Information security management system (ISO 27001)

What the standard requires

The requirements are in clauses 4 to 10 of the standard. They apply to every organisation that wants to follow it, whatever its size.

What must be documented is relatively little: the scope, the policy, the risk method and the results of risk assessment and treatment, the Statement of Applicability, the objectives, evidence of competence, monitoring results, the internal audit programme and results, management review results, and nonconformities and actions. The rest you decide yourselves, based on risk.

Annex A and ISO 27002

Annex A of ISO 27001 is a catalogue of 93 controls in four themes: organisational (37), people (8), physical (14) and technological (34). You do not have to implement all of them. You compare your risk treatment with the catalogue so that nothing necessary is missed, and justify each inclusion or exclusion in a Statement of Applicability.

ISO/IEC 27002 is the guidance for the same 93 controls: what each is for and how it can be implemented. You cannot certify against it, but it is the practical support when the controls are designed.

To certify or not

Certification is voluntary. A certificate is issued by an accredited certification body after a two-stage audit, is valid for three years and is followed by a surveillance audit every year. Certification is right when customers, tenders or owners require it, or when you need external proof. Without certification the standard can still be the best framework for the work, followed with the same internal audit and management review. How long the build takes is described in the offer ISO 27001 from gap analysis to certification.

A management system that lives

The most common problem we see is not a missing ISMS but one that stops being used after certification. A living ISMS has a few signs:

• the risk assessment is repeated when the business, systems or suppliers change, not only once a year;
• management reviews end in decisions with owners and dates;
• internal audits are done by someone who is not auditing their own work, and nonconformities get closed;
• the objectives can be measured, and someone follows them up;
• staff know what applies to them, and new starters learn it from day one.

That is also what a certification auditor looks for at the surveillance audits.

One system for several regulations

NIS2 and the Swedish Cybersecurity Act, DORA, the GDPR and the CRA make overlapping demands: risk analysis, policies, incident handling, continuity, supplier management and management accountability. An ISMS under ISO 27001 handles the common parts once. Our experience is that a working ISMS provides about 80 per cent of the governance and security structure the Cybersecurity Act requires. What remains are the Act’s own obligations, such as registration, incident reporting within fixed deadlines and management training. We build those into the same system rather than a separate track. The same applies to DORA’s ICT risk requirements and register of ICT third-party arrangements, the GDPR’s requirements on processing personal data and the CRA’s requirements on secure development and vulnerability handling.

If you also want management systems for privacy (ISO 27701), continuity (ISO 22301) or quality (ISO 9001), the standards share the same high-level structure, so they can share policy, internal audit and management review.

Common pitfalls

• The scope is too wide or too narrow: the whole group at once, or only the IT department when the information sits in the business.
• The risk assessment is done in a workshop and never used again.
• The Statement of Applicability is filled in but has no justifications.
• Policies are written for the auditor, not for the people who have to follow them.
• The internal audit is done by the same people who built the system.
• Management is there at the start but not in the management review.

How we help

• Current state: a gap analysis against ISO 27001, NIS2 or DORA with a documented current state and a prioritised plan.
• Build and certification: ISO 27001 from gap analysis to certification: risk method, policies, Statement of Applicability, implementation, internal audit and pre-audit.
• Independent review: an ISO 27001 internal audit, also for organisations that built their ISMS themselves or with someone else.
• Ongoing management: senior GRC advisory or an interim CISO when the ISMS needs an owner.

The team includes certified ISO 27001 Lead Implementers and Lead Auditors. Read about a software company that built its ISMS.