are you ready for iso27001 - missing the linq€¦ · · 2017-06-06are you ready for...

AREYOUREADY

FOR

ISO27001:2013ASimpleGuide

ABSTRACTIfyou’rethinkingaboutimplementingISO27001:2013,thenthisguidewillhelpyoumakeanassessmentofwhetheryou’rereadytofacethechallengesahead

MISSINGTHELINQ2016

AREYOUREADYFORISO27001:2013

MISSINGTHELINQ2016 2

AREYOUREADYFORISO27001:2013?

ASIMPLEGUIDE

INTRODUCTION

Ifyou’rethinkingaboutimplementingISO27001:2013,thenthisguidewillhelpyoumakeanassessmentofwhetheryouarereadyforISO27001:2013.

Byaskingafewsimplequestions,itwillenableyoutomaketherightdecisionforyouandyourbusinessandhelpyouavoidmakingacostlymistake.

FollowtheAreYouReadyforISO27001:2013–ASimpleGuidetolearnwhatisrequired.

Ifyouwantmoredetailedinformationorhelpinjumpstartingyouraccreditationprocessthengotoourwebsitewww.missingthelinq.comformoreinformationorsendusanemailatcontact@missingthelinq.com



QUESTION1–ISYOURMANAGEMENTTEAMCOMMITTED?

Unlessyouhavethebackingoftheseniormanagementteamand/oramemberoftheseniorteammanagementleadingtheprojectitwillfail.

Theyshouldbethedrivingforcebehindtheprogramme,theyneedtocompletelyunderstandthestrategicissuesaroundITgovernanceandinformationsecurityandthevalueofsuccessfulcertification.Iftheseniormanagementarenotbehindthisproject,thereislittlepointinproceeding,certificationwillnotbeawardedwithoutclearevidenceofsuchcommitment.

ManagementsupportisveryimportantasanISMSprojectcutsacrossallpartsofanorganisation,andthereforeallkeyleadersneedtobeonside.

QUESTION2–DOYOUHAVEAGOODBUSINESSCULTURE?

WithoutStaffBuy-inyouwillnotachievetheoutcomesrequired,IS27001:2013isaboutbusinesschangeandthoseaffectedbychangeneedtobeon-board.

Everyonewillanswerthisquestionwithapositive,allpeoplebelievethattheyhaveagoodbusinesscultureandsomewillevenbelievetheyhavethebestbusinessculture.However,youhavetoanswerthisquestionhonestly.

Aprofessionalorganisationisonewhereeveryoneknowswhattheyareresponsiblefor,whytheydoitandwhatisexpectedfromthem.Anopennesstochangeisabenefitwhenadoptingstandardsaswellasgoodcommunicationandhighlevelsofstaffengagement.



QUESTION3–AREYOUALREADYMEETINGTHEREQUIRMENTS?

Awellorganisedcompany,withgoodstructureandorganisationandsupportingprocessesandpeopleopentochangeandwilingtolearnmay

alreadybeonthepathtoaccreditation.

Inordertounderstandhowfaryourorganisationisfromaccreditationandhowmuchworkisrequiredtoachieveit,itisworthgettingholdofacopyofthestepbystepguidestoimplementingISO27001:2013thiswillgiveyouasimpleintroductiontotheStandardandaninsightofwhatisrequired.

Furthermore,itisrecommendedbeforecommittingyourselftothefullprojectthatagapanalysisisperformed.Atop-downapproachissuggestedasthiswillgettothecriticalloopholesquicklyandidentifygapsupfrontbeforeembarkingonacostlyproject.

ThiscanbedoneusingtheStatementofApplicability(SoA)asguidanceonwhichcontrolsneedtobeputinplaceandonwhichthemanagementsystemswillbebased.

QUESTION4–DOYOUHAVEAVAILABLEBUDGET&RESOURCES?

FailtoPlan,PlantoFail-ofcoursewhileitisnecessary,itisnotsufficienttojusthaveaplan,havingtherightlevelofresourceandbudgetiscriticalwhen

implementingtheproject.

NoteveryorganisationcanaffordtheluxuryofadedicatedInformationSecurityOfficer,oraSecurityManager,nordoeseveryorganisationhavetheskillsorcompetenciesin-housetodelivertheproject.

Likewise,somemayhaveimplementedtheISOstandardinapreviousrole,orhavebackgroundsincreatingmanagementsystems.

ThegoodnewsisthatpeopleofalltypeshavesuccessfullyimplementedISO27001:2013andachievedcertification,itmaytakealittlelongerdependingonexperience.



QUESTION5–WHATARETHERISKS/COSTSOFNOTBEINGACCREDITED?

RiskassessmentisattheheartoftheStandardandmustbebusinessdriven,itshouldreflectlegal,regulatoryandcontractualrequirements,understanding

whattherisksaretothebusinessnotbeingaccreditedarecrucial.

Therequirementultimatelyisthattheriskassessmentshouldtakeintoaccountboththeorganisationscontextaswellasrequirementsofthirdpartieswhomayhaveaninterest.

Theorganisationneedstodetermineitscriteriaforacceptingrisksandidentifythelevelsofriskitiswillingtoaccept.Ariskassessmentisaprocessthatcombinesriskanalysisandriskevaluation.Riskanalysisistheuseofinformationtoestimaterisk.

Riskevaluationistheprocessofcomparingtheestimatedriskagainstgivenriskcriteriatodetermineitssignificance

Inotherwords;whatistherealisticlikelihoodofariskoccurring,andtheharmlikelytoresultfromtherisk.

QUESTION6–WILLITMAKEYOUABETTERBUSINESS?

Thefinalquestionyoushouldaskyourself,isgoingthroughallthehardwork,timeandeffortacrossallpartsoftheorganisation,implementingchangeand

controlsgoingtomakeyouabetterbusiness?

AlotofworkandcommitmentisgoingtoberequiredtoimplementISO27001:2013,alotofchangewillneedtobemanagedacrossalotoftheorganisationandthereforetherehastobeatangiblebusinessbenefit,whichismeasurableandquantifiable.

AcknowledgingthatISO27001:2013‘isagoodidea’,ordoingtheprojectforthetickintheboxisnotthereasontoputtheorganisationthroughthechangesrequired.Therewillbemorebeneficialprojectstoworkonwhichwillhavebiggerreturnsoninvestment,howeverdependingontheanswerstotheabove5questionsitwillgiveyouagoodindicationofwherethisprojectssitsintermsofprioritisationandwhetheritfitsinyourorganisationsstrategyornot.



GLOSSARYOFTERMS

StatementofApplicability(SoA)–IsoneofthekeydocumentsintheISO27001:2013Standard.Itidentifiesthecontrolsrelevanttothebusinessandexplainswhythosecontrolshavebeenselectedtotreattheidentifiedrisks.

TheSoAdefineshowtheinformationsecurityprogrammewillbeimplementedandisthelinkbetweentheriskassessmentandimplementationoftheinformationsecurityprocesses.TheSoAexplainswhichofthesuggested114controlsfromAnnexAwillbeappliedandjustifiesanyexcludedcontrols.

RiskAssessment–Ariskassessmentcombinestwotechniquesariskanalysisandariskevaluation.

RiskAnalysis-Usesinformationtoidentifypossiblesourcesofrisk.Itusesinformationtoidentifythreatsoreventsthathaveaharmfulordetrimentalimpact.Itthenestimatestheriskbyaskingwhatistheprobabilityofthateventoccurring,andwhatimpactwouldithaveifitoccurred?

RiskEvaluation–Comparestheestimatedriskwithasetofriskcriteria.Thisisdonetodeterminehowsignificanttheriskreallyis.

RiskAcceptance–IspartoftheRiskTreatmentdecisionmakingprocess,meaningtheriskisacceptablegivencertaincontrolsareinplaceortheriskhasbeenmitigatedinsomeotherway.

Controls–Inthecontextofinformationsecuritymanagement,acontrolisanyadministrative,managerial,technical,orlegalmethodthatisusedtomodifyormanageinformationsecurityrisk.Controlscanincludethingssuchaspractises,processes,policiesandorganisationstructures.Controlsaresometimesreferredtoasksafeguardsorcountermeasures.

InformationSecurityManagementSystem(ISMS)–Includesallofthepolicies,procedures,documents,records,plans,guidelines,agreements,contracts,processes,practises,methods,activities,roles,responsibilities,relationships,tools,techniques,technologies,resourcesandstructuresthatareusedtoprotectandpreserveinformation,tomanageandcontrolinformationsecurityrisksandtoachievebusinessobjectives.



MissingtheLinq9FarncombeLaneOakwoodDerbyDE212AYRegisteredinEnglandandWalesNo.9832076

WEB:www.missingthelinq.com EMAIL:[email protected]

are you ready for iso27001 - missing the linq€¦ · · 2017-06-06are you ready for...

Documents