ISO 27001 Implementation

We start the process by undertaking a detailed gap analysis of the organisation and its approach to controlled security measures.

The assessment is done aligned to the control requirements of the ISO 27001 standard.

Once the gaps are reviewed and documented, the next step is to apply the required controls.

This is documented in a ‘statement of applicability’ which defines how the standard is going to apply to your organisation.

Note – this is one of the major documents in the ISO 27001 standard.

At this point, we have understood the gaps in compliance and we have documented and agreed the controls we need to implement.

The obvious next step is to develop a suitable plan for control implementation, the required change management and target operating model changes that will be required.

ISO 27001 requires there to be strong and effective governance in place around information security in general but specifically relating to the Information Security Management System (ISMS).

Typically, we would establish a security working group e.g. Information Security Working Group (ISWG) and our lead implementer would chair the meetings for the duration of the implementation.

We would then adopt our ISO 27001 toolkit of documentation to fast track this key stage of the implementation.

Documentation would need to be fully aligned with the desired working practices and involves significant effort to review and refine as required.

Apart from documentation, the standard requires a significant change to many IT operational processes and procedures.

The lead implementer is heavily involved at this stage in managing that change within the organisation.

Usually after a few months the organisation is ready for its internal audit.  This is then undertaken as if it was a certification audit and requires a total review of the implementation.

The audit findings are then produced and a report is issued with all observations and any non-conformities.

Once the internal audit has been completed successfully, the organisation is then ready for its external certification audit which is undertaken by an authorised third-party.

We are on hand to support our clients during this phase of the implementation including being in attendance during the actual certification audit itself.