Cyber Security - Cyber Security Analyst- Cyber Security Incident Response - IT Risk Management - MAS TRM - MAS TRMG - MAS TRM Guideline - Vulnerability Management - Penetration Testing -Cloud Security - Information Security - SOC Analyst - Incident Response - VAPT – DFIR-Risk Management- Audit - IT Audit- Internal Audit - Network Concept - MAS TRM Guideline - ISO 27001 Implementation – Cybersecurity- cybersecurity - AI Incident Response-Operational Risk management-Security Policy

ISO 27001 Implementation

The Types of risks that sensitive and valuable information are subject to can generally be grouped into three categories

Confidentiality

Where one or more persons gain unauthorised access to information.

Availability

Where access to the information is lost or hampered.

Integrity

Where the content of the information is changed so that it is no longer accurate or longer.

For more details visit : Cyber Security CIA Triad

Important steps to remember during ISO 27001 Implementation:

ISO 27001 :2013 version 14 domains and 114 controls.
In ISO 27001:2022 structural changes were made to the Annex A controls.
In ISO 27001:2013, controls were organized into 14 different domains. In the new update, 2022 version controls are placed into the following four themes instead:

People controls (8 controls) ,Organizational controls (37 controls) ,Technological controls (34 controls) ,Physical controls (14 controls)

ISO 27001 Implementation high level can be divide into three categories

Introduction to the Clauses and Other supporting standards

As with most other ISO management system standards, the requirements of ISO 27001 that need to be satisfied are specified in Clauses 4.0 – 10.0 mandatory
In addition to Clauses 4.01 - 0.0 there is a further set of requirements detailed in a section called Annex A, which is referenced in Clause 6.0.
Annex A contains 114 best practice information security controls. Each of these 114 controls needs to be considered. To be compliant with ISO 27001 the organization must implement these controls.

Mandatory Clauses and Documents for ISO 27001

Mandatory documents for ISO 27001 Implementation :

Scope of ISMS ( 4.3)
Information Security Policy (5.2)
Risk Assessment Plan
Risk Treatment Plan
Inventory of Assets
Standard Operating Procedures (SOP)
Statement Of Applicability (SOA)
Incident Response Plan
Business Continuity Plan (BCP)
Internal Audit Report

Implementation Details

First mandatory clauses for ISO 27001 implementation (Clauses 4.0 – 10.0)

In addition 114 best practice information security controls. Each of these 114 controls needs to be considered. To be compliant with ISO 27001 the organization .
Perform gap analysis to implement 114 controls , Which comes under planning phase.
Finally internal audit to be perform to verify controls and external audit ( ISO attestation body) to provide Certificate.

Mandatory Clause Details

Clause 1: Scope

The Scope section of ISO 27001 sets out the purpose of the standard and types of organizations it is designed to apply. The sections of the standard (called Clauses) that contain requirements that an organization needs to comply with in order for the organization to be certified.

Clause 2: Normative References

In ISO standards, the Normative References section lists any other standards that contain additional information that is relevant to determining whether or not an organization complies with the standard (i,e. ISO 27002, ISO 27005 ..etc). During Audit auditor may ask what are the reference standard being used to design this.

Clause 3: Terms And Definitions

There are no terms and definitions given in ISO 27001. Instead, reference is made to the most current version of ISO 27000 Information Security Management Systems .

In addition to the terms explained in the “Key Principles and Terminology” section above, the most important terms used in ISO 27001 are:

Access Controls
Effectiveness
Risk
Risk Assessment
Risk Treatment
Top Management

Clause 4: Context Of The Organization

The purpose of your ISMS is to protect your organization’s Information Assets, so that the organization can achieve its goals.

• Internal – The things over which the organization has some control.

• External – The things over which the organization has no direct control.

Clause 5: Leadership

Leadership in this context means active involvement in setting the direction of the ISMS, promoting its implementation and ensuring appropriate resources are made available. This ensuring that the ISMS objectives are clear and aligned with overall strategy. During external audit auditor may check with leadership of the organization.

Clause 6: Planning

Planning is one of the important and time taking stage, There are few important things needs to done in this stage

Planning
Risk Assessment
Risk Treatment
Annex A and the Statement of Applicability

One Sample how this can be perform

All this 14 domains can be place in excel different tab and their respective control (114)

To Perform Gap Assessment and define the scope of applicability ( Example with just 3 domains , However we have to consider all 14 domains)

Clause 7: Support

This applies to people, infrastructure and environment as much as physical resources, materials, tools etc. There is also a renewed focus on knowledge as a significant resource within your organization. When planning your quality objectives, a major consideration will be the current capacity and capability of your resources as well as those you may need to source from external suppliers / partners.

Competence
Documented Information
Awareness
Communication

Clause 8: Operation

So, after all the planning and risk assessment, we’re ready to move on to the “do” stage. Clause 8 is all about having appropriate control over the creation and delivery your product or service.

Information Security Risk Assessment
Information Security Risk Treatment

Clause 9: Performance Evaluation

Monitoring, Measurement, Analysis and Evaluation
Management Review
Internal Audits

Clause 10: Improvement

The key aim of implementing an ISMS should be to reduce the likelihood of information security events occurring and their impact. No ISMS is likely to be perfect. However, a successful ISMS will improve over time and increase the organization’s resilience to information security attacks.

Nonconformity and Corrective Action
Root cause analysis

Next Steps once above Implemented

Google Sites

Report abuse