Related: [ISO27DIY Manifesto](ISO27DIY%20Manifesto.md)

The essence of the ISO 27001 standard is mitigating known information security risks by implementing applicable controls for risk mitigation from a pre-defined set (the Annex A).

To get certified, an organization must be able to prove adequate implementation of a) a set of risk management processes, and b) a set of risk mitigating controls. You can prove this implementation to an auditor by producing relevant documentation in respons to the auditors questions. 

Documentation can have the form of plans, policies, communication, analyses, evaluations, meeting minutes, logs and reports, etc. In ISO27DIY, we use the term  'Artifacts'.

The ISO27DIY method focuses on producing all necessary artifacts to successfully pass an ISO 27001 certification audit. [^id]

[^id]: At this point any ISO 27001 consultant will rightfully argue that information security is not about producing documents, but about thinking and doing security. The truth is it would take a considerable effort to consistently produce all the required proof *without* actually doing it. And that *if* you're actually doing security, it's not that hard to produce a consitent set of required documentation. there's not much point in faking it.

Each Session treats one or more ISMS 'topics'.

In every ISMS topic, Actions that have to be executed/performed are identified.

The Actions have to be defined within the organizational context, in organization-specific Policies.

The Actions to be executed/performed need to be Planned and Documented.

So there's **Actions, and Artifacts**:
- Plans
- Policies
- Documents – reviews, analyses, reports, logs, checklists, etc.

### Artifacts
Artifacts have:
- a version number and date, to establish ...
- an owner and producer: someone who's responsible for ... and someone who's responsible for ...
- a period/frequency/cycle length – because of the iterative nature of the ISO 27001 ISMS
- a 'next execution' date for actions
- a 'next review' date for policies
- A a 'reviewer' – can be a person or a committee / meeting

Artifacts are tagged with:
- the standard's Controls or Clauses that are addressed with the Artifact in question
- the ['phase'](ISO27DIY%20ISMS%20Cycle.md) the Artifact is proof of: Plan, Implement, Execute, Evaluate, Adapt <- at least define 'Implement' to include Execution

The purpose of this tagging is to make auditing easier and to produce an [Implementation Dashboard](🏺%20ISO27DIY%20Artefacts/ISO27DIY%20implementation%20dashboard.md) to get an overview of progress and gaps.

Artifacts have a written ISO27DIY Recipe on how to create them. The Recipe is a plain English translation of the original ISO 27002 Implementation Guidance, augmented with examples and learnings from practice.

### Policies
Policies are a subset of Artifacts and will typically have the following content:
*To mitigate the risk of X, controls A, B and C will be implemented on asset Y by Responsible Z. The effectiveness will be measured through P and will be evaluated by Q according to method R, following planning S*. 

See [ISO27DIY Policy Card template](📒%20Templates/ISO27DIY%20Policy%20Card%20template.md)

### Risks
Risks need to have:
- associated information asset
- Analysis
- Treatment
- mitigating control(s)

### Controls
Controls (need to) have:
- associated risk
- Implementation plan
- Evaluation
- etc.


### Standard requirements 
Take into consideration that there are specific requirements for 'documented information', see:
- [ISO_27001_OT C 7.5.2 Creating and updating](../ISO%2027001%202013/ISO_27001_OT%20C%207.5.2%20Creating%20and%20updating.md)
- [ISO 27001 C 7.5.3 Control of documented information](../ISO%2027001%202013/ISO%2027001%20C%207.5.3%20Control%20of%20documented%20information.md)
- [ISO 27001 A 5.1.1 Policies for information security](../ISO%2027001%202013/ISO%2027001%20A%205.1.1%20Policies%20for%20information%20security.md)

- - [Advised Documents for ISO 27001](../../../../../../iso27DIY-gis/reference/Advised%20Documents%20for%20ISO%2027001.md)


## Tooling provisions
- [About ISO27DIY Policy Cards](../About%20ISO27DIY%20Policy%20Cards.md)
- [ISO27DIY Kanban board](ISO27DIY%20Kanban%20board.md)

## Related
- Each session should follow a set [ISO27DIY Workshop Overview template](📒%20Templates/ISO27DIY%20Workshop%20Overview%20template.md).
- Sessions should target the [ISO27DIY Target audience](ISO27DIY%20Target%20audience.md).
- [ISO27DIY Additional resources](ISO27DIY%20Additional%20resources.md)
- [[List of ISO 27001 articles per Session]]
