC 27001 is the international standard for Information Security Management Systems (ISMS). Certification demonstrates systematic approach to managing information security risks.

Current version: ISO 27001:2022 (replaced 2013 version — transition deadline October 2025 for existing certifications)

Key changes in 2022:

• Annex A restructured from 114 to 93 controls
• New controls added: threat intelligence, cloud security, ICT supply chain, data masking, physical security monitoring, information deletion, data leakage prevention, web filtering, secure coding

ISMS Scope Definition

Scope Statement Must Include

• Organizational units and locations covered
• External and internal context (Clause 4.1)
• Interested parties and their requirements (Clause 4.2)
• Information assets within scope
• Interfaces and dependencies with other organizations

Scoping Considerations

• Start narrow for first certification (one product, one team, one location)
• Exclusions must be justified and documented
• Cannot exclude controls that affect in-scope assets

Plan-Do-Check-Act (PDCA) Cycle

PLAN:  Establish ISMS, risk assessment, treatment plan, SoA
DO:    Implement controls, training, procedures
CHECK: Internal audits, management review, monitoring
ACT:   Corrective actions, continual improvement

Mandatory Clauses (4–10)

All mandatory — cannot be excluded:

Risk Assessment Process (Clause 6.1.2)

Step 1: Establish Risk Criteria

• Define risk acceptance criteria
• Define risk evaluation criteria (likelihood × impact scales)

Step 2: Identify Risks

• Asset-based: List assets → identify threats and vulnerabilities per asset
• Event-based: List scenarios of confidentiality/integrity/availability failure

Step 3: Analyze Risks

• Likelihood (1–5 scale)
• Impact (1–5 scale)
• Risk level = Likelihood × Impact

Step 4: Evaluate Risks

• Compare against acceptance criteria
• Prioritize for treatment

Step 5: Risk Treatment (Clause 6.1.3)

Options:

• Modify: Apply controls (most common)
• Avoid: Stop the activity
• Share: Transfer to insurer or third party
• Retain: Accept (document decision with owner approval)

Risk Treatment Plan

Document for each risk:

• Selected treatment option
• Controls to implement
• Responsible owner
• Implementation timeline
• Residual risk level after treatment
• Approval by risk owner

Statement of Applicability (SoA)

Most important document for certification audit.

Must list all 93 Annex A controls and for each:

• Include or exclude
• Justification for inclusion/exclusion
• Implementation status
• Reference to implementing policy/procedure

Exclusions must be justified — cannot exclude a control that mitigates an accepted risk that wasn't retained.

Annex A Controls Overview (ISO 27001:2022)

A.5 Organizational Controls (37 controls)

5.1 Policies for information security 5.2 Information security roles and responsibilities 5.3 Segregation of duties 5.4 Management responsibilities 5.5 Contact with authorities 5.6 Contact with special interest groups 5.7 Threat intelligence (new) 5.8 Information security in project management 5.9 Inventory of information and other assets 5.10 Acceptable use of information and other assets 5.11 Return of assets 5.12 Classification of information 5.13 Labelling of information 5.14 Information transfer 5.15 Access control 5.16 Identity management 5.17 Authentication information 5.18 Access rights 5.19 Information security in supplier relationships 5.20 Addressing information security within supplier agreements 5.21 Managing information security in the ICT supply chain (new) 5.22 Monitoring, review and change management of supplier services 5.23 Information security for use of cloud services (new) 5.24 Information security incident management planning and preparation 5.25 Assessment and decision on information security events 5.26 Response to information security incidents 5.27 Learning from information security incidents 5.28 Collection of evidence 5.29 Information security during disruption 5.30 ICT readiness for business continuity (new) 5.31 Legal, statutory, regulatory and contractual requirements 5.32 Intellectual property rights 5.33 Protection of records 5.34 Privacy and protection of PII 5.35 Independent review of information security 5.36 Compliance with policies and standards 5.37 Documented operating procedures

A.6 People Controls (8 controls)

6.1 Screening (background checks) 6.2 Terms and conditions of employment 6.3 Information security awareness, education and training 6.4 Disciplinary process 6.5 Responsibilities after termination or change of employment 6.6 Confidentiality or non-disclosure agreements 6.7 Remote working (new) 6.8 Information security event reporting

A.7 Physical Controls (14 controls)

7.1 Physical security perimeters 7.2 Physical entry 7.3 Securing offices, rooms and facilities 7.4 Physical security monitoring (new) 7.5 Protecting against physical and environmental threats 7.6 Working in secure areas 7.7 Clear desk and clear screen 7.8 Equipment siting and protection 7.9 Security of assets off-premises 7.10 Storage media 7.11 Supporting utilities 7.12 Cabling security 7.13 Equipment maintenance 7.14 Secure disposal or re-use of equipment

A.8 Technological Controls (34 controls)

8.1 User endpoint devices 8.2 Privileged access rights 8.3 Information access restriction 8.4 Access to source code 8.5 Secure authentication 8.6 Capacity management 8.7 Protection against malware 8.8 Management of technical vulnerabilities 8.9 Configuration management (new) 8.10 Information deletion (new) 8.11 Data masking (new) 8.12 Data leakage prevention (new) 8.13 Information backup 8.14 Redundancy of information processing facilities 8.15 Logging 8.16 Monitoring activities (new) 8.17 Clock synchronization 8.18 Use of privileged utility programs 8.19 Installation of software on operational systems 8.20 Networks security 8.21 Security of network services 8.22 Segregation of networks 8.23 Web filtering (new) 8.24 Use of cryptography 8.25 Secure development life cycle 8.26 Application security requirements 8.27 Secure system architecture and engineering principles 8.28 Secure coding (new) 8.29 Security testing in development and acceptance 8.30 Outsourced development 8.31 Separation of development, test and production environments 8.32 Change management 8.33 Test information 8.34 Protection of information systems during audit testing

Certification Process

Stage 1 Audit (Documentation Review)

• Auditor reviews ISMS documentation
• Checks SoA completeness
• Reviews risk assessment and treatment plan
• Identifies areas requiring attention before Stage 2
• Duration: 1–2 days

Stage 2 Audit (Implementation Verification)

• Auditor verifies controls are implemented and operating
• Interviews staff, reviews evidence, tests controls
• Issues nonconformities (major/minor) and observations
• Duration: 2–5 days depending on scope

Major vs Minor Nonconformities

• Major: Absence of required element, systemic failure, ISMS breakdown → must close before certification
• Minor: Isolated failure, minor gap → corrective action plan required, closed at next surveillance

Surveillance Audits

• Annual (usually year 1 and year 2 after certification)
• Cover subset of controls
• Must show ISMS is maintained and improved

Recertification Audit

• Year 3 — full recertification audit
• Covers all controls again
• New 3-year cycle begins

Key Documents Required

• ISMS scope statement
• Information security policy (top-level)
• Risk assessment methodology
• Risk assessment results (risk register)
• Risk treatment plan
• Statement of Applicability
• Information security objectives
• Competence records (training)
• Operational planning results
• Monitoring and measurement results
• Internal audit program and results
• Management review minutes
• Nonconformity and corrective action records

Quick Implementation Checklist

Month 1–2: Foundation

• Management commitment obtained
• ISMS scope defined
• Roles assigned (CISO/Information Security Manager)
• Asset inventory created
• Information security policy approved

Month 3–4: Risk Management

• Risk assessment methodology documented
• Risk assessment completed
• Risk treatment plan finalized
• SoA drafted

Month 5–8: Control Implementation

• Priority controls implemented
• Policies and procedures written
• Staff training completed
• Supplier agreements updated

Month 9–10: Evaluation

• Internal audit conducted
• Management review completed
• Nonconformities addressed
• Stage 1 audit preparation

Month 11–12: Certification

• Stage 1 audit
• Remediation of Stage 1 findings
• Stage 2 audit
• Certification received