[Introduction to the workshop series](ISO27DIY%20Workshop%200%20-%20Introduction%20to%20the%20ISO27DIY%20workshop%20series.md)

Understanding ISO 27001

[Preparing the implementation project](ISO27DIY%20Workshop%201%20-%20Preparing%20the%20project.md)

[Project kickoff meeting](ISO27DIY%20Workshop%202%20-%20Project%20kickoff%20meeting.md)

A. Context and Scope
	1. [[ISO27DIY Video A.1 Context and Scope - External issues]]
	2. [ISO27DIY Video A.2 Context and Scope - Stakeholders](ISO27DIY%20Video%20A.2%20Context%20and%20Scope%20-%20Stakeholders.md)
	3. [ISO27DIY Video A.3 Context and Scope - Regulations and Contracts](ISO27DIY%20Video%20A.3%20Context%20and%20Scope%20-%20Regulations%20and%20Contracts.md)
	4. [ISO27DIY Video A.4 Context and Scope - Internal issues](ISO27DIY%20Video%20A.4%20Context%20and%20Scope%20-%20Internal%20issues.md)
	5. [ISO27DIY Video A.5 Context and Scope - Scope statement](ISO27DIY%20Video%20A.5%20Context%20and%20Scope%20-%20Scope%20statement.md)
	6. [ISO27DIY Video A.6 Context and Scope - Roundup](ISO27DIY%20Video%20A.6%20Context%20and%20Scope%20-%20Roundup.md)

B. Business Processes and Information Assets
	1. [ISO27DIY Video B.1 Processes and Assets - Business processes](ISO27DIY%20Video%20B.1%20Processes%20and%20Assets%20-%20Business%20processes.md)
	2. [ISO27DIY Video B.2 Processes and Assets - Interfaces and dependencies](ISO27DIY%20Video%20B.2%20Processes%20and%20Assets%20-%20Interfaces%20and%20dependencies.md)
	3. [ISO27DIY Video B.3 Processes and Assets - Asset Inventory](ISO27DIY%20Video%20B.3%20Processes%20and%20Assets%20-%20Asset%20Inventory.md)

C. Risks and Treatment
	1. [ISO27DIY Video C.1 Risks and Treament - Risk Identification](ISO27DIY%20Video%20C.1%20Risks%20and%20Treament%20-%20Risk%20Identification.md)


[[ISO27DIY Workshop 6 Controls selection | Select and Implement Controls]]
Select and Implement Controls
	- Identify all controls from Annex A necessary for the chosen risk treatment;
	- Draft a 'Statement of Applicability' for the Annex A controls;
	- Plan the implementation ('risk treatment plan').
	- Introducing the [ISO27DIY implementation dashboard](🏺%20ISO27DIY%20Artefacts/ISO27DIY%20implementation%20dashboard.md)

[[ISO27DIY Workshop 7 ISMS documentation | Document the ISMS activities]]
Document the ISMS activities
	- Write information security policies
	- Record risk analyses and treatment decisions
	- Register incidents and non-conformities
	- Collect log files, measurements, and evaluation reports
	- Plan implementation, evaluations, and audits.

Identify or Plan Remaining Controls

[[ISO27DIY Workshop 8 Management Reviews|Conduct Management Reviews]]
Conduct Management Reviews
	Review:
	• Status of actions
	• External and Internal Changes
	• Feedback from Stakeholders
	• Risk assessment results and Treatment plans
	• Effectiveness of the ISMS
	• Decisions on changes and improvements.


[[ISO27DIY Workshop 9 Certification|Prepare for Certification]]
Prepare for Certification
- Internal audit - [Conducting an internal audit](../../../../../../💡Permanent%20ideas/Conducting%20an%20internal%20audit.md)
- [ISO27DIY Workshop X - Certification](ISO27DIY%20Workshop%20X%20-%20Certification.md)


# Previous art

There's this workshop structure document for NHC clients: ![](ISO%2027001%20workshop%20onderwerpen.docx)

I've made several sets of slide decks for workshops. Those for Kaliber, Nedap and Networking4AL are the most recent.
