ISO 27001 is the international standard for information security management systems (ISMS). Certification means establishing organizational security discipline, not simply passing an audit.
Phase 1: Gap analysis
Compare your current practices with ISO 27001 requirements. Identify existing, missing and partially implemented controls. This phase takes two to four weeks.
Phase 2: Scope and policies
Define the certification scope, whether the entire organization or selected departments, and write the high-level ISMS policy and supporting procedures. Management commitment is essential.
Phase 3: Implementing controls
- Risk assessment and the Statement of Applicability (SoA)
- Physical and environmental security controls
- Access control, identity management and authorization
- Supplier management and contracts
- Incident management and business continuity
Phase 4: Internal audit and certification
Resolve nonconformities identified during the internal audit, then apply to an accredited certification body. The audit has two stages: Stage 1 reviews documentation and Stage 2 reviews implementation. A typical project takes six to nine months.
Keep reading