What is an Information Security Management System?

An ISMS (Information Security Management System) provides a model for establishing, implementing, and reviewing protection of information assets. It is also responsible for its maintenance and improvement.

It is designed to achieve business goals while managing risks based on risk assessment and the organization’s risk acceptance levels.

What is ISO 27001:2013? 

ISO 27001:2013 is the internationally recognised standard for Information Security Management Systems (ISMS).

This standard covers the requirements for applying appropriate controls to ensure the protection of information assets.

As a family of standards, the ISMS courses are intended to assist organizations of all types and sizes to implement and operate an ISMS.

The ISMS family of standards consists of the following:

The two standards in the ‘Requirements’ swimlane specify requirements; the others offer guidance. However, among the latter, the more important are ISO 27005 and ISO 27002.

For more information about ISMS standards, visit the International Organization for Standardization (ISO) or the International Electrotechnical Commission (IEC )

What is ISO/IEC 27005: 2011?

ISO 27005: 2011 Information Security Risk Management provides guidance on implementing a process-oriented risk management approach.

Its goal is to assist in satisfactorily implementing and fulfilling the information security risk management requirements of ISO 27001.

Where does ISO 27002:2013 Code of Practice for Information Security Management fit in?

This standard provides a list of commonly accepted control objectives and best practice controls for achieving information security.

What Benefits Do Certified Firms Enjoy?

In terms of information security, a management system allows an organization to:

• satisfy the security requirements of customers and other stakeholders;
• improve an organization’s plans and activities;
• meet the organization’s information security objectives;
• comply with regulations, legislation and industry mandates; and
• manage information assets in an organized way that facilitates continual improvement and adjustment to current organizational goals and to the environment.

Furthermore, independent certification of an ISMS will permit an organisation to:

• achieve greater assurance that its information assets are adequately protected against information security risks on a continual basis;
• maintain a structured and comprehensive framework for identifying and assessing information security risks, selecting and applying applicable controls, and measuring and improving their effectiveness;
• continually improve its control environment; and,
• effectively achieve legal and regulatory compliance.

For more information on certification and the use of an Accredited Certification Body, visit www.ukas.org or  www.inab.ie.

How do you implement ISO 27001?

Here is a simplified version of the detailed step-by-step process in our ISO 27001 Lead Implementer Course:

1. Obtain management support
2. Develop a project plan
3. Define the ISMS scope
4. Write a top-level ISMS Policy
5. Develop the Risk Assessment Methodology
6. Perform the risk assessment and treatment
7. Write the Statement of Applicability
8. Write the Risk Treatment Plan
9. Define the method for measuring the effectiveness of controls
10. Implement controls and mandatory procedures
11. Implement training & awareness programs
12. Manage day-to-day operations of the ISMS
13. Monitor the performance of the ISMS
14. Perform internal audit
15. Perform the management review, and
16. Implement all the necessary corrective actions

Once you have finished these 16 steps, you’ll be ready for the certification.