ISO 27001 Foundation cheat sheet

ISO/IEC 27001 is a certifiable management system standard specifying requirements for establishing, implementing, maintaining and continually improving an ISMS; it is not a control catalog.

ISO/IEC 27002 provides implementation guidance for controls and is informative, not certifiable; Annex A of 27001 states control requirements.

The 27001:2022 Annex A structure has 93 controls in 4 themes: Organizational (37), People (8), Physical (14), Technological (34).

An ISMS rests on the Plan-Do-Check-Act cycle: Plan (context, risk, objectives), Do (implement), Check (monitor, audit, review), Act (correct and improve).

Information security preserves confidentiality, integrity and availability; ISO 27000 additionally references other properties such as authenticity, accountability, non-repudiation and reliability.

Terms: 'risk' is the effect of uncertainty on objectives; 'residual risk' remains after risk treatment; 'risk appetite' is the amount of risk an organization is willing to accept.

Certification is issued by an accredited certification body after a successful audit; the standard itself is not a certificate and no body can certify a person.

27001 requirements are mandatory for certification ('shall'), while Annex A controls are selected and justified in the Statement of Applicability.

Clause 4 requires the organization to determine external and internal issues relevant to its purpose and that affect its ability to achieve intended ISMS outcomes.

Interested parties (Clause 4.2) must be identified along with their relevant requirements; these requirements become part of the ISMS scope considerations.

The ISMS scope statement (Clause 4.3) must be documented and consider the issues, interested parties, interfaces and dependencies among activities.

Clauses 4.1 and 4.2 are not required to be documented as information, but the scope in 4.3 must be maintained as documented information.

The ISMS (Clause 4.4) is described as a process-based system, and the organization must establish, implement, maintain and continually improve it.

Context analysis feeds risk assessment: issues and requirements shape which risks and controls are relevant to the ISMS.

External issues examples include legal, regulatory, technological, competitive and market factors; internal issues include culture, governance, capabilities and resources.

Top management (Clause 5.1) must demonstrate leadership by ensuring policy and objectives are compatible with strategic direction and by integrating ISMS requirements into business processes.

The information security policy (Clause 5.2) must be documented, communicated within the organization and made available to relevant interested parties.

Roles and responsibilities (Clause 5.3) must be assigned and communicated; top management must assign responsibility and authority for ISMS performance and reporting.

Clause 6.1 requires planning actions to address risks and opportunities; risk assessment must define and apply risk acceptance criteria and identify risk owners.

Risk treatment (Clause 6.1.3) requires selecting controls and producing a Statement of Applicability (SoA), which justifies inclusion or exclusion of each Annex A control.

Information security objectives (Clause 6.2) must be measurable where practicable, monitored, communicated, and updated; they must be consistent with the policy.

Planning of changes (Clause 6.3) requires changes to the ISMS to be carried out in a planned manner, considering purpose, potential consequences, resources and responsibility.

Risk assessment and treatment results must be retained as documented information.

Clause 7 support elements: resources, competence, awareness, communication and documented information.

Competence (7.2) requires determining necessary competence, ensuring persons are competent, taking actions to acquire competence, and retaining evidence.

Documented information (7.5) must be controlled: available and suitable when needed, and protected for confidentiality, integrity and loss of integrity.

Operational planning (8.1) requires processes to be planned, implemented and controlled, and documented information retained to demonstrate the processes were carried out as planned.

Risk assessment (8.2) must be performed at planned intervals or when significant changes occur; risk treatment (8.3) must be implemented and retained as documented information.

Performance evaluation (Clause 9) covers monitoring, measurement, analysis and evaluation (9.1), internal audit (9.2) and management review (9.3).

Internal audits must be conducted at planned intervals and the audit programme must consider the importance of processes and prior results.

Management review inputs include audit results, nonconformities, monitoring results, interested-party feedback, risk assessment status and opportunities for improvement; outputs include improvement decisions.

Clause 10.1 requires determining opportunities for improvement and implementing actions to meet customer and interested-party requirements and enhance the ISMS.

Nonconformity and corrective action (10.2) requires reacting, evaluating the need to eliminate the cause, implementing action, reviewing effectiveness and updating risks if necessary.

Corrective action records must be retained as documented information, including the nature of nonconformities and results of corrective action.

Continual improvement (10.3) requires the organization to continually improve the suitability, adequacy and effectiveness of the ISMS.

Certification audit is a two-stage process: Stage 1 reviews readiness and documentation; Stage 2 evaluates implementation and effectiveness.

A surveillance audit is typically performed at least once a year, and recertification occurs on a three-year cycle for a typical ISO management system certificate.

A nonconformity is a requirement not fulfilled; a major nonconformity generally affects the ability of the system to achieve intended results and must be corrected before certification.

Certification is voluntary; the standard does not impose legal obligations by itself, but compliance with laws and regulations may be required by the organization's own context.

'Documented information' covers both documents (information and the medium on which it is contained) and records (evidence of results achieved).

An 'interested party' is a person or organization that can affect, be affected by, or perceive itself to be affected by a decision or activity.

'Effectiveness' is the extent to which planned activities are realized and planned results achieved; 'efficiency' is the relationship between results achieved and resources used.

A 'control' is a measure that maintains and/or modifies risk; controls can be preventive, detective or corrective.

'Monitoring' is determining the status of a system, process, product, service or activity; 'measurement' is the process of determining a value.

The Statement of Applicability is the central linking document between risk treatment and Annex A controls and must be maintained as documented information.

'Outsourcing' (8.1) does not transfer responsibility: the organization must control externally provided processes, products or services used within the ISMS scope.

Before the Stage 1 audit, key documented information normally includes the scope, policy, risk assessment and treatment, SoA, objectives and internal audit and management review records.

Evidence of ISMS operation (records, logs, meeting minutes, training records) is generally reviewed more closely in Stage 2 than in Stage 1.

Internal audit and management review must have been completed before the certification audit, because they are required ISMS processes.

The SoA must list each Annex A control with justification for inclusion or exclusion; exclusion does not mean the risk is ignored, it must be justified.

A risk register typically records risk description, owner, likelihood, impact, treatment and residual risk, and is linked to the SoA.

Audit findings are categorized by the certification body, commonly as major nonconformity, minor nonconformity, observation and opportunity for improvement.

Corrective action for a major nonconformity usually requires verification by the auditor before the certificate is granted.

Risk assessment includes risk identification, risk analysis and risk evaluation; risk treatment includes selecting and implementing options.

Risk treatment options include modifying risk (controls), retaining risk, avoiding risk and sharing risk; these correspond to ISO 31000 treatment options.

Risk acceptance criteria must be established and applied; residual risk must be acceptable against those criteria.

Risk owners must be assigned and must accept the residual risk; this is a key Clause 6.1.2/6.1.3 requirement.

The risk assessment methodology should be consistent, valid and produce comparable results; it should define how likelihood and impact are determined.

Risk assessment must be repeated at planned intervals and when significant changes occur, and results must be retained as documented information.

The SoA must include justification for inclusion of controls and justification for exclusion of Annex A controls.