ISMS Documentation

Develop necessary ISMS documentation, including policies, procedures, and records (Clause 7.5). Ensure these documents are accessible and maintained.

Proper documentation supports consistency and provides evidence of compliance during audits. Our platform’s document management features ensure that all documentation is up-to-date, accessible, and protected.

Implementation and Operation

Resource Allocation

Allocate resources needed for the ISMS, including personnel, technology, and budget (Clause 7.1). This ensures the ISMS is adequately supported.

Adequate resourcing is crucial for the successful implementation and maintenance of the ISMS. Our platform helps in tracking and managing resources effectively, ensuring that all necessary elements are in place.

Competence and Awareness

Ensure personnel are competent through training and maintain awareness of information security (Clause 7.2, Clause 7.3), involving continuous education and skill development.

Competence and awareness are fundamental to effective information security management. Our platform’s training modules and tracking features ensure that personnel remain competent and aware of best practices.

 Communication

Establish communication channels for internal and external information security communication (Clause 7.4). This ensures relevant information is shared timely.

Operational controls are the day-to-day practices that ensure the ISMS functions effectively. Our platform’s operational planning and control features help manage and monitor the implementation of these controls.

6. Implementation of Annex A Controls
Tailor Your Security with Flexible Annex A Controls
ISO 27001:2022 recognises that each organisation has unique information security needs and challenges. One of the standard’s strengths is its flexibility, particularly when implementing Annex A controls. Rather than enforcing a one-size-fits-all approach, ISO 27001:2022 allows organisations to pick and choose specific controls from Annex A based on their unique risk profile, business objectives, and regulatory requirements.

Understanding Annex A
Annex A of ISO 27001:2022 provides a comprehensive list of security controls organisations can implement to mitigate risks and protect their information assets. These controls are grouped into categories such as organisational, people, physical, and technological controls. While Annex A offers a robust framework, not all controls will be relevant or necessary for every organisation.

Customising Your Control Set
To ensure your ISMS is both effective and efficient, it’s essential to tailor the Annex A controls to fit your specific needs. This customisation process involves:

Conducting a Thorough Risk Assessment: Identify the risks your organisation faces and determine which controls are necessary to mitigate those risks. Our platform’s risk management tools, including the Risk Bank and Dynamic Risk Map, facilitate a comprehensive risk assessment process.
Aligning with Business Objectives: Ensure that the selected controls support your broader business objectives. Controls should enhance your security posture without hindering business operations. Our platform helps you map controls to business objectives, ensuring alignment and relevance.
Considering Regulatory Requirements: Different industries and regions have specific regulatory requirements. Choose controls that help you comply with these legal obligations. Our platform’s compliance management features provide up-to-date regulatory information and assist in selecting appropriate controls.
Balancing Cost and Benefit: Implement controls that provide the most significant benefit relative to their cost. Our platform’s cost-benefit analysis tools help you prioritise controls based on their impact and resource requirements.

Implementing Selected Controls
Once you have identified the relevant Annex A controls, our platform supports their implementation through:

Policy Templates and Management Tools: Easily create, manage, and update policies associated with the selected controls.
Training Modules and Awareness Programs: Ensure your team understands and effectively implements the chosen controls.
Monitoring and Reporting Tools: Continuously track the effectiveness of the implemented controls and make adjustments as necessary.
Continuous Improvement
As your business evolves, so do your information security needs. Regularly review and update your control set to address new risks and changes in your business environment. Our platform’s continuous improvement features facilitate ongoing assessment and enhancement of your ISMS, ensuring it remains robust and responsive.

Selecting and implementing the right controls can be complex, but you don’t have to navigate this process alone. Our platform offers expert guidance and support to help you make informed decisions and effectively implement your chosen controls.

Commonly Used Annex A Controls
A.5 Organisational Controls
Policies for Information Security 

Develop and maintain policies that guide the ISMS. Ensure policies are clear, accessible, and regularly reviewed.

Information Security Roles and Responsibilities 

Define and assign information security roles and responsibilities to ensure accountability and clear lines of responsibility.

Segregation of Duties

Implement controls to separate duties to reduce the risk of fraud and errors, ensuring checks and balances within processes.

Management Responsibilities 

Ensure management understands and supports information security responsibilities, reinforcing the importance of security in their roles.

Contact with Authorities 

Maintain contact with relevant authorities to stay informed about regulatory requirements and potential threats.

Contact with Special Interest Groups 

Engage with external groups to stay updated on security trends and best practices, fostering a culture of continuous learning.

Threat Intelligence 

Collect and analyse threat intelligence to stay ahead of potential security threats, leveraging external and internal sources.

Information Security in Project Management 

Integrate information security into project management processes, ensuring that security considerations are included in all projects.

Supplier Security 

Assess and manage the security of suppliers and third parties, ensuring that they meet your information security requirements.

Business Continuity 

Develop and test business continuity and disaster recovery plans, ensuring that the organisation can continue to operate in the event of a disruption.

Our platform provides templates, tracking, and management tools to support the implementation of organisational controls. These tools help in defining roles, managing policies, and maintaining critical contacts with authorities and special interest groups.

People Controls

Screening 

Conduct background checks and screening for employees and contractors to ensure their suitability for roles involving sensitive information.

Terms and Conditions of Employment 

Include information security responsibilities in employment contracts to formalise expectations and responsibilities.

Awareness, Education, and Training 

Implement training programs to ensure staff are aware of information security policies and practices, fostering a culture of security.

Disciplinary Process 

Establish a process for disciplinary action in case of security breaches to enforce accountability and compliance.

Responsibilities after Termination 

Define responsibilities for information security after employment termination to ensure continued protection of sensitive information.

Confidentiality or Non-Disclosure Agreements 

Ensure confidentiality agreements are signed and enforced to protect proprietary and sensitive information.

Remote Working

Implement controls to secure remote working environments, ensuring that remote access does not compromise security.

Event Reporting 

Establish mechanisms for reporting security events to ensure timely and effective response to incidents.

Our platform’s user management and training features support the implementation of people controls. These tools facilitate background checks, manage employment terms, deliver training programs, and enforce confidentiality agreements.

Physical Controls

Establish secure perimeters to protect information assets, using barriers, access controls, and surveillance.

Physical Entry Controls

Implement entry controls to prevent unauthorised access to facilities, including ID badges, biometric scanners, and security personnel.

Securing Offices, Rooms, and Facilities

Protect physical locations where information assets are stored, ensuring they are secure and access is controlled.

Physical Security Monitoring 

Monitor physical security to detect and respond to incidents, using CCTV, alarms, and security patrols.

Protection against Physical Threats

Implement measures to protect against physical threats, such as natural disasters, theft, and vandalism.

Working in Secure Areas 

Define procedures for working in secure areas to ensure that only authorised personnel have access.

Clear Desk and Clear Screen Policy 

Implement policies to ensure workspaces are kept clear of sensitive information, reducing the risk of unauthorised access.

Equipment Security 

Ensure the security of equipment both on-site and off-site, including laptops, servers, and storage devices.

Secure Disposal or Reuse of Equipment 

Implement procedures for the secure disposal or reuse of equipment, ensuring that sensitive information is not exposed.

Our platform supports the implementation of physical controls through documentation and tracking tools that help establish secure perimeters, manage entry controls, and protect physical locations and equipment.

Technological Controls

User Endpoint Devices 

Secure endpoint devices used by employees, including laptops, mobile devices, and desktops.

Privileged Access Management 

Control and monitor privileged access to critical systems, ensuring that only authorised users have access to sensitive information.

Information Access Restriction 

Define and enforce access controls for information assets, ensuring that access is based on the principle of least privilege.

Secure Authentication Information 

Implement secure authentication methods, including multi-factor authentication and strong password policies.

Capacity Management 

Ensure IT resources are sufficient to meet operational needs, preventing system overloads and ensuring availability.

Malware Protection 

Implement anti-malware solutions to detect and prevent malicious software from compromising systems.

Vulnerability Management 

Regularly identify and address system vulnerabilities through patch management and vulnerability scanning.

Configuration Management 

Maintain secure configurations for IT systems, ensuring that settings are optimised for security.

Information Deletion 

Implement secure deletion methods for sensitive information, ensuring that data is irretrievable once deleted.

Data Masking 

Use data masking techniques to protect sensitive data in non-production environments, such as testing and development.

Data Leakage Prevention

Implement controls to prevent data leakage, ensuring that sensitive information is not accidentally or maliciously disclosed.

Information Backup

Regularly back up data and ensure recovery procedures are in place, protecting against data loss.

Redundancy 

Ensure redundancy for critical systems to maintain availability, including failover and load balancing.

Logging and Monitoring 

Implement logging and monitoring to detect and respond to incidents, ensuring that suspicious activities are identified and addressed.

Clock Synchronisation 

Ensure system clocks are synchronised, maintaining accurate time-stamps for logs and events.

Cryptographic Controls 

Implement and manage cryptographic solutions, including encryption and key management.

Secure Development 

Ensure secure coding practices are followed during software development, reducing the risk of vulnerabilities in applications.

Our platform’s technological controls management features assist in securing endpoint devices, managing privileged access, enforcing access controls, and ensuring effective malware protection, vulnerability management, and secure configurations.

7. Performance Evaluation
Monitoring and Measurement

Monitor, measure, analyse, and evaluate the ISMS performance against information security objectives (Clause 9.1).

Our platform provides performance tracking and measurement tools that help in monitoring ISMS performance, analysing results, and ensuring continuous alignment with security objectives.

Internal Audit

Conduct internal audits to verify the ISMS effectiveness and compliance with ISO 27001 (Clause 9.2).

Our platform’s audit management features streamline the planning, execution, and documentation of internal audits, ensuring a thorough evaluation of ISMS effectiveness.

Management Review

Perform management reviews to assess the overall performance of the ISMS and make necessary adjustments (Clause 9.3).

Our platform supports management reviews by providing templates and tools to document review inputs, decisions, and actions, facilitating a structured review process.

8. Continual Improvement
Corrective Actions

Identify and address nonconformities through corrective actions (Clause 10.1).

Our platform’s incident management and corrective actions tools help in identifying nonconformities, documenting corrective actions, and tracking their implementation and effectiveness.

Continual Improvement

Implement continuous improvement processes to enhance the ISMS (Clause 10.2).

Our platform’s continuous improvement features support ongoing assessment and enhancement of the ISMS, ensuring that security practices evolve to meet changing threats and requirements.

9. Certification Audit
Pre-Certification Audit (Optional)

Conduct a pre-certification audit to identify any gaps and make necessary improvements.

Our platform helps prepare for certification audits by providing audit templates, documentation management, and gap analysis tools to ensure readiness.

Stage 1 Audit (Documentation Review)

An external certification body reviews your ISMS documentation to ensure compliance with ISO 27001 requirements.

Stage 2 Audit (On-Site Audit)

The certification body conducts an on-site audit to verify the implementation and effectiveness of the ISMS.

Certification Decision

The certification body reviews the audit findings and decides whether to grant ISO 27001:2022 certification.

Our platform facilitates the certification process by organising documentation, tracking audit progress, and ensuring all necessary requirements are met.

10. Post-Certification Activities
Surveillance Audits

Undergo regular surveillance audits (typically annually) to ensure ongoing compliance with ISO 27001.

Recertification Audits

Every three years, undergo a recertification audit to maintain the ISO 27001 certification.

Our platform supports ongoing compliance through regular surveillance and recertification audit management, ensuring continuous adherence to ISO 27001 standards.