ISO 27001:2013

  1. Home
  2. ISO 27001:2013

ISO 27001:2013

What is ISO 27001?

ISO 27001 (formally known as ISO/IEC 27001:2005) is a specification for an information security management system (ISMS). An ISMS is a framework of policies and procedures that includes all legal, physical and technical controls involved in an organisation's information risk management processes.     

 

Certification

An ISMS may be certified compliant with ISO/IEC 27001 by a number of Accredited Registrars worldwide.[6] Certification against any of the recognized national variants of ISO/IEC 27001 (e.g. JIS Q 27001, the Japanese version) by an accredited certification body is functionally equivalent to certification against ISO/IEC 27001 itself.

In some countries, the bodies that verify conformity of management systems to specified standards are called "certification bodies", while in others they are commonly referred to as "registration bodies", "assessment and registration bodies", "certification/ registration bodies", and sometimes "registrars".

The ISO/IEC 27001 certification,[7] like other ISO management system certifications, usually involves a three-stage external audit process defined by the ISO/IEC 27021[8] and ISO/IEC 27006[9] standards:

Stage 1 is a preliminary, informal review of the ISMS, for example checking the existence and completeness of key documentation such as the organization's information security policy, Statement of Applicability (SoA) and Risk Treatment Plan (RTP). This stage serves to familiarize the auditors with the organization and vice versa.

Stage 2 is a more detailed and formal compliance audit, independently testing the ISMS against the requirements specified in ISO/IEC 27001. The auditors will seek evidence to confirm that the management system has been properly designed and implemented, and is in fact in operation (for example by confirming that a security committee or similar management body meets regularly to oversee the ISMS). Certification audits are usually conducted by ISO/IEC 27001 Lead Auditors. Passing this stage results in the ISMS being certified compliant with ISO/IEC 27001.

Ongoing involves follow-up reviews or audits to confirm that the organization remains in compliance with the standard. Certification maintenance requires periodic re-assessment audits to confirm that the ISMS continues to operate as specified and intended. These should happen at least annually but (by agreement with management) are often conducted more frequently, particularly while the ISMS is still maturing.

Structure of the standard

The official title of the standard is "Information technology — Security techniques — Information security management systems — Requirements"

ISO/IEC 27001:2013 has ten short clauses, plus a long annex, which cover:

1. Scope of the standard

2. How the document is referenced

3. Reuse of the terms and definitions in ISO/IEC 27000

4. Organizational context and stakeholders

5. Information security leadership and high-level support for policy

6. Planning an information security management system; risk assessment; risk treatment

7. Supporting an information security management system

8. Making an information security management system operational

9. Reviewing the system's performance

10. Corrective action

Annex A: List of controls and their objectives

This structure mirrors other management standards such as ISO 22301 (business continuity management) and this helps organizations comply with multiple management systems standards if they wish. Annexes B and C of 27001:2005 have been removed.

Controls

Clause 6.1.3 describes how an organization can respond to risks with a risk treatment plan; an important part of this is choosing appropriate controls. A very important change in ISO/IEC 27001:2013 is that there is now no requirement to use the Annex A controls to manage the information security risks. The previous version insisted ("shall") that controls identified in the risk assessment to manage the risks must have been selected from Annex A. Thus almost every risk assessment ever completed under the old version of ISO/IEC 27001 used Annex A controls but an increasing number of risk assessments in the new version do not use Annex A as the control set. This enables the risk assessment to be simpler and much more meaningful to the organization and helps considerably with establishing a proper sense of ownership of both the risks and controls. This is the main reason for this change in the new version.

There are 114 controls in 14 groups and 35 control categories:

A.5: Information security policies (2 controls)

A.6: Organization of information security (7 controls)

A.7: Human resource security - 6 controls that are applied before, during, or after employment

A.8: Asset management (10 controls)

A.9: Access control (14 controls)

A.10: Cryptography (2 controls)

A.11: Physical and environmental security (15 controls)

A.12: Operations security (14 controls)

A.13: Communications security (7 controls)

A.14: System acquisition, development and maintenance (13 controls)

A.15: Supplier relationships (5 controls)

A.16: Information security incident management (7 controls)

A.17: Information security aspects of business continuity management (4 controls)

A.18: Compliance; with internal requirements, such as policies, and with external requirements, such as laws (8 controls)

The controls reflect changes to technology affecting many organizations—for instance, cloud computing—but as stated above it is possible to use and be certified to ISO/IEC 27001:2013 and not use any of these controls.

 

 

Benefits of ISO 27001


Implementing an information security management system will provide your organisation with a system that will help to eliminate or minimise the risk of a security breach that could have legal or business continuity implications.

An effective ISO 27001 information security management system (ISMS) provides a management framework of polices and procedures that will keep your information secure, whatever the format.

Following a series of high profile cases, it has proven to be very damaging to an organisation if information gets into the wrong hands or into the public domain. By establishing and maintaining a documented system of controls and management, risks can be identified and reduced.

Achieving ISO 27001 certification shows that a business has:

  • Protected information from getting into unauthorised hands
  • Ensured information is accurate and can only be modified by authorised users
  • Assessed the risks and mitigated the impact of a breach
  • Been independently assessed to an international standard based on industry best practices


ISO 27001 certification demonstrates that you have identified the risks, assessed the implications and put in place systemised controls to limit any damage to the organisation.

Benefits include:

  • Increased reliability and security of systems and information
  • Improved customer and business partner confidence
  • Increased business resilience
  • Alignment with customer requirements
  • Improved management processes and integration with corporate risk strategies

Mandatory Documents

  • Scope of the ISMS (clause 4.3)
  • Information security policy and objectives (clauses 5.2 and 6.2)
  • Risk assessment and risk treatment methodology (clause 6.1.2)
  • Statement of Applicability (clause 6.1.3 d)
  • Risk treatment plan (clauses 6.1.3 e, 6.2, and 8.3)
  • Risk assessment report (clauses 8.2 and 8.3)
  • Definition of security roles and responsibilities (clauses A.7.1.2 and A.13.2.4)
  • Inventory of assets (clause A.8.1.1)
  • Acceptable use of assets (clause A.8.1.3)
  • Access control policy (clause A.9.1.1)
  • Operating procedures for IT management (clause A.12.1.1)
  • Secure system engineering principles (clause A.14.2.5)
  • Supplier security policy (clause A.15.1.1)
  • Incident management procedure (clause A.16.1.5)
  • Business continuity procedures (clause A.17.1.2)
  • Statutory, regulatory, and contractual requirements (clause A.18.1.1)
  • And here are the mandatory records:
  • Records of training, skills, experience and qualifications (clause 7.2)
  • Monitoring and measurement results (clause 9.1)
  • Internal audit program (clause 9.2)
  • Results of internal audits (clause 9.2)
  • Results of the management review (clause 9.3)
  • Results of corrective actions (clause 10.1)
  • Logs of user activities, exceptions, and security events (clauses A.12.4.1 and A.12.4.3)

 

 

 

Non-mandatory documents

  • There are numerous non-mandatory documents that can be used for ISO 27001 implementation, especially for the security controls from Annex A. However, I find these non-mandatory documents to be most commonly used:
  • Procedure for document control (clause 7.5)
  • Controls for managing records (clause 7.5)
  • Procedure for internal audit (clause 9.2)
  • Procedure for corrective action (clause 10.1)
  • Bring your own device (BYOD) policy (clause A.6.2.1)
  • Mobile device and teleworking policy (clause A.6.2.1)
  • Information classification policy (clauses A.8.2.1, A.8.2.2, and A.8.2.3)
  • Password policy (clauses A.9.2.1, A.9.2.2, A.9.2.4, A.9.3.1, and A.9.4.3)
  • Disposal and destruction policy (clauses A.8.3.2 and A.11.2.7)
  • Procedures for working in secure areas (clause A.11.1.5)
  • Clear desk and clear screen policy (clause A.11.2.9)
  • Change management policy (clauses A.12.1.2 and A.14.2.4)
  • Backup policy (clause A.12.3.1)
  • Information transfer policy (clauses A.13.2.1, A.13.2.2, and A.13.2.3)
  • Business impact analysis (clause A.17.1.1)
  • Exercising and testing plan (clause A.17.1.3)
  • Maintenance and review plan (clause A.17.1.3)
  • Business continuity strategy (clause A.17.2.1)

 

FAQ

An ISMS (information security management system) provides a systematic approach for managing an organisation’s information security. It’s a centrally managed framework that enables you to manage, monitor, review and improve your information security practices in one place.
An ISMS is designed to protect the entire organisation by providing a framework for managing information security risks. It includes policies and procedures for identifying, assessing and managing risks to information security, and for incident response and recovery.
There are three costs to becoming certified: internal costs (e.g., resource cost), consulting costs for preparation, and certification costs. The costs can vary notably based on the ISMS scope, ISMS gap assessment, resource capabilities, and the project schedule
1. It will protect your reputation from security threats 2. You’ll avoid regulatory fines 3. It will protect your reputation 4. It will improve your structure and focus 5. It reduces the need for frequent audits
1. Implement a security management system (ISMS) 2. Conduct a risk assessment 3. Develop security policies and procedures 4. Implement controls to mitigate identified risk 5. Monitor and review the effectiveness of the ISMS 6. Maintain records of the ISMS 7. Communicate the ISMS to all employees 8. Train employees on the ISMS
It helps organisations avoid potentially costly security breaches. ISO 27001-certified organisations can show customers, partners and shareholders that they have taken steps to protect data in the event of a breach. This can help minimise the financial and reputational damage caused by a data breach.
1. Create a project plan 2. Efine the scope of your ISMS 3. Perform a risk assessment and gap analysis 4. Design and implement policies and controls 5. Complete employee training 6. Document and collect evidence 7. Complete an ISO 27001 certification audit 8. Maintain continuous compliance
1. Scope of the ISMS 2. Information security policy and objectives 3. Risk assessment and risk treatment methodology 4. Statement of Applicability 5. Risk treatment plan 6. Risk assessment report 7. Definition of security roles and responsibilities 8. Inventory of assets 9. Acceptable use of assets 10. Access control policy 11. Operating procedures for IT management 12. Secure system engineering principles 13. Supplier security policy 14. Incident management procedure 15. Business continuity procedures 16. Statutory, regulatory, and contractual requirements
There are three costs to becoming certified: internal costs (e.g., resource cost), consulting costs for preparation, and certification costs. The costs can vary notably based on the ISMS scope, ISMS gap assessment, resource capabilities, and the project schedule

ISO Certification List

Download Brochures

Quick Contact