|
ISMS is an Information Security Management System (ISMS) addressed in clauses 4-10 of ISO 27001 Clauses 4-19 make up the core of the framework. The ISMS helps organizations establish a governance structure to manage their information security program, and is the primary focus of an ISO 27001 certification audit.
What you need to know for an ISO 27001 Audit
When most companies begin the journey toward ISO 27001 certification, they are thinking about the 114 controls they need to implement, which is called Annex A or ISO 27002. While the 114 controls are an essential element of ISO 27001; the part most organizations underestimate is the ISMS.
To pass an audit you will need to download the ISO 27001 framework, read, interpret, and design a system of management that hits every bullet and sub-bullet of clauses 4-10. This will include things like a governance body, policies, a formal risk assessment, resourcing the program, internal audits, and procedures to keep top management up-to-speed on the program.
Beyond the Audit: The Power of an ISMS
If you are looking for a way to get cybersecurity at the table with executives, an effective ISMS is a forcing mechanism. It literally requires top-level leadership involvement and commitment to continuous improvement. Use this opportunity to get leadership involved and to build a true risk management program. That is the spirit and intent of ISO 27001.
Challenges of Building an ISMS
If top management is not willing or able to support the program – organizations will struggle to effectively implement ISO 27001. Organizations attempting to delegate the ISO 27001 program to entry-level team members is bound to fail.
These team members often do not have the experience, context, or political pull within the organization to drive big changes. If you are implementing ISO 27001 at your organization, it’s recommended that the project has an executive sponsor. This will help the organization implement the governance structures required to align with ISO 27001.
