	Use [[ISO 27001 in 10 steps - Slide Deck]]

# Introduction 220
Hello and welcome to ISO 27001 in 2 minutes and 20 seconds.

I'm Richard Kranendonk.

In this video I will explain what ISO 27001 is, how it can benefit you, how you can implement it in your organization, and how you can get certified.

So let's go.

**-> Slide**

# ISO 27001 and it's benefits

ISO 27001 is an internationally recognized standard for information security management, developed and maintained by the International Organization for Standardization, located in Geneva, Switzerland.

Having an ISO 27k1 certificate is a knock-out criterium for most vendor selection shortlists, and as such is rapidly becoming a 'license to operate' in B2B environments.

Being certified will speed up purchasing processes, and help win your client's trust.

There are also additional benefits:
- if well implemented, ISO27K1 will raise your maturity level from incident driven to continual improvement.
- your company will be more resilient against cybersecurity threats.
- and of course there's the aspect social responsibility

So, let's take a closer look at the standard itself.

**-> Slide**

Related note: [ISO 27001 benefits](ISO%2027001%20benefits.md)


# Structure of ISO 27001 

The ISO 27k1 consists of 2 parts:
- a process to identify, manage and document information security risks, called the ISMS or Information Security Management System.
- a list of controls to mitigate (or control) the risks you've identified, called "Annex A"

The process part is described in chapters 4 through 10, and the controls are listed in an addendum called ''Annex A"

Let's start with the process.

**-> Slide**


# Risk management process

ISO 27001 describes a cyclic, iterative process for managing your security risks. This is usually linked to the so called Deming cycle with its 4 steps of Plan, Do, Check, Act, but I find these a bit to abstract and confusing, so I prefer the following:

1. Identify and Analyse Risks
2. Define and Implement Controls (putting measures in place to mitigate those risks)
3. Monitor (the execution of the Controls)
4. Evaluate (the effectivity of the controls in lowering your risks)

... and then you enter the next cycle by re-analysing the risk, and adjusting your controls where necessary. This process of continous improvement is a core requirement of ISO 27001. 

You may also gather from this slide that the ISO 27001 standard is at its core a Risk Management framework.

Now, the essence of acquiring and keeping an ISO 27001 certificate, is that you are able to proof that you are actually executing this cycle. You do this by creating and maintaining documentation:

ADD ARTEFACTS TO MANAGEMENT CIRCLE
Identify and Analyse Risks			| Risk Analysis
Define and Implement Controls	| Policies and Implementation Plans for Controls
Monitor 										| Reports and Logs		
Evaluate										| (formal) Evaluations or for instance Meeting Notes

This documented set of processes is commonly referred to as the Information Security Management System, or ISMS.

**-> Slide**

The ISMS does not exist in splendid isolation: there are lots of internal and external factors that have an influence on the development of risks and controls. These must be identified.

# Context of the ISMS

Slide: [[ISO 27001 in 220 - slide 4 - Context of the ISMS]]

Factors that can have an influence on your information security risks, and how you manage them, include:

- macro-environmental factors (like political and legal developments, demographic trends, economics and technological developments)
- your organization's strategy and culture
- strengths and weaknesses of your organization
- different internal and external stakeholders, and their interests
- and your business processes

Most of these will be periodically or continuously changing, and that's why the cyclical nature of the ISMS is so important.

The ISO 27001 standard demands that you are aware of these internal and external issues, and that you document how these influence your Information Security Management System.

Management science provides numerous well known tools that are of use here, I will elaborate this subject in the full ISO27DIY video that deals with this subject.

Next, it's important that you define the boundaries and applicability of the ISMS, or "Scope".

# Scope of the ISMS
Slide: [[ISO 27001 in 220 - slide 5 - Scope of the ISMS]]

As you now know, ISO 27001 is all about managing risks. Because you can't take responsibility for all risks that will become known to you, it's important to set the boundaries of the landscape you are seeking certification for.

This is done through the scope statement. The scope statement clarifies which business processes the ISMS is applied to.

For example:
- Delivering hosted desktops and complementary cloud services 
- Consulting, implementing and executing data services for direct mail activities
- Developing, maintaining and managing a software solution
- Producing and visualizing 3D content

The scope of the ISMS is also the scope of your ISO 27001 certification, and as such will be visible to your stakeholders.

Relevant literature notes:
- [ISO 27001 examples of scope statements](../../ISO%2027001%20examples%20of%20scope%20statements.md)

# Leadership, roles and responsibilities
ISO 27001 demands that top management must show leadership and commitment with regards to the ISMS, by:

- setting objectives for information security, making sure they are met, and promoting continual improvement
- establishing an information security policy
- integrating the ISMS procedures into the organization’s processes
- providing the necessary resources and support
- communicating the importance of information security and actually directing managment and personell to contribute to this process.

You see there's a quite heavy demand on top management for committing to the success of the Information Security Management System.

While the responsibilities of top management are relatively detailed in ISO 27001, it is charistically unspecified for all other roles. ISO 27001 just states that relevant roles and responsibilities must be assigned and communicated by top management.

The only responsibilities mentioned explicitly are:
- ensuring conformity of the ISMS to the Standard
- reporting on the performance of the ISMS to top management.
- planning and executing an audit programme

ISO 27001 also mentions the roles of Asset Owner and Risk Owner, but other than that you are free to define roles and responsibilities yourself.

So, now that we have identified the context of the ISMS and set the boundaries, identified roles and responsibilities, it's time to put the risk management process in motion.

# The CIA Triad

As you recall from Slide: [[ISO 27001 in 220 - slide 3 - Risk management process]], this starts with identifying risks. 

More specifically, risks associated with the loss of confidentiality, integrity and availability of information, also known as the 'CIA triad'.

When you bring up the topic of information security, most people will think of the confidentiality aspect, first: personal or sensitive data falling into the wrong hands. And we can read about breaches like that in the media daily. But integrity and availability can be equally important for information. Think about the availability of your website on the day you launch your new sales campaign, or the integrity of product data in your webshop. In both examples confidentiallity isn't a factor, but the impact of not having the data available or not being able to trust the data can be dramatic nonetheless.

So two things to remember here: the CIA triad of confidentiality, integrity and availability, and the fact that the importance of these aspects may differ for different kinds of information assets. Let's look at assets.

# Creating the Asset Inventory

Earlier, in Slide: [[ISO 27001 in 220 - slide 4 - Context of the ISMS]], we looked at the context of the ISMS, and may have identified risks affecting the organization as a whole, like laws and regulations, stakeholder interests and known weaknesses of the organization.

Now it's time to increase the granularity of our risk identification process, and we're going to do that by looking at the objects we are actually seeking security for, namely our information assets.

ISO 27001 mandates an Inventory of Information Assets, meaning collections of information and the facilities used to process that information.

So what is an information asset? A Word document? A database table? A server or laptop? ISO 27001 won't tell you. A practical standpoint is that anything that's worth securing or protecting, is an Asset. Don't lose yourself in endless discussions about where one asset ends and the next one begins. 

Remember: the ISMS best works with an iterative approach. Just start somewhere and refine it in the next cycles.

A practical way to start identifying information assets is to create a workshop situation with a small team, and ask the question what sort of information assets people use in their day to day jobs. 

Now that we have a first draft of our Asset Inventory, we need to look at the possible impact of compromises to these assets, and identify 'critical assets'. 

We can do that by scoring each asset on the security principles of the CIA triad: Confidentiality, Integrity and Availability. To keep it easy, I would suggest using a comparative approach and attach a score of High, Medium or Low.

Your asset inventory may grow fairly large over time, and it's practical to classify your assets into groups, taking into account aspects like value, sensitivity, criticality and legal requirements. That way you don't have to define protection measures on an asset-by-asset basis, and by labeling the information assets, you will make it easier for people to know how to handle each asset.

Now that we know what information assets are most important to protect, and what aspect of information security needs the most attention, we can move on to identifying Risks.

# Identifying, Analyzing and Treating Risks

Risks occur when there's a chance of assets being compromised. Intentionally, or accidentally. A laptop may be stolen, a threat actor may gain access to a database, or your power supply may be interrupted by a flood.

You must identify the risks of loss of confidentiality, integrity and availability of your information assets.

ISO 27001 defines risk as a function of the probability that this loss will occur, and the impact it will have once that event occurs. R = P x I.

Again, don't loose yourself in academic discussions on the exact likelihoods of occurance and levels of impact. Keep in mind that the goal here is to be able to prioritize actions and the dedication of resources. I haven't been through an audit yet, where qualifying both probability and impact as either High, Medium or Low wasn't good enough.

Also, don't try to create the 'Complete list of risks': start with the top-of-mind risks and expand and refine in the next iterations.

See also [Assets, Vulnerabilities, Threats, Risks](../../../../🎇%20Sparks/Assets,%20Vulnerabilities,%20Threats,%20Risks.md).

Next, you need to decide on Risk Treatment.

# Risk Treatment
You can take several actions on a Risk:
- Mitigate it, 
- Transfer it – to another party.
- Avoid it, by not performing the activities or using the technology associated with the risk
- or Accept it

ISO 27001 dictates that you should at least define your risk acceptance criteria, by setting maximum levels for chance and impact. Everything above that should lead to action.

For all risks you decide to mitigate, you must now find an appropriate Control, which brings us to the infamous Annex A.

# Annex A Controls
Slide: [[ISO 27001 in 220 - slide 6 - Annex A Controls]]

Annex A lists 114 controls, or measures to mitigate your various information security risks. They include physical controls, dealing with access to areas and processing facilities, technical controls like password protection and encryption, and organizational controls, like training and instruction and vendor management.

The idea is that you apply each and every one of them, unless you can convincingly argue that they should not apply to you. For instance, if you only use virtual servers hosted by a provider, controlling physical access to a server room would not apply to your organization.

You need to write down which controls from Annex A are, or will be applied by your organisation, in the so called Statement of Applicability. 

Relevant notes: 
- [ISO 27001 Approaching Annex A](../../ISO%2027001%20Approaching%20Annex%20A.md)
- [ISO 27001 Statement of Applicability](../../ISO%2027001%20Statement%20of%20Applicability.md)

# Documenting the ISMS
This picture of the ISMS was in one of the first slides:

ADD ARTEFACTS TO MANAGEMENT CIRCLE
Identify and Analyse Risks			| Risk Analysis
Define and Implement Controls	| Policies, Implementation Plans
Monitor 										| Reports and Logs		
Evaluate										| (formal) Evaluations or for instance Meeting Notes

We've done our Risk Analysis and selected the appropriate Controls. For Controls that haven't been implemented yet, you should have some sort of demonstrable planning.

Controls must have an associated Policy, which describes what risk the control is supposed to mitigate, how the control should be applied, who is responsible for applying the control, and how, and by whom, the effectiveness of the control will be established.

Risks and Controls must be periodically evaluated. These evaluations must also be planned and documented.

# Performance evaluation

Next to the periodical evaluation of Controls, ISO 27001 defines some other important mechanisms to guard the effectiveness of the ISMS, ensure continual improvement, and maintain compliance with the ISO 27001 standard. These are:
- management review
- Internal audits
- External audits

## Management Review

The Management Review must be conducted periodically (usually yearly) by 'top management' and must cover:

a) the status of actions from previous management reviews;
b) changes in relevant external and internal issues;
c) feedback on the information security performance
d) feedback from interested parties;
e) results of risk assessment and status of risk treatment plan; and
f) opportunities for continual improvement.

The outputs of the management review must include decisions related to continual improvement and necessary changes to the ISMS.

## Internal audits     
Internal audits must be conducted at planned intervals to provide information on whether the ISMS:

a) conforms to the requirements of the organization and of the standard
b) is effectively implemented and maintained.

It's advisable to structure internal audits in the same way external audits are conducted, namely by asking the auditees for documented proof for the correct implementation of each of ISO 27k1's clauses and applicable controls.

Internal audits are often planned multiple times per year, with each audit covering a subset of the complete standard.

Moving on to External audits, the first external audit you'll have, is the ISO 27001 Certification audit.

# Certification
The ISO 27001 Certification audit consists of 2 stages.

Stage 1 is a document review, in which the auditor looks for a set of described procedures, plans and assessments, most of which have been mentioned in this video.

Once all these documents have been produced, you'll move on to Stage 2, also called The Main Audit, which ssually follows a few weeks after Stage 1.

Stage 2 focusses on proof of actual implementation of your ISMS processes and risk controls. This is checked mainly by asking for records of activities, but also through observation and employee interviews.

The certifcation audit takes anywhere from 3 days to 4 weeks, depending on the size of the organization.

See: [ISO 27001 Cost of Certification](../../../../../../iso27DIY-gis/reference/ISO%2027001%20Cost%20of%20Certification.md)

## Report
The auditor will report the findings using 3 categories:

- Observations, which may be handled by the organization as it sees fit
- Minor non-conformities: which are deviations from the standard that do not affect the ability to achieve the ISMS's goals. They require drafting a Corrective Action Plan to resolve the issue
- Major non-conformities, which do affect the ISMS's ability to achieve the intended results. These prevent the certificate from being issued.

The auditor will set a deadline for resolving the non-conformities, usually 90 days. After you've reported the issue as being solved, and supplied evidence, the auditor will issue the certificate.

The certificate is valid for a period of 3 years, during which there will be 2 'controle' audits. After the third year, you will again have a full-blown re-certification audit.

External audits should be performed by accredited certification bodies, listed on the International Accreditation Forum's website.

See [ISO 27001 Certification audit](../../ISO%2027001%20Certification%20audit.md)


# Closing
So, there you have it, the ISO 27001 in XX minutes.

If you liked this video/ helped you, please …

If you want to learn more about implementing iso 27 on your organization without paying excessive consulting fees, head on over to ISO27DIY.com. 

Download the slide deck
