ISO 27001 Consulting Services Readiness, Implementation, Audit and Program Management

What is ISO 27001: 2022?
Brief Overview

• What is the role of an ISO 27001 consultant?

  ISO 27001 has 30 management system requirements and 93 Annexure controls. To achieve certification, an organization needs to demonstrate implementation of all management system requirements and all applicable annexure controls.

  An ISO 27001 consultant can be invaluable when implementing and maintaining an ISO 27001 Information Security Management System (ISMS).

  Here’s why you might need one:

  Expertise and Knowledge
  The journey of ISO 27001 requires expertise in a range of cyber security domains that cut across technology, human resources, physical, supplier security and governance expertise. With so many domains involved, hiring an ISO 27001 consultant can reduce your learning roadmap as an organization.

  Scoping the environment
  Scoping the engagement in terms of systems, locations, functions, and service providers is a key aspect of starting the ISO 27001 journey. An ISO 27001 consultant can bring their expertise to define the scope appropriately.

  Gap Assessment
  An ISO 27001 consultant can perform a gap analysis to identify where your current practices fall short of ISO 27001 requirements, providing a clear roadmap to compliance. A gap analysis will result in determining the ‘applicable’ and ‘not applicable; requirements with suitable justifications.

  Implementation of Policies and Procedures
  An ISO 27001 consultant will design, and define all policies and procedures as per applicable controls. For each of the 23 requirements, there is a need to define policies and procedures.

  Implementation of Secure Practices
  An ISO 27001 consultant will ensure policies turn into actual practices. This is through control-specific handholding of teams to ensure they indeed follow these practices.

  Implementation of Secure Configurations
  Depending upon your infrastructure (cloud or on-prem or a hybrid of both) the ISO 27001 consultant will ensure that all configurations are optimized for security.

  Risk Management Advisory
  A gap assessment will several issues or vulnerabilities, and an ISO 27001 consultant will provide specific advice to reduce the risk.

  Third-Party Risk Assessment
  An ISO 27001 consultant can evaluate the risks associated to suppliers, and provide actionable insights and recommendations.

  Penetration Testing
  An ISO 27001 consultant can perform testing of your Infrastructure and provide recommendations to reduce the risk.

  Training and Awareness
  An ISO 27001 consultant will provide training to your staff, ensuring your team understands both the standard and implementation requirements.

  Continuous Monitoring
  After the implementation process is complete, the ISO 27001 consultant can assist in managing and monitoring the governance process as well as reporting the degree of effectiveness.

  Managing certification body auditors
  Once the organization has prepared and is ready with the Implementation, there are several Q&A sessions between the clients and the auditors through stage 1 and stage 2 audits. The ISO 27001 consultant can make the journey easy by responding to several of these questions.

  In summary, engaging an ISO 27001 consultant will not only improve your security posture but also reduce the time to achieve ISO 27001 certification. While you focus on your business, the ISO 27001 consultant can ensure success with ISO 27001 certification, thereby saving valuable business hours and winning more business opportunities.

• How fast can a company achieve ISO 27001 certification?

  • ISO 27001 certification involves the presence of a management system and the successful implementation of the applicable annexure controls.
  • Most organizations which are currently not certified have 20-30% of annexure controls already in place. How do we know this? This is based on our experience of the initial gap analysis.
  • To achieve certification the organization needs to implement the pending applicable annexure controls and a system of governance.
  • The speed is dependent on several factors including the choice of consultants, the organization's readiness to address the identified gaps, agreement on the policies and procedures, and a holistic approach that involves all functional heads involved in the journey.
  • A small organization with 1 production network, 1 location, and less than 100 people would generally take 2-3 months to accomplish this.
  • It is not necessary that a larger organization with more people will take more time, it is a function of determining the applicable control, identified gaps and how fast collectively everyone gets together to make those security decisions and the implementation.
  • Do not forget to add the time that a certification body will take to perform stage 1 and stage 2 audits
  • For a more precise discussion, reach out to us.
• What are the mandatory requirements in iso 27001?

  • Unfortunately, this is not a straightforward forward answer as you might think :-)
  • But here is a sincere attempt.
  • Management system controls (Clause 4 to 10) are mandatory
  • The number of annexure controls is based on risk assessment.
  • See the diagram above for 4 sections of the annexure controls.
  • In the Anexure controls, few sections are mandatory, because in every organization there will be organizational, and personnel controls.
  • For most organizations working remotely many of the physical security controls may not apply.
  • The technical controls require assessment based on whether you have your data center or you are in the cloud. Whether you have an in-house development team or a third party. Based on those assumptions controls can be added or removed.
  • For instance, if you don't have in-house application development, all controls that are linked to development and its network requirement are not applicable.
  • For a more precise discussion on the applicability of controls, reach out to us.
• What is information security?

  Information is anything that has a business value. Security is the protection against loss of confidentiality, integrity and availability. Combined, in the context of any organization, information security is the protection of all information that business considers ‘valuable’.

• What is information security management system (ISMS)?

  • ISMS is an organization framework that defined a set of rules, policies, and procedures that ensures protection of information.
  • ISMS is a management program driven by a management representative such as Chief Information Security Officer (CISO).
• What is ISO 27001 certification?

  • ISO 27001 is the certification that the organization achieves upon demonstrating that they have implemented the ISMS.
  • ISO 27001 is a certificate issued by a certification body upon completing a 2- phase audit.
  • An ISO 27001 certification is valid for three years subject to annual surveillance.
  • ISO 27001 certificate provides assurance to your customers that you have implemented 'optimum-security' in all processes that handles sensitive data.
• What are the benefits of implementing ISMS?

  • Implementing ISMS helps an organization to protect their information and digital assets, proactively.
  • Additionally, it reduces the opportunity of being hacked as systems and processes are designed to ensure that the organization and its information assets are secure.
  • Processes such as risk assessment ensure all changes in the organizations consider security as part of the implementation.
  • Controls such as threat intelligence ensures you are proactive as new threats develop in the wild.
  • An annual calendar of 'management system' activities ensures that ensures there is an overarching role that is guiding the organizations security related decisions.
• How much does it cost to implement ISO 27001 2022?

  A number of factors play a role in determining the fee, such as:

  • Scope of business, and information systems involved.
  • Number of business locations.
  • Number of networks including cloud service provider.
  • Presence of application development in scope.
  • Identified gaps or risks.

  Please contact us, we are fairly quick in submitting a commercial proposal.

• What are the key phases of implementing ISMS?

  The phases of implementing include understanding the business, listing all information assets, conducting gap analysis, risk assessment and risk management, policy documentation, testing and measurement of controls, audit, and awareness of all stakeholders.

• How to make a ISO 27001 Certification Checklist?

  ISO 27001 checklist creation is a challenging but interesting task that includes on one hand, understanding of iso 27001 requirements, and on the other an organization’s business, strategic information risks, and their information assets.

  ISO 27001 has control requirement covering several domains that includes the following domains.

  • Strategic
  • Technical
  • Physical
  • Personnel
  • Suppliers
  • Process

  Phase A – ISO 27001 requirement checklist

  The journey starts with getting a copy of the iso 27001 controls, and using the same to create a meta template in which against each requirement one should prepare the iso 27001 questions using one or more of the followings:

  • What to ask?
  • What to check?
  • Whom to ask?

  Phase B – Business requirement checklist

  In the organization context, each business is somewhat unique, so the next step is to gather enough information about the organizations, such as:

  • Main Business
  • Products and Services
  • Information to be secured
  • Information Systems in Use
  • Number and location of Users
  • Applications developed
  • Network locations
  • Office locations
  • Supplier List and their services
  • Individual roles and nominations

  With this, one has created the organization context necessary to apply the questions from the phase A.

  ISO 27001 checklist is incomplete with just the standard questions, there is always a need to prepare the question in the context of the organization for which this is applied.

  A complete iso 27001 checklist strategy therefore needs to have both the iso 27001 control checklist as well as organizational checklist.

• What does the ISO 27001 certification body lead auditor looking for in certifying an organization?

  ISO 27001 certification audit is valid for three years subject to fulfilment of the standard requirements by the organization. ISO 27001 certificate is issued by the certification bodies.
  
  In the first year they perform two stages of the audit, namely stage 1, and stage 2.
  
  Stage 1 audit is the documentation audit, where they look for documentation alignment with the applicable requirements as per the organizations Statement of Applicability (SOA).
  
  Stage 1 questions are centred around company policies and procedures and demonstrate an organizations’ ‘intent’.
  
  Stage 2 assessment aims at verifying the ‘implementation and effectiveness’. This phase is much more comprehensive where the iso 27001 certification body auditor looks for evidence of implementations across all domains and controls that are applicable to the organization.
  
  Stage 2 focuses on the technical side of the implementations that includes the followings:
  
  

  • Cloud security controls,
  • Network security controls,
  • Application development security lifecycle controls
  • Human resource controls
  • Physical security controls
  • Supplier management controls
  • Other ‘security management’ processes

  Upon assured of the ‘intent, implementation and effectiveness’ the iso 27001 certificate is issued by the certification body to the organization.

• How to define a scope statement in ISO 27001 certification journey?

  "The scope statement is an important statement for any organizations iso 27001 certification as it reflects the business and supporting functions that support the information security management system (ISMS).

  A scope statement generally has the following 4 parts:

  Part 1: About the business, the sentence looks like:

  information security management system (ISMS) applies to the delivery of [Software as a service (SAAS)] OR [business process outsourcing].

  Part 2 – Industries that you serve, the sentence may look like:

  The services cater to the healthcare industry.

  Part 3 – Internal teams or functions:

  ISMS is supported by internal teams such as Product Management, Application Development, Cloud Operations, DevOps, IT Operations, Human Resource, Legal, Procurement, physical security and business development.

  Here you write functions as per the organization structure, all teams that participated.

  Part 4 – Reference to Statement of Applicability (SOA)

  This is as per Statement of Applicability (SOA) version 1.0

  Note that the SOA is where all the applicable and not applicable controls are listed.

• What is the ISO 27001 Statement of Applicability (SOA)?

  SOA is a document created by the organization to demonstrate its alignment with the standard list of annexure controls.

  • it declares applicable controls and those that are not.
  • It defines the justification for both applicable and not applicable controls.
  • It is the basis on which a company gets certified. SOA is used by the ISO 27001 certification auditor to make their judgment on the scope of compliance.
  • As a best practice, we advise clients to add more columns in the SOA such as documentation and risk owner, a term to associate a control with a team, responsible for enforcement of the control in the organization.
• How to fulfill the ISO 27001 cloud security requirements?

  Cloud security is a shared responsibility. Each cloud service provider, be it SAAS, PAAS or IAAS, provides shared responsibility controls to its customers.

  In our ISO 27001 Consulting Services, we assist clients in determining the applicable shared controls and assist them through the process of gap analysis, and implementation support.

• • Mike represents an organization which wishes to implement ISO 27001.
  • Carol is an ISO 27001 consultant.
  • Ann is an ISO 27001 lead auditor.

  Mike has questions for each of the following points. Some are responded by Carol and the others responded by Ann.

  Mike: Hi Carol and Ann, thanks for joining me today. Our organization is planning to implement ISO 27001, and I have quite a few questions to better understand the process.

  Carol: Hi Mike! As an ISO 27001 consultant, I’m here to help you navigate the implementation process and ensure your organization is well-prepared for certification.

  Ann: And as a lead auditor, I’ll address your questions about the certification process, audits, and how to maintain compliance once certified.

  
  

  Mike:Let’s start with the basics. What is ISO 27001 certification?

  Carol:ISO 27001 certification is a formal recognition that your organization has implemented an Information Security Management System (ISMS) that meets the ISO 27001 standard. It ensures you have a systematic approach to managing sensitive information securely.

  Ann:It also means an accredited certification body has independently audited your ISMS and confirmed its compliance with ISO 27001.

  
  

  Mike:Why should we implement ISO 27001?

  Carol:It helps you manage information security risks, protects sensitive data, and enhances customer trust. It’s also essential for regulatory compliance, and gives you a competitive edge. Also consider all the opportunities you are perhaps you are loosing because you don’t have the ISO 27001.

  Ann:From an auditor’s perspective, it demonstrates your organization’s commitment to security and continuous improvement. It’s especially valuable for industries handling sensitive information, like IT or finance.

  
  

  Mike:Carol, what’s your role as an ISO 27001 consultant?

  Carol:My job is to guide you through the ISO 27001 implementation process. I’ll conduct a gap analysis, help you design your ISMS, create necessary documentation, train your team, and prepare you for the audit. Think of me as your partner in achieving certification.

  
  

  Mike:What is the difference between ISO 27001 and ISO 27002?

  
  

  Ann:ISO 27001 defines the requirements for an ISMS, while ISO 27002 provides detailed guidance on how to implement the controls listed in ISO 27001’s Annex A. They complement each other.

  Carol: Exactly. ISO 27001 is about the "what" you need to do, and ISO 27002 is about the "how" to do it.

  
  

  Mike:How does ISO 27001 differ from NIST or SOC 2?

  Carol:Consider each standard as a Venn diagram. Each standard has something familiar with the other but has additional requirements for each. ISO 27001 is a good starting point for any organization, and you can implement other standards in a step-by-step manner.

  
  

  Mike:What is an ISMS, and how do we create it?

  Carol:An ISMS is a structured framework of policies, procedures, and controls to manage and mitigate information security risks. You create one by defining its scope, conducting risk assessments, implementing controls, and continuously monitoring and improving the system.

  Ann:A well-documented ISMS is critical, as it will be the focus of your ISO 27001 audits.

  
  

  Mike:What are the first steps to start implementation?

  Carol:Begin with a gap analysis to assess your current security posture. Define the scope of your ISMS, create a risk assessment methodology, and establish a project plan.

  Ann:Don’t forget to secure top management support early on. Their commitment is essential for success.

  
  

  Mike:How should we define the scope?

  Carol:Identify the processes, systems, and locations that handle information assets. The scope should align with your business objectives and risk exposure. The scope consists of the business/legal entity that is getting certified, business services, internal functions, locations and even networks.

  Ann:A clear, concise scope makes audits more straightforward and avoids unnecessary complexities.

  
  

  Mike:What’s the Statement of Applicability, and why is it important?

  Ann:The SoA lists all Annex A controls, specifying which ones are applicable to your organization and why. It’s a critical audit document, as it demonstrates how you’ve tailored your ISMS to your specific needs. SOA also specified the controls that do not apply with their justification for exclusion.

  Carol:It also serves as a reference for internal stakeholders, ensuring everyone understands the chosen controls and their purpose. Each control that is listed should undergo risk assessment, measurement and audit.

  
  

  Mike:What are ISO 27001 management system requirements?

  Carol:ISO 27001 Management System consists of context, interested parties, scope, ISMS policy, risk assessment, risk treatment, objective settings, measurements, internal audits and management review. To get ISO 27001 consider management system as mandatory requirements.

  
  

  Mike:What are Annex A controls, and how do we determine which ones apply?

  Carol:Annex A includes 93 controls across 4 domains of organizational security, human resource security physical security and technical controls. You select applicable controls based on your risk assessment.

  Ann:The SoA will document which controls are relevant and why. This alignment between risks and controls is essential for certification.

  
  

  Mike:How long does it take to get ISO 27001 certified?

  Ann:It depends on your organization’s size and readiness. A startup can take 2- 3 months, whereas a multinational organization can take 9-12 months.

  Carol:With proper planning and a committed team, you can streamline the process and achieve certification faster.

  
  

  Mike:What happens once we’re certified?

  
  

  Carol:Certification is just the beginning. You’ll need to maintain and improve your ISMS, conduct regular internal audits, and prepare for annual surveillance audits.

  Ann:Compliance is an ongoing effort. Continuous improvement ensures your ISMS remains effective and adapts to evolving threats.

  
  

  Mike:How do we demonstrate continual improvement?

  Carol:Once you get certified, you will experience your ISMS journey. Based on this you will determine controls that require ongoing monitoring and others for occasional monitoring. For example you may decide to perform an access review every 3 months, 6 months or even once in 12 months. You will need to create a plan and execute and monitor the plan to ensure newly identified risks are treated urgently.

  
  

  Mike:Thank you, Carol and Ann. This has been incredibly insightful. I feel much more confident about starting our ISO 27001 journey.

  Carol:Glad we could help, Mike. Let’s get started on your implementation plan!

  Ann:Looking forward to supporting you through the certification process. Let us know how we can assist further.