ISO 27001 LI cheat sheet

Information security preserves confidentiality (only authorized access), integrity (accuracy and completeness), and availability (accessible and usable when needed).

An ISMS is a systematic framework of policies, objectives, processes, and controls used to manage information security risk.

ISO/IEC 27001:2022 contains the requirements for an ISMS; ISO/IEC 27002:2022 provides implementation guidance for Annex A controls.

Clause 4 requires determining external and internal issues, interested parties and their requirements, and the scope of the ISMS.

Risk is often expressed as likelihood multiplied by impact; a threat exploits a vulnerability, and a control reduces risk.

Common risk treatment options are avoid, modify, share, and retain risk.

Clause 5 requires top management to establish policy, assign roles, and integrate ISMS requirements into business processes.

Initiation outputs typically include the ISMS scope, information security policy, risk assessment approach, and implementation plan.

Clause 6.1.2 risk assessment requires risk criteria, repeatable results, and identification, analysis, and evaluation of information security risks.

Risk acceptance criteria define which residual risks are acceptable and who has authority to accept them.

Clause 6.1.3 risk treatment selects controls, compares them with Annex A, and produces the Statement of Applicability and risk treatment plan.

ISO/IEC 27001:2022 Annex A contains 93 controls in four themes: organizational 37, people 8, physical 14, and technological 34.

The Statement of Applicability records applicable controls, inclusion justification, exclusion justification, and implementation status.

A risk treatment plan identifies actions, resources, responsible owners, deadlines, and expected residual risk.

Clause 6.2 ISMS objectives must be measurable where practicable, monitored, communicated, and consistent with the information security policy.

Planning must consider issues, interested party requirements, and risks and opportunities, and changes must be planned in a controlled manner.

Clause 7 support covers resources, competence, awareness, communication, and documented information.

Documented information must be controlled for availability, protection, distribution, access, retrieval, retention, and disposition.

Competence requires determining necessary competence, ensuring persons are competent, taking action where needed, and retaining evidence.

Awareness requires persons to know the policy, their contribution to ISMS effectiveness, and the implications of nonconformance.

Clause 8 operational planning and control requires processes to be planned, implemented, controlled, and outsourced processes to be controlled.

Annex A controls are selected through risk treatment; exclusion is permitted only with justification recorded in the Statement of Applicability.

Least privilege grants users only the minimum access needed for assigned tasks; need-to-know limits access to information.

Segregation of duties separates incompatible tasks to reduce the risk of error, fraud, or unauthorized action.

Clause 9.1 requires determining what to monitor and measure, the methods, when to perform it, who performs it, and when results are analyzed.

Monitoring observes the state of an activity or control; measurement assigns a value using a defined scale.

Clause 9.2 internal audits must be conducted at planned intervals using defined criteria and scope, with impartial auditors.

An audit programme includes frequency, methods, responsibilities, planning, and reporting, and should be risk-based.

Clause 9.3 management review inputs include audit results, nonconformities, performance, risks, and interested party feedback.

Management review outputs include decisions on improvement opportunities and ISMS changes, including resource needs.

A nonconformity is a requirement not fulfilled; corrective action addresses its cause to prevent recurrence.

Internal auditors should not audit their own work, preserving objectivity and impartiality.

Clause 10.1 requires identifying improvement opportunities and implementing actions to meet intended ISMS outcomes.

Clause 10.2 nonconformity and corrective action requires reaction, cause evaluation, action implementation, effectiveness review, and risk updates.

Continual improvement inputs include monitoring results, internal audits, management review, incidents, and nonconformities.

Correction fixes a detected nonconformity; corrective action removes its cause to prevent recurrence.

Documented information must be retained as evidence of the nonconformity, cause, action taken, and results of effectiveness review.

Trend analysis of incidents, audit findings, and metrics supports prioritization of improvement actions.

A certification audit typically has Stage 1, which assesses readiness and documentation, and Stage 2, which assesses implementation effectiveness.

Stage 1 reviews ISMS documentation, scope, risk assessment, Statement of Applicability, internal audit, and management review readiness.

Stage 2 collects evidence of conformity and effective implementation across the defined certification scope.

A major nonconformity is a significant or systemic failure; certification may not be granted until it is corrected and verified.

A minor nonconformity is an isolated lapse; correction and corrective action may be verified before or at the next audit.

Surveillance audits occur at least annually after initial certification; recertification occurs before the three-year cycle ends.

The certification body must be accredited, and the certification decision is made independently of the audit team.

Audit findings are classified according to the certification scheme, commonly as conformity, nonconformity, or observation/opportunity for improvement.