ISO 27001 Consulting Services Readiness, Implementation, Audit and Program Management

ISO 27001 - 2022
Brief Overview

• What is the role of an ISO 27001 consultant?

  ISO 27001 has 30 management system requirements and 93 Annexure controls. To achieve certification, an organization needs to demonstrate implementation of all management system requirements and all applicable annexure controls.

  An ISO 27001 consultant can be invaluable when implementing and maintaining an ISO 27001 Information Security Management System (ISMS).

  Here’s why you might need one:

  Expertise and Knowledge
  The journey of ISO 27001 requires expertise in a range of cyber security domains that cut across technology, human resources, physical, supplier security and governance expertise. With so many domains involved, hiring an ISO 27001 consultant can reduce your learning roadmap as an organization.

  Scoping the environment
  Scoping the engagement in terms of systems, locations, functions, and service providers is a key aspect of starting the ISO 27001 journey. An ISO 27001 consultant can bring their expertise to define the scope appropriately.

  Gap Assessment
  An ISO 27001 consultant can perform a gap analysis to identify where your current practices fall short of HITRUST requirements, providing a clear roadmap to compliance. A gap analysis will result in determining the ‘applicable’ and ‘not applicable; requirements with suitable justifications.

  Implementation of Policies and Procedures
  An ISO 27001 consultant will design, and define all policies and procedures as per applicable controls. For each of the 23 requirements, there is a need to define policies and procedures.

  Implementation of Secure Practices
  An ISO 27001 consultant will ensure policies turn into actual practices. This is through control-specific handholding of teams to ensure they indeed follow these practices.

  Implementation of Secure Configurations
  Depending upon your infrastructure (cloud or on-prem or a hybrid of both) the ISO 27001 consultant will ensure that all configurations are optimized for security.

  Risk Management Advisory
  A gap assessment will several issues or vulnerabilities, and an ISO 27001 consultant will provide specific advice to reduce the risk.

  Third-Party Risk Assessment
  An ISO 27001 consultant can evaluate the risks associated to suppliers, and provide actionable insights and recommendations.

  Penetration Testing
  An ISO 27001 consultant can perform testing of your Infrastructure and provide recommendations to reduce the risk.

  Training and Awareness
  An ISO 27001 consultant will provide training to your staff, ensuring your team understands both the standard and implementation requirements.

  Continuous Monitoring
  After the implementation process is complete, the ISO 27001 consultant can assist in managing and monitoring the governance process as well as reporting the degree of effectiveness.

  Managing certification body auditors
  Once the organization has prepared and is ready with the Implementation, there are several Q&A sessions between the clients and the auditors through stage 1 and stage 2 audits. The ISO 27001 consultant can make the journey easy by responding to several of these questions.

  In summary, engaging an ISO 27001 consultant will not only improve your security posture but also reduce the time to achieve ISO 27001 certification. While you focus on your business, the ISO 27001 consultant can ensure success with ISO 27001 certification, thereby saving valuable business hours and winning more business opportunities.

• How fast can a company achieve ISO 27001 certification?

  • ISO 27001 certification involves the presence of a management system and the successful implementation of the applicable annexure controls.
  • Most organizations which are currently not certified have 20-30% of annexure controls already in place. How do we know this? This is based on our experience of the initial gap analysis.
  • To achieve certification the organization needs to implement the pending applicable annexure controls and a system of governance.
  • The speed is dependent on several factors including the choice of consultants, the organization's readiness to address the identified gaps, agreement on the policies and procedures, and a holistic approach that involves all functional heads involved in the journey.
  • A small organization with 1 production network, 1 location, and less than 100 people would generally take 2-3 months to accomplish this.
  • It is not necessary that a larger organization with more people will take more time, it is a function of determining the applicable control, identified gaps and how fast collectively everyone gets together to make those security decisions and the implementation.
  • Do not forget to add the time that a certification body will take to perform stage 1 and stage 2 audits
  • For a more precise discussion, reach out to us.
• What are the mandatory requirements in iso 27001?

  • Unfortunately, this is not a straightforward forward answer as you might think :-)
  • But here is a sincere attempt.
  • Management system controls (Clause 4 to 10) are mandatory
  • The number of annexure controls is based on risk assessment.
  • See the diagram above for 4 sections of the annexure controls.
  • In the Anexure controls, few sections are mandatory, because in every organization there will be organizational, and personnel controls.
  • For most organizations working remotely many of the physical security controls may not apply.
  • The technical controls require assessment based on whether you have your data center or you are in the cloud. Whether you have an in-house development team or a third party. Based on those assumptions controls can be added or removed.
  • For instance, if you don't have in-house application development, all controls that are linked to development and its network requirement are not applicable.
  • For a more precise discussion on the applicability of controls, reach out to us.
• What is information security?

  Information is anything that has a business value. Security is the protection against loss of confidentiality, integrity and availability. Combined, in the context of any organization, information security is the protection of all information that business considers ‘valuable’.

• What is information security management system (ISMS)?

  • ISMS is an organization framework that defined a set of rules, policies, and procedures that ensures protection of information.
  • ISMS is a management program driven by a management representative such as Chief Information Security Officer (CISO).
• What is ISO 27001 certification?

  • ISO 27001 is the certification that the organization achieves upon demonstrating that they have implemented the ISMS.
  • ISO 27001 is a certificate issued by a certification body upon completing a 2- phase audit.
  • An ISO 27001 certification is valid for three years subject to annual surveillance.
  • ISO 27001 certificate provides assurance to your customers that you have implemented 'optimum-security' in all processes that handles sensitive data.
• What are the benefits of implementing ISMS?

  • Implementing ISMS helps an organization to protect their information and digital assets, proactively.
  • Additionally, it reduces the opportunity of being hacked as systems and processes are designed to ensure that the organization and its information assets are secure.
  • Processes such as risk assessment ensure all changes in the organizations consider security as part of the implementation.
  • Controls such as threat intelligence ensures you are proactive as new threats develop in the wild.
  • An annual calendar of 'management system' activities ensures that ensures there is an overarching role that is guiding the organizations security related decisions.
• How much does it cost to implement ISO 27001 2022?

  A number of factors play a role in determining the fee, such as:

  • Scope of business, and information systems involved.
  • Number of business locations.
  • Number of networks including cloud service provider.
  • Presence of application development in scope.
  • Identified gaps or risks.

  Please contact us, we are fairly quick in submitting a commercial proposal.

• What are the key phases of implementing ISMS?

  The phases of implementing include understanding the business, listing all information assets, conducting gap analysis, risk assessment and risk management, policy documentation, testing and measurement of controls, audit, and awareness of all stakeholders.

• How to make a ISO 27001 Certification Checklist?

  ISO 27001 checklist creation is a challenging but interesting task that includes on one hand, understanding of iso 27001 requirements, and on the other an organization’s business, strategic information risks, and their information assets.

  ISO 27001 has control requirement covering several domains that includes the following domains.

  • Strategic
  • Technical
  • Physical
  • Personnel
  • Suppliers
  • Process

  Phase A – ISO 27001 requirement checklist

  The journey starts with getting a copy of the iso 27001 controls, and using the same to create a meta template in which against each requirement one should prepare the iso 27001 questions using one or more of the followings:

  • What to ask?
  • What to check?
  • Whom to ask?

  Phase B – Business requirement checklist

  In the organization context, each business is somewhat unique, so the next step is to gather enough information about the organizations, such as:

  • Main Business
  • Products and Services
  • Information to be secured
  • Information Systems in Use
  • Number and location of Users
  • Applications developed
  • Network locations
  • Office locations
  • Supplier List and their services
  • Individual roles and nominations

  With this, one has created the organization context necessary to apply the questions from the phase A.

  ISO 27001 checklist is incomplete with just the standard questions, there is always a need to prepare the question in the context of the organization for which this is applied.

  A complete iso 27001 checklist strategy therefore needs to have both the iso 27001 control checklist as well as organizational checklist.

• What does the ISO 27001 certification body lead auditor looking for in certifying an organization?

  ISO 27001 certification audit is valid for three years subject to fulfilment of the standard requirements by the organization. ISO 27001 certificate is issued by the certification bodies.
  
  In the first year they perform two stages of the audit, namely stage 1, and stage 2.
  
  Stage 1 audit is the documentation audit, where they look for documentation alignment with the applicable requirements as per the organizations Statement of Applicability (SOA).
  
  Stage 1 questions are centred around company policies and procedures and demonstrate an organizations’ ‘intent’.
  
  Stage 2 assessment aims at verifying the ‘implementation and effectiveness’. This phase is much more comprehensive where the iso 27001 certification body auditor looks for evidence of implementations across all domains and controls that are applicable to the organization.
  
  Stage 2 focuses on the technical side of the implementations that includes the followings:
  
  

  • Cloud security controls,
  • Network security controls,
  • Application development security lifecycle controls
  • Human resource controls
  • Physical security controls
  • Supplier management controls
  • Other ‘security management’ processes

  Upon assured of the ‘intent, implementation and effectiveness’ the iso 27001 certificate is issued by the certification body to the organization.

• How to define a scope statement in ISO 27001 certification journey?

  "The scope statement is an important statement for any organizations iso 27001 certification as it reflects the business and supporting functions that support the information security management system (ISMS).

  A scope statement generally has the following 4 parts:

  Part 1: About the business, the sentence looks like:

  information security management system (ISMS) applies to the delivery of [Software as a service (SAAS)] OR [business process outsourcing].

  Part 2 – Industries that you serve, the sentence may look like:

  The services cater to the healthcare industry.

  Part 3 – Internal teams or functions:

  ISMS is supported by internal teams such as Product Management, Application Development, Cloud Operations, DevOps, IT Operations, Human Resource, Legal, Procurement, physical security and business development.

  Here you write functions as per the organization structure, all teams that participated.

  Part 4 – Reference to Statement of Applicability (SOA)

  This is as per Statement of Applicability (SOA) version 1.0

  Note that the SOA is where all the applicable and not applicable controls are listed.

• What is the ISO 27001 Statement of Applicability (SOA)?

  SOA is a document created by the organization to demonstrate its alignment with the standard list of annexure controls.

  • it declares applicable controls and those that are not.
  • It defines the justification for both applicable and not applicable controls.
  • It is the basis on which a company gets certified. SOA is used by the ISO 27001 certification auditor to make their judgment on the scope of compliance.
  • As a best practice, we advise clients to add more columns in the SOA such as documentation and risk owner, a term to associate a control with a team, responsible for enforcement of the control in the organization.
• How to fulfill the ISO 27001 cloud security requirements?

  Cloud security is a shared responsibility. Each cloud service provider, be it SAAS, PAAS or IAAS, provides shared responsibility controls to its customers.

  In our ISO 27001 Consulting Services, we assist clients in determining the applicable shared controls and assist them through the process of gap analysis, and implementation support.