ISMS Implementation Guide [White Paper]

ISMS Implementation Guide

Usage note
Note: The intent of this document is to help you recognize the activities related to establishing an ISMS. This document should not be considered as professional consulting for establishing or implementing an ISMS. Use of this guide does not guarantee a successful implementation nor an implementation that is ready for certification. If you want to implement an ISMS, consider hiring a professional consultant who specializes in ISMS implementation.

Table of contents
Overview of an ISMS ............................................................................................................................. 4
1 Purchase a copy of the ISO/IEC standards .................................................................................. 5
2 Obtain management support ......................................................................................................... 5
3 Determine the scope of the ISMS .................................................................................................. 7
4 Identify applicable legislation........................................................................................................ 8
5 Define a method of risk assessment............................................................................................. 9
6 Create an inventory of information assets to protect ............................................................... 12
7 Identify risks ................................................................................................................................. 13
8 Assess the risks........................................................................................................................... 14
9 Identify applicable objectives and controls ............................................................................... 16
10 Set up policy and procedures to control risks .......................................................................... 20
11 Allocate resources and train the staff......................................................................................... 21
12 Monitor the implementation of the ISMS.................................................................................... 22
13 Prepare for certification audit...................................................................................................... 23
14 Ask for help .................................................................................................................................. 24
Appendix A Documents and Records........................................................................................... 25

Overview of an ISMS
Information security is the protection of information to ensure:
• Confidentiality: ensuring that the information is accessible only to those authorized to access it.
• Integrity: ensuring that the information is accurate and complete and that the information is not
modified without authorization.
• Availability: ensuring that the information is accessible to authorized users when required.
Information security is achieved by applying a suitable set of controls (policies, processes, procedures,
organizational structures, and software and hardware functions).
An Information Security Management System (ISMS) is way to protect and manage information based on
a systematic business risk approach, to establish, implement, operate, monitor, review, maintain, and
improve information security. It is an organizational approach to information security.
ISO/IEC publishes two standards that focus on an organization’s ISMS:
• The code of practice standard: ISO/IEC 27002 (ISO/IEC 17799). This standard can be used as a
starting point for developing an ISMS. It provides guidance for planning and implementing a program
to protect information assets. It also provides a list of controls (safeguards) that you can consider
implementing as part of your ISMS.
• The management system standard: ISO/IEC 27001. This standard is the specification for an ISMS.
It explains how to apply ISO/IEC 27002 (ISO/IEC 17799). It provides the standard against which
certification is performed, including a list of required documents. An organization that seeks
certification of its ISMS is examined against this standard.
These standards are copyright protected text and must be purchased. (For purchasing information, refer to
section 1, “Purchase ISO standards.”)
The standards set forth the following practices:
• All activities must follow a method. The method is arbitrary but must be well defined and
documented.
• A company or organization must document its own security goals. An auditor will verify whether these
requirements are fulfilled.
• All security measures used in the ISMS shall be implemented as the result of a risk analysis in order
to eliminate or reduce risks to an acceptable level.
• The standard offers a set of security controls. It is up to the organization to choose which controls to
implement based on the specific needs of their business.
• A process must ensure the continuous verification of all elements of the security system through
audits and reviews.
• A process must ensure the continuous improvement of all elements of the information and security
management system. (The ISO/IEC 27001 standard adopts the Plan-Do-Check-Act [PDCA] model as
its basis and expects the model will be followed in an ISMS implementation.)
These practices form the framework within which you

Read This White Paper