Steps for Implementing ISO 27001

Key considerations prior to implementation

• Cost analysis

  One of the biggest considerations for implementing an ISMS is time and money. For example, scheduling meetings with key stakeholders, providing resources to implement and manage an ISMS, facilitating cross-department collaboration, and accounting for system and process reviews, will all place considerable demand on your time and budget. You will also need to account for external consultation and certification fees. So, having a breakdown of costs is essential for ensuring that you can carry out the project in full and secure internal funding.

• Key stakeholder buy-in

  Implementing ISO 27001 requires considerable commitment from your existing teams so it’s not a decision many businesses can take lightly. That’s why it’s important to secure buy-in from both senior management and key stakeholders early on. This will allow you to communicate why ISO 27001 is a worthwhile investment for your organisation. You will also need to set expectations and agree on the scope of the work to be carried out with senior management.

• Project team

  With your budget in place and your implementation plans signed off, it’s time to pull together your project team. When allocating responsibility, you’ll need to find staff with expertise in information security. This should include both physical and cyber security, and ideally, they should also have prior experience with auditing and ISMS implementation.

  If these skills don’t exist within your workforce, consider hiring external experts who are qualified ISO 27001 lead implementers and auditors. Their experience of implementing and auditing an ISMS can bring valuable insight and provide methods to ensure you implement an ISMS in the most effective and time efficient manner.

Implement the ISMS

Once you have secured support from senior management and allocated resources to your team, use the following steps to guide your ISO 27001 implementation:

Security risk assessment & risk treatment

A crucial part of ISO 27001 implementation is your risk assessments and Risk Management Framework (RMF). They play a key role in helping to identify where additional controls are needed. Establishing an RMF allows a business to identify, understand and manage risks in a structured and consistent manner, and align the actions needed with your business’s objectives.

The risk assessment can be carried out using many different methods as ISO 27001 does not define a specific methodology. However, the key is to identify risks that can affect the confidentiality, integrity and availability of information assets. The risk assessment will enable your business to identify those risks that need to be addressed. From this, a risk treatment plan can be developed to define what needs to be done to address the risks. For example, apply new controls, decide to accept the risk or terminate the activity that is causing the risk, along with timescales.

Once the risk assessment and treatment plans are developed, a Statement of Applicability (SoA) can be created. A SoA clearly outlines the controls the organisation has and isn’t applying.

Implement controls

Once the controls that are needed have been identified, it’s time to implement them. This can require several different activities and will need input from a wide variety of people across different parts of the organisation. It’s important to remember that controls can be:

1. Technical – for example, installing an anti-virus solution
2. People-based – training your workforce on common cyber security threats to ensure you reduce the risk of cyber attacks
3. Process-based – for example, a strategic onboarding process that ensures you carry out security checks and define access levels for new employees

Certain policies and procedures will need to be documented as this is a mandatory requirement of ISO 27001. For example, the information security policy is a mandatory document, but it’s important to remember that not everything needs to be documented and organisations should always take care to ensure their documentation is manageable.

Monitor and evaluate

Monitoring and evaluating your ISMS is critical to ensure it is working correctly and continuous improvement is taking place. During implementation, this activity will involve conducting an internal audit which involves testing and evaluating the controls the organisation has implemented and identifying any areas where there are non-conformities.

Corrective actions can then be identified and implemented. Additionally, the standard requires, as part of monitoring activities, that your management team review the ISMS at periodic intervals. This is known as a management review and will cover areas such as:

• Any changes to the internal or external environment that may impact information security
• Results of audits
• Reviewing information security objectives
• Results of risk assessments
• Opportunities for improvement
• Non-conformities and corrective actions
• Monitoring and measuring results

ISO 27001 Certification

The last step in the process is to achieve certification by undergoing a two-step auditing process conducted by a certification body. You will need to be able to provide the auditor with details of your ISMS and prove to them that it is a working system by demonstrating what you are doing. Many people get nervous about these audits, but if you’ve implemented your ISMS well, and can evidence that you are doing what you say you are doing, your road to certification will be a lot smoother.

Now what?

You may now heave a sigh of relief having achieved certification BUT it’s important to remember that your work is not complete. An ISMS is a continuously evolving system, and your organisation must ensure that it is running as part of your business-as-usual activities. That means there will be an ongoing set of activities to carry out to maintain your ISMS and ensure that there are no problems when it comes to the annual audits. This is often the most difficult part for organisations as the focus moves away from the ISMS and resources get re-allocated. It is critical at this stage that there is a clear plan of activities to maintain the ISMS and adequate resources are in place to deliver this.