Scribd Logo
Upload

Welcome to Scribd!

  • 401 views

    ISO 27001 Controls and Checklist - Mine

    Uploaded by

    Sonya
    The document discusses ISO 27001 and what a consultant can do to help an organization achieve certification. It explains that ISO 27001 defines requirements for establishing, implementing, maintaining and improving an information security management system. The consultant's role would be to define security improvement objectives, identify key processes, understand customer requirements, perform a risk assessment and implement controls. It also provides details on some of the key aspects of ISO 27001 such as the domains of controls, statements of applicability, and mandatory documentation requirements.

    Copyright:

    © All Rights Reserved
    Download as PPTX, PDF, TXT or read online from Scribd

    ISO 27001 Controls and Checklist - Mine

    Uploaded by

    Sonya
    401 views17 pages
    The document discusses ISO 27001 and what a consultant can do to help an organization achieve certification. It explains that ISO 27001 defines requirements for establishing, implementing, maintaining and improving an information security management system. The consultant's role would be to define security improvement objectives, identify key processes, understand customer requirements, perform a risk assessment and implement controls. It also provides details on some of the key aspects of ISO 27001 such as the domains of controls, statements of applicability, and mandatory documentation requirements.

    Original Title

    ISO 27001 controls and checklist - Mine

    Copyright

    © © All Rights Reserved

    Available Formats

    PPTX, PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    The document discusses ISO 27001 and what a consultant can do to help an organization achieve certification. It explains that ISO 27001 defines requirements for establishing, implementing, maintaining and improving an information security management system. The consultant's role would be to define security improvement objectives, identify key processes, understand customer requirements, perform a risk assessment and implement controls. It also provides details on some of the key aspects of ISO 27001 such as the domains of controls, statements of applicability, and mandatory documentation requirements.

    Copyright:

    © All Rights Reserved
    Download as PPTX, PDF, TXT or read online from Scribd
    Download as pptx, pdf, or txt
    401 views17 pages

    ISO 27001 Controls and Checklist - Mine

    Uploaded by

    Sonya
    The document discusses ISO 27001 and what a consultant can do to help an organization achieve certification. It explains that ISO 27001 defines requirements for establishing, implementing, maintaining and improving an information security management system. The consultant's role would be to define security improvement objectives, identify key processes, understand customer requirements, perform a risk assessment and implement controls. It also provides details on some of the key aspects of ISO 27001 such as the domains of controls, statements of applicability, and mandatory documentation requirements.

    Copyright:

    © All Rights Reserved
    Download as PPTX, PDF, TXT or read online from Scribd
    Download as pptx, pdf, or txt
    You are on page 1of 17

    ISO 27001 Checklist : 16

    ISO
    What is ISO 27001

     ISO 27001 defines the requirements as follows:


     Establishment of Information Security Management System [ISMS]
     Implementation of ISMS
     Maintenance and continual improvement of ISMS
     It presents a systematic approach to secure the sensitive information in an
    organization
    What the consultant needs to do for us

     Define the objectives to implement security improvement program


     Identify the firm’s key processes
     Understand customers’ requirements
     Define the scope by comparing the existing security with that of requirements as per
    ISO27001
     erform a risk assessment  Manage the identified risk  Implement controls  Prepare
    and apply for certifications
    Obtain management support
     The most important reason and the first one to sort out when commencing
    with ISO 27001. One of the main reasons why ISO 27001 certification projects
    fail – management is either not providing enough people to work on the
    project, or not enough money. (Read the article 
    Four key benefits of ISO 27001 implementation for ideas on how to present
    the case to management.)
     2. Treat it as a project
     As I already said, the implementation of an Information Security Management
    System (ISMS) based on ISO 27001 is a complex issue involving various activities
    and lots of people, lasting several months (or more than a year). If you do not
    clearly define what is to be done, who is going to do it, and in what time frame
    (i.e., apply project management), you might as well never finish the job. (Read
    the article ISO 27001 project – How to make it work for more about
    developing a successful ISO 27001 project.)
    ISO 27001 controls
    ISO
    Domains in ISO27001

     The controls list in Annex A is organized into 14 sections with a 114 controls :
     Controls related to organizational issues : 24 ( 21%)
     Controls related to human resources : 6 (5%)
     It-related controls : 61 (54%)
     Controls related to physical security : 15 (13%)
     Controls related to legal issues : 8 (7%)
    Domains in Annex A

    Issues Section/Domain

    Organizational Issues A.5, A.6, A.8, A.15

    Human Resources A.7

    IT related section A.9 A.10 A.12 A.13 A.14 A.16 A.17

    Physical Security A.11

    Legal Issues A.18


    Names of the 14 domains of ISO 27001

    Domain Domain Name Description


    Section
    Information security policies Controls on how the policies are written and reviewed
    A.5
    A.6 Organization of information security Controls on how the responsibilities are assigned ; also includes the
    controls for mobile devices and teleworking
    A.7 Human Resources security controls prior to employment, during, and after the employment
    A.8 Asset Management Inventory of assets and acceptable use; also for information
    classification and media handling
    A.9 Access control controls for the management of access rights of users, systems and
    applications, and for the management of user responsibilities
    A.10 Cryptography Controls related to encryption and key management
    Names of the 14 domains of ISO 27001- contd
    2
    Domain Domain Name Description
    Section
    A.11 Physical & Environmental Security controls defining secure areas, entry controls, protection against
    threats, equipment security, secure disposal, Clear Desk and Clear
    Screen Policy, etc.

    A.12 Operational Security controls related to the management of IT production: change


    management, capacity management, malware, backup, logging,
    monitoring, installation, vulnerabilities, etc.

    A.13 Communications Security controls related to network security, segregation, network services,
    transfer of information, messaging, etc.
    A.14 Systems acquisition, development and controls defining security requirements, and security in development
    maintenance and support processes
    Names of the 14 domains of ISO 27001- contd
    3
    Domain Section Domain Name Description
    A.15 Supplier relationships controls on what to include in agreements, and how to monitor th
    suppliers
    A.16 Information security incident controls for reporting events and weaknesses, defining
    management responsibilities, response procedures, and collection of evidence
    A.17 Information security aspects of business controls requiring the planning of business continuity, procedure
    continuity management verification and reviewing, and IT redundancy
    A.18 Compliance Controls requiring the identification of applicable laws and
    regulations, intellectual property protection, personal data
    protection, and reviews of information security
    Which controls apply to us

     The Statement of Applicability (SoA) is the main link between our information security
    risk assessment and treatment work, and will show ‘where’ and ‘how’ we have chosen to
    implement the controls and the control objectives
     Based on our risk assessments , we select the ones that are applicable to our organization,
    driven by our risks
     We will continue to add or delete from the 114 controls as we continue to build our ISMS
    specific to our organization
    SoA and forward….

     The risks around the valuable information and the processing facilities, devices,
    people involved etc is evaluated with the 
    Confidentiality, Integrity, and Availability (CIA) of information in mind. 
     Whilst we can consider the risks from our operations as drawn out from above, one
    of the control areas in Annex A that will always be applicable is the “Identification
    of applicable legislation and contractual requirements” in A.18.1.1.  
     This means we must consider the requirements of relevant laws, regulations and
    contractual requirements.  Impacts EU GDPR for EU Citizen customer information.
    Eventually we will also have to take into account other privacy standards like
    POPI in South Africa, LGPD in Brazil, and the CCPA in California. 
    nTask SoA

     At a minimum we will include :


     List of the 114 Annex A controls
     Whether the control is implemented or not
     Justification for its inclusion or exclusion
    Mandatory Documentation

     List
    Clauses in each Annex that are imp

     Annex A.5 – Information Security Policies


     Annex A.5.1 is about management direction for information security. The objective of this Annex is to manage direction and support for
    information security in line with the organisation’s requirements.
     Annex A.6 – Organisation of Information Security
     Annex A.6.1 is about internal organisation. The objective in this Annex A area is to establish a management framework to initiate and control
    the implementation and operation of information security within the organisation.
     Annex A.6.2 is about mobile devices and teleworking. The objective in this Annex A area is to establish a management framework to ensure
    the security of teleworking and use of mobile devices.
     Annex A.7 – Human Resource Security
     Annex A.7.1 is about prior to employment. The objective in this Annex is to ensure that employees and contractors understand their
    responsibilities and are suitable for the roles for which they are considered.
     Annex A.7.2 – the objective in this Annex is to ensure that employees and contractors are aware of and fulfil their information security
    responsibilities during employment.
     Annex A.7.3 is about termination and change of employment. The objective in this Annex is to protect the organisation’s interests as part of the
    process of changing and terminating employment.

    You might also like