Use: ISO 27001 in 10 steps - Slide Deck

<!--- Intro -->

Hello and welcome! 

In this 7 minute video you will learn 
what ISO 27001 *is*,
how it can benefit your organization, 
how you should implement it, 
and how you can get certified.

I'm Richard Kranendonk.


---
<!--- # Benefits -->
<!--- [[ISO 27001 in 220 - slide 1 - Benefits]] -->
 
ISO 27001 is an internationally recognized standard for information security management.

Having a certificate will make sales easier in B2B markets, 

and if well implemented ISO27k1 will increase your resilience against cybersecurity threats ... 

and raise your maturity level from incident driven to continual improvement.



---
<!--- # Structure -->
<!--- [[ISO 27001 in 220 - slide 2 - Structure]] -->


27k1 consists of 2 parts.

A process to manage information security, called the ISMS, 

and a list of controls to mitigate information security risks, called Annex A. 

---
<!--- Process -->
<!--- [[ISO 27001 in 220 - slide 3 - Risk management process]] -->

The ISMS, which stands for Information Security Management System,
is an iterative process for managing your security risks and implementing continual improvement.

You start with identifying and analysing your risks

Then you select controls to mitigate those risks, and implement them

You Monitor the execution of the Controls to see if they work

and evaluate how effective they are in lowering your risks.

You then enter the next cycle by re-analysing the risk, and adjusting your controls where necessary. 

---
<!--- # Context -->
<!--- [[ISO 27001 in 220 - slide 4 - Context of the ISMS]] -->

To implement this process, you have to establish the context in which the ISMS will operate.

You have to identify the factors that influence your information security risks, including:
- macro-environmental factors (like political and legal developments, demographic trends, economic and technological developments)
- your organization's strategy and culture
- strengths and weaknesses of your organization
- different internal and external stakeholders, and their interests
- laws, regulations, and standards that apply to your business
- and your business processes themselves.

You also need to set the Scope of your ISMS, which means defining which business activities you're seeking certification for.

---
<!--- # Responsibilities -->
<!--- [[ISO 27001 in 220 - slide 5 - Responsibilities]] -->

ISO27k1 makes top management responsible for the success of the ISMS, by:
- demanding it shows leadership and commitment
- setting information security objectives 
- making shure information security policies are implemented and adhered to
- defining relevant roles and assigning responsibilities
- and providing the necessary resources and support.


---
<!--- # The CIA Triad -->
<!--- [[ISO 27001 in 220 - slide 6 - The CIA Triad]] -->
 
Managing information security means paying respect to the CIA Triad of Confidentiality, Integrity and Availability. The importance of each principle may vary for different kinds of information.

---
<!--- # Assets -->
<!--- [[ISO 27001 in 220 - slide 7 - Assets]] -->

To identify *what* needs to be protected, you need to create an Asset Inventory, 
and identify the *impact* of loss of confidentiality, integrity and availability on your different information assets. 
You need to organize your assets into categories, classify them, and label them, so that it's clear how they must be handled.


---
<!--- # Risks -->
<!--- [[ISO 27001 in 220 - slide 8 - Risks]] -->

When you *know* your assets, you can identify your *risks*. 
Risk is a function of the probability that a negative event will occur, and the impact the event will have, *once* it occurs. 

This *risk score* helps you set priorities for treatment.

Risk Treatment means either *mitigating* the risk, by implementing a control,
*transfering* the risk to another party, 
*avoiding* the risk, by not performing the activities associated with it, 
or *accepting* the risk.
 

---
<!--- # Controls -->
<!--- [[ISO 27001 in 220 - slide 9 - Controls]] -->


For every risk that you decide to mitigate, 
you must select one or more appropriate Controls from Annex A.

Annex A lists 114 controls, 
including physical controls, like access to facilities,
logical controls, like backups and encryption,
and organizational controls, such as instruction and vendor management.

Every control needs to be applied in your organization, unless you can convincingly argue that they should not apply to you. 
This is done in your Statement of Applicability.



---
<!--- # Documentation -->
<!--- [[ISO 27001 in 220 - slide 10 - Documentation]] -->

27k1 mandates that you document your activities with regards to the ISMS, as proof of the actual implementation. This documentation is the main focus of certification audits.

Required documentation includes:
- Information security Policies
- Analyses of risks, incidents and non-conformities
- Log files, measurements, and evaluation reports
- and Planning, for implementation, evaluations, and audits 


---
<!--- # Management Review -->
<!--- [[ISO 27001 in 220 - slide 11 - Management Review]] -->

A Management Review must periodically be conducted by 'top management' and must include:

- the status of actions from previous management reviews;
- changes in internal and external issues;
- feedback from interested parties;
- results of risk assessments and treatment plans
- an assessment of the effectiveness of the ISMS as a whole
- and decisions about necessary changes and possible improvements.


---
<!--- # Certification -->
<!--- [[ISO 27001 in 220 - slide 12 - Certification]] -->

The Certification Audit consists of a review of the documentation mentioned in this video, and additional observations and interviews. 
It takes anywhere from 3 days to 4 weeks, depending on the size of the organization.
The result is a report with observations and minor, and possibly major, non-conformities. 
You get 90 days to resolve the issues, after which you will be issued your certificate.

The certificate is valid for 3 years, during which there will be 2 Surveillance audits. You need to re-certify every 3 years.

---
<!--- # Recapitulate -->
<!--- [[ISO 27001 in 220 - slide 12A - Recapitulate]] -->

To summarize, these are the 15 steps to implement ISO 27001 and get your certificate:

1. Involve Top Management 
2. Define the context of the ISMS
3. Set the Scope and Objectives
4. Establish a Team and assign Responsibilities
5. Initiate the ISMS process through regular Team Meetings
6. Create an Information Asset Inventory
7. Identify business impact of compromise to Assets
8. Classify Information Assets
9. Identify and analyse Risks
10. Determine Risk Treatment
11. Select and Implement Controls
12. Draft information security policies 
13. Collect or create other required documentation
14. Conduct Management Reviews
15. Request a Certification Audit

---
<!--- # Closing -->
<!--- [[ISO 27001 in 220 - slide 13 - Closing]] -->

So, there you have it, the short introduction to getting your ISO 27001 certification!

Please share this video with those who might benefit. 

You can download the slide deck used in this video at ISO27DIY.com, where you will also find additional resources for implementing ISO 27001 in *your* organization.

