ISO 27001 IMPLEMENTATION

Agenda
• ISO 27000 Overview
• The ISMS
• Planning the Implementation
• Deploying the ISMS
• Measurement and Continual Improvement
ISO 27000 OVERVIEW

3
Audience
• Certifications:
• CISA
• CISSP
• ISO 27001
• Which version – 2005 or 2013

• Reason for attending

• Industry
• Planning for ISO 27001
• Expanding ISO 27001
• General knowledge
• Consulting
• Building or expanding ISO 27001
• Certification firms

4
ISO Management Principles

Customer Involvement Process

Leadership
Focus of People Approach

System Factual Mutually

Approach to Continual Approach to Beneficial
Management Improvement Decision Supplier
Making Relationships

5
The Standards
• ISO
• 19,000 standards since 1947

• ISO 27000
• ISO 27001
• ISO 27002
• ISO 27003
• ISO 27004
• ISO 27005
• ISO 31000

• 14 clauses, 35 control objectives, 114 controls

6
Terminology (lingo)
• SOX
• Interim testing, roll forward testing, significant deficiencies, material
weaknesses
• Final report issued by external auditors (typically the Big 4)
• SOC 1/2
• Gaps, observations, recommendations
• SOC report – generally issued by a CPA firm
• ITGC / Domains
• PCI
• Final report is called a ROC (report of compliance) – generally
issued by an InfoSec Compliance firm
• ISO 27001
• Stage 1, Stage 2, Surveillance Audits
• Certification – only a few firms do this
7
THE ISMS

9
Definition of ISMS
• An Information Security Management System consists of
the policies, procedures, guidelines, and associated
resources and activities, collectively managed by an
organization, in the pursuit of protecting its information
assets.
• An ISMS is a systematic approach for establishing,
implementing, operating, monitoring, reviewing,
maintaining and improving an organization’s information
security to achieve business objectives.
• It is based upon a risk assessment and the organization’s
risk acceptance levels designed to effectively treat and
manage risks.
10
 Clause 4
Context of the
The Clauses Organization

Clause 6
Planning

Plan

Clause 10 Clause 8
Improvement Act Do Operation

Check

Clause 9
Performance
Evaluation

Clause 7 Clause 5
Support Leadership

Annex A
Control Objectives and Controls

11
ISO 27002 Clauses No of
Controls
Information Security Policies
Organization of Information Security
Human Resources
Asset Management
Access Control
Cryptography
Physical And Environmental Security
Operations Security
Communications Security
System Acquisition, Development And Maintenance
Supplier Relationships
Information Security Incident Management
Information Security Aspects Of Business Continuity Management
Compliance
12
Framework
1. Plan 2. Do 3. Check 4. Act
Organizational Monitoring, Treatment of Non-
Initiating the ISMS Measurement,
Structure conformities
Analysis and
Understanding the Document Evaluation Continual
organization Management Improvement

Analyze the Design of Controls

Internal Audit
existing System & Procedures

Leadership and Management

Communication
project approval Review

Awareness &
Scope
Training

Implementation of
Security Policy
Controls

Incident
Risk Assessment
Management

Statement of Operations
Applicability Management

13
ISO 27001 Advantages
• Improvement of security
• Good governance
• Conformity
• Cost reduction
• Marketing

14
 Certification Timeline
Internal Audit
Oct 5

Management Review Stage 2 Audit

Oct 10 Dec 8

Select certification body (registrar) ISMS Complete Stage 1 Audit Certificate Granted
Apr 5 Aug 31 Nov 3 Jan 13

2016 Mar Apr May Jun Jul Aug Sep Oct Nov Dec 2017
2017
Today

Interview Registars Mar 23 - Apr 5

at least 3
Build ISMS Mar 23 - Aug 31
months
Operationalize ISMS Sep 1 - Nov 30

Internal Audit Oct 1 - Oct 5

External Stage 1 Audit Nov 1 - Nov 3
External Stage 2 Audit Dec 1 - Dec 8
Continual
Sep 1 - Jan 31
Improvement

Surveillance Audits – annually

Recertification Audit – every 3 years

14
PLANNING THE
IMPLEMENTATION

15
Understanding
• Mission, objectives, values and
the strategies
Organization
• External environment
1. Plan • Internal environment
Initiating the
ISMS
• Key processes
Understanding
the organization • Infrastructure
Analyze the
existing System
Leadership and • Interested parties
project approval
Scope • Business Requirements
Security Policy
• ISMS Objectives
Risk Assessment
Statement of • Legal, regulatory and
Applicability
contractual obligations
16
Analyze the
• Identify security processes,
Existing
procedures, plans and
System
measures
1. Plan • Identify actual level of
Initiating the
ISMS compliance
Understanding
the organization
Analyze the
• Evaluate effectiveness and
existing System
Leadership and
project approval
maturity level of processes
Scope
• Gap analysis (not required by
Security Policy
the ISO standard)
Risk Assessment
Statement of
Applicability

17
Leadership
• Business case
and Project
Approval • Project team
• Steering Committee
1. Plan
Initiating the
• Project plan
ISMS
Understanding
the organization
• Management approval
Analyze the
existing System
Leadership and
project approval
Scope

Security Policy

Risk Assessment
Statement of
Applicability

18
 Scope
• Defines the boundaries
(organizational, information
system, physical) and
1. Plan applicability of the ISMS
Initiating the
ISMS • Helps determine the amount of
Understanding
the organization
Analyze the
effort
existing System
Leadership and • Scope can be limited
project approval
Scope • Organizational unit(s)
Security Policy
• Geographic area
Risk Assessment
Statement of • Product or Service
Applicability

19
 Scope
Scope
• Key characteristics of the organization
• Organizational processes

1. Plan • Descriptions of roles and responsibilities

Initiating the
for the ISMS
ISMS
Understanding • List of information assets
the organization
Analyze the • List of information systems
existing System
Leadership and • Details and reasons for exclusions
project approval
Scope

Security Policy Scope Statement

Risk Assessment • Summary
Statement of
Applicability • Written on the certificate

20
Security Policy
• Appropriate to the purpose of the
Requirements organization
• Commitment to meeting ISO objectives
• Available to the organization as documents
1. Plan • Communicated within the organization
Initiating the • Available to interested parties, as
ISMS
Understanding
appropriate
the organization
Analyze the
• ISMS Policy should cover all clauses of
existing System ISO 27001
Leadership and
project approval • Security policy can be a single document
Scope or separate policy for each ISO 27002
Security Policy clause
Risk Assessment • Can be high level statement of policies
Statement of with more detail given in subordinate
Applicability
policies

21
Document Types
Policy • high-level business rules, or requirements,
defining what the organization will do to protect
information

Standard • collections of system-specific or procedural-

specific requirements that must be met by
everyone

Guideline • collections of system specific or procedural

specific "suggestions" for best practice

Process • high-level, end-to-end view of related activities that

produce a specific service or product
Narrative • indicate where there is a separation of
responsibilities and control points.

Procedure • specific operational steps or manual methods that

workers must follow to implement the goal of the
written policies and standards
Note: Standards, guidelines and procedures can be included in
process narratives or in policies (rare)
22
Policy Document Structure
• Summary
• Overview
• Scope
• Objectives
• Principles
• Responsibilities
• Enforcement
• Related policies
• Definitions
• Review and approval information
• Version history

23
Documentation Standard
• Outlines content of each type of document
• Describes the look and identification of the document
• Describes how to review documents
• Defines numbering scheme:
Organizational Unit:
Company CP – Corporate
Identifier IT – Information Technology
OP – Operations

XX 000 CP PL 001

Domain: Document Type: Sequential

000 – ISMS PL - Policy Number
05 – Information Security PN – Process Narrative
Policy PR – Procedure
06 – Organization of ST – Standard
Information Security XG – Guideline
07 – Human Resource XX – Other Supporting
Security Document
etc.

24
 Risk
• Select risk assessment methodology that
Assessment will provide comparable and reproducible
results
• Determine risks and opportunities that
need to be addressed
1. Plan
• Establish and maintain risk criteria
Initiating the
ISMS • Select risk treatment options
Understanding
the organization • Assess control changes, as appropriate
Analyze the
existing System • Formulate risk treatment plan
Leadership and
project approval
Scope

Security Policy
ISO 31000 is a generic framework
Risk Assessment
ISO 27005 adapts ISO 31000 to
Statement of information security and is aligned with
Applicability
ISO 27001

25
Statement of
A Statement of Applicability shall be
Applicability produced that includes the following:
1. The necessary control objectives and controls
and
2. Justification for inclusions, whether they are
1. Plan
implemented or not, and
Initiating the
ISMS 3. The justification for exclusions of controls from
Understanding ISO 27001, Annex A
the organization
Analyze the
existing System
Leadership and
project approval
Scope Must be validated and approved
Security Policy One of the first documents that will be
Risk Assessment analyzed by the certification auditor
Statement of
Applicability

26
DEPLOYING THE ISMS

27
Organizational
Structure • Governance structure
• Information Security
Committee
2. Do
• Normally chaired by CISO
Organizational
Structure
Document
Management
• Operational committees, as
Design of Controls
& Procedures appropriate
Communication
Awareness & - The Information Security Committee should be
Training
described in the ISMS Policy
Implementation of
Controls Membership
Incident
Management
Responsibilities
Operations Agenda items for meetings
Management

28
 Document • Documented information required by the
Management standard
• Documented information determined by
the organization as being necessary for
the effectiveness of the ISMS
2. Do
Organizational
Structure
Document
Management
Design of Controls The extent of ISMS documented
& Procedures

Communication
information can differ by organization
Awareness & Size of the organization
Training
Implementation of
Types of activities, processes, products and
Controls services
Incident
Management Complexity of processes and their interactions,
Operations
Management
Competence of personnel

29
 Document Documents Explicitly Required Clause
ISMS scope
Management Information security policy 5.2
Information security risk assessment process 6.1.2 &
and results 8.2
Information security risk treatment process and 6.1.3 &
2. Do results 8.3
Organizational Statement of Applicability 6.1.3d
Structure
Document Information security objectives 6.2
Management
Evidence of competence 7.2d
Design of Controls
& Procedures
Control of documented information 7.5
Communication
Awareness & Operational planning and control 8.1
Training
Implementation of ISMS monitoring and measurement results 9.1
Controls
Incident
Management
Internal audit programs and audit results 9.2
Operations
Management Management review 9.3

Non-conformities, corrective actions and results 10.1

30
 Design of • Controls should be specific and concise
Controls & • Should address:
Procedures • Who What When
• Where Why How

2. Do • Example:
• The network administrator (Who) makes sure that
Organizational
Structure backups are completed (What) by reviewing
Document backup logs (How) each morning (When).
Management
Design of Controls Following the review, the network administrator
& Procedures
completes and signs a checklist (Where) that is
Communication retained for future reference (Why).
Awareness &
Training
Implementation of
Controls
Incident Note: No requirement to describe in detail each
Management
Operations security control, but highly recommended
Management

31
Communication • The organization shall determine the need
for internal and external communications
relevant to the ISMS
• What to communicate;
• When to communicate;
2. Do • With whom to communicate;
Organizational
Structure
• Who shall communicate; and
Document • The processes by which communication shall be
Management
Design of Controls effected
& Procedures
• Interested parties to consider:
Communication
Awareness & • Employees
Training
• Investors
Implementation of
Controls • Suppliers
Incident
Management • Customers / Clients
Operations
Management • Media
• Communities

32
Awareness & • Ensure the competence of those involved
Training in the operations of the ISMS on the basis
of education, training or experience
• Identify required skills
• Evaluate education / training needs
2. Do • Implement a training program
Organizational
Structure • A user who has not been properly
Document
Management informed, trained and made aware of the
Design of Controls
& Procedures
importance of information security is a
Communication potential risk to the security of the
Awareness & organization
Training
Implementation of • An awareness program is focused on
Controls
Incident encouraging better security behavior
Management
Operations • Policy dissemination
Management
• Information about threats
• Individual responsibility for security

33
Implementation Operation Planning and Control
of Controls • The organization shall plan, implement and
control the processes needed to meet
information security requirements, and to
implement the actions determined to address
identified risks. The organization shall also
2. Do implement plans to achieve information security
Organizational objectives.
Structure
Document • The organization shall keep documented
Management
Design of Controls
information to the extent necessary to have
& Procedures confidence that the processes have been
Communication carried out as planned.
Awareness & • The organization shall control planned changes
Training
Implementation of
and review the consequences of unintended
Controls changes, taking action to mitigate any adverse
Incident
Management
effects.
Operations • The organization shall ensure that outsourced
Management
processes are determined and controlled.

34
 Incident • Ensure that security events are detected and
Management identified
• Educate users about the risk factors that could
cause security incidents
• Treat security incidents in the most appropriate
2. Do and effective way
Organizational
Structure
• Reduce the possible impact of incidents on the
Document operations of the organization
Management
Design of Controls • Prevent future security incidents and reduce
& Procedures
their change of occurrence
Communication
Awareness & • Improve security controls of the organization by
Training correcting any deficiencies identified following
Implementation of
Controls the analysis of security incidents
Incident
Management
Operations Note: ISO 27035 is a code of practice for
Management
managing information security incidents

35
 Operations • Once the ISMS project is complete, the ISMS is
Management transferred to the operations of the organization
• Top management shall demonstrate leadership
and commitment with respect to the ISMS by
ensuring that the needed resources are
2. Do available
Organizational • The organization shall determine and provide
Structure
Document the resources needed for the establishment,
Management
Design of Controls
implementation, maintenance and continual
& Procedures improvement of the ISMS
Communication
Awareness &
Training Budget
Implementation of
Controls
Incident Tools
Management
Operations Qualified
Management Personnel

36
MEASUREMENT AND
CONTINUAL IMPROVEMENT

37
Monitoring and • Identifying the measurement objectives
Measuring • Selecting attribute objects that can be
measured
• Create performance indicators
• Evaluate if objectives are achieved and
improve the management system

38
Internal Audit • Types of Audits:
• First Party Audits (Internal Audit)
• Second Party Audits (Customer Audit)
• Third Party Audits (External Independent Audit)
• Audit Charter
• Access and Independence
• Audit Procedures
• Audit Activities

• External / Certification
• Stage 1
• Stage 2
• Surveillance in years 2 and 3

• Non-conformity
• Major
• Minor

39
Management • Performed by top management
Review
• At least annually

• Agenda
• Status of previous review
• Changes
• Non-conformities
• Monitoring and measuring results
• Audit results
• Fulfillment of information security objectives
• Feedback of interested parties
• Results of risk assessment / risk treatment
• Continual improvement opportunities

40