Strategy fo ISO 27001 Certification-Phase 3

Phase 3 – Activate your ISMS

The ISO/IEC 27001:2013 Standard introduces a process approach for integrating structures that strengthen an organization’s ISMS reducing the risks to the information assets. This approach covers the adoption and implementation of systems of processes within your organization, with identification and interactions of the processes, and their management.

The third phase of the Strategy for ISO/IEC 27001:2013 Certification is the implementation, operation, and monitoring of the policies and procedures used to reduce business risk, as defined by the security standard ISO 27001. There may also be specific procedures, standards, and policies unique to your organization in addition to the ISO 27001. Be certain to clearly define and justify the purposes of the implementation, as they are generally specific to the organization and the auditor will need to understand why.

11. Cultivating a Risk-aware Culture

The International Standards framework is very clear on the expectations of an organization‘s risk-aware culture and in order to pass the certification process for ISO 27001, the organization must establish a visible environment and culture that cultivates risk awareness.

We define it as a foundation of values, knowledge, beliefs, understanding and communication of the risks associated to the organization‘s objectives and assets necessary to achieving the objectives. We believe that you and your team should plan your strategy for implementation with staff in mind. Eliminating any resistance at the beginning and providing a clear vision will increase your efficiency and effectiveness for ISMS implementation.

Risk awareness may also be defined as a capability of the organization to recognize risks before they threaten, mitigate them when they arise, and recover from the damages they may cause. Creating a risk aware culture suggests that the capability is present throughout the organization and it is woven into the normal routines, rituals, and behaviors of all those involved.

Every step that follows and all the work that has been completed up to this point will be wasted if training and awareness programs aren’t established to support the implementation and ultimately the risk-aware culture. All levels of the organization have to be involved. Every employee needs to understand their individual expectations, as well as commit to the success of implementation.

Three key points to keep in mind when cultivating a risk aware culture in your organization:

• Risk awareness for Executives is about leadership and process management
• Risk awareness for Managers is about integration and execution of policies and procedures
• Risk awareness for Staff Members is about embracing the shared knowledge culture

12. Implement the controls and procedures

Your task here is to apply all of the knowledge you have gained about your organization’s ISMS risk management. The controls and procedures you need to implement are both the mandatory compliance requirements from the ISO 27001 standard as well as all the other mitigating controls you have chosen to implement based on the Risk Treatment. You may encounter resistance from all levels of the organization, as the implementation of new controls and new procedures may result in behavior changes for many employees. The better prepared you have made everyone through the training and awareness stage, the higher the success rate will be for the implementation.

We have outlined a few of the necessary policies and procedures you will need to comply with the ISO 27001:

• Personnel Security: Personnel security deals with the information employees, contractors, and third parties are exposed to.
• Physical and Environmental Security: Controls that address unauthorized physical access, damage and interference to an organization’s premises and information, as well as the prevention of loss, damage, theft or compromising of assets and organizational activities.
• Communications and Operation Management: focuses on ensuring correct and secure operation of information, including; third parties, systems, software, back-ups, networks, media, exchange of information, ecommerce, and monitoring.
• Access Control: focuses controlling the level of access in regards to the management of access, responsibilities and application information.
• System Development and Maintenance: ensures that information security is a vital component of information technology and information systems.
• Incident Management: verifies that information security vulnerabilities, events and weaknesses related to information systems are communicated and addressed in a timely manner, allowing for corrective action to take place.
• Business Continuity Management: The process of creating, testing, and implementing plans that counter disruptions in business activities and protect critical business processes.
• Compliance: ensuring laws, regulations and contractual obligations are obeyed through audits and review of controls.

13. Make the ISMS routine

The basic principle of the ISO 27001 implementation is to make the changes and adjustments a streamlined part of the everyday routines. All of the implemented controls and procedures need to be operating seamlessly within the business. If your employees are hindered or interrupted by the new protocols, then the business will be affected negatively. Recording the everyday activities through audit logs and incidents tracking and similar will provide you with the burden of proof that the employees are routinely executing the required procedures. The auditors will also expect the burden of proof for implemented controls to validate the implementation for the ISO 27001 certification.

14. Monitor and review

Monitoring and reviewing of the organizations ISMS includes action items such as internal audits and control measurement. By doing this effectively, organizations can reassure themselves that their ISMS is in fact serving its objectives.

You have to be able to assess and measure each control as they are implemented and operated on a daily basis. Understanding the baseline before the implementation and routinely analyzing the success or failure is the only way to know how your organization is progressing.

How do I do that?

By monitoring the effectiveness and maturity of controls, addressing incidents, as well as ensuring that the policies in place are in fact improving the overall operations of the organization. Further, the presence of residual risk should be assessed, and controls or measures implemented as needed.

We use a Control Maturity and Effectiveness Assessment (CMEA) in RM Studio that makes this process simple and productive. The CMEA improves the quality of the internal audit process as well as the overall impact of each control implemented. By combining the CMEA with the Risk Treatment, RM Studio provides you with a centralized collection of numerous aspects of data and allows you to design corrective and preventative actions accordingly.