bagelhole/iso27001-compliance

ISO 27001 Compliance

Implement an Information Security Management System (ISMS) aligned with ISO/IEC 27001:2022.

When to Use

• Establishing an ISMS for the first time in an organization
• Preparing for ISO 27001 certification audit
• Conducting risk assessments and developing risk treatment plans
• Creating the Statement of Applicability (SoA)
• Transitioning from ISO 27001:2013 to the 2022 revision
• Meeting customer or regulatory requirements for ISO 27001 certification

ISMS Plan-Do-Check-Act Cycle

pdca_cycle:
  plan:
    - Define ISMS scope and boundaries
    - Establish information security policy
    - Conduct risk assessment
    - Develop risk treatment plan
    - Produce Statement of Applicability
    - Obtain management approval and commitment
    - Define security objectives and metrics

  do:
    - Implement selected Annex A controls
    - Deploy technical security controls
    - Conduct security awareness training
    - Document all procedures and processes
    - Implement incident management process
    - Establish supplier security management

  check:
    - Conduct internal audits (at least annual)
    - Perform management review meetings
    - Monitor and measure control effectiveness
    - Review incident trends and near misses
    - Assess compliance with legal requirements
    - Evaluate security metrics against objectives

  act:
    - Address nonconformities with corrective actions
    - Implement continual improvement initiatives
    - Update risk assessment based on changes
    - Refine controls based on audit findings
    - Communicate improvements to stakeholders

ISMS Scope Definition

isms_scope:
  template:
    organization: "Company Name, Ltd."
    scope_statement: |
      The ISMS covers the design, development, operation, and support of
      the Company's cloud-based SaaS platform, including all supporting
      infrastructure, personnel, and processes at the following locations.

    included:
      locations:
        - "Primary office: 123 Main Street, City, Country"
        - "AWS us-east-1 and eu-west-1 regions"
        - "Remote workers accessing corporate systems"
      business_processes:
        - "Software development and deployment"
        - "Cloud infrastructure management"
        - "Customer data processing and storage"
        - "Customer support operations"
        - "Corporate IT and internal systems"
      information_assets:
        - "Customer data (PII, business data)"
        - "Source code and intellectual property"
        - "Employee personal data"
        - "Financial records"
        - "Security configurations and credentials"
      technology:
        - "AWS cloud infrastructure"
        - "SaaS application stack"
        - "Corporate IT systems (Google Workspace, Okta, Jira)"
        - "Development tools (GitHub, CI/CD pipelines)"

    excluded:
      - "Physical data center operations (inherited from AWS)"
      - "Third-party SaaS platforms beyond integration points"
    exclusion_justification: "Physical data center controls are inherited from AWS, which maintains its own ISO 27001 certification."

    interfaces:
      - "Customer API endpoints"
      - "Third-party integrations (payment processor, email provider)"
      - "AWS management plane"

Risk Assessment Process

risk_assessment:
  methodology:
    approach: "Asset-based risk assessment"
    risk_formula: "Risk = Likelihood x Impact"
    scale: "1-5 for both likelihood and impact (total 1-25)"

  likelihood_scale:
    1: "Rare - less than once per 5 years"
    2: "Unlikely - once per 2-5 years"
    3: "Possible - once per 1-2 years"
    4: "Likely - multiple times per year"
    5: "Almost Certain - monthly or more frequent"

  impact_scale:
    1: "Negligible - minimal operational impact, no data loss"
    2: "Minor - limited impact, small data exposure, <$10K cost"
    3: "Moderate - significant impact, data breach <1K records, <$100K cost"
    4: "Major - severe impact, large data breach, <$1M cost, regulatory action"
    5: "Critical - catastrophic, massive breach, >$1M cost, business viability at risk"

  risk_matrix:
    #        Impact: 1    2    3    4    5
    likelihood_5:  [5,  10,  15,  20,  25]
    likelihood_4:  [4,   8,  12,  16,  20]
    likelihood_3:  [3,   6,   9,  12,  15]
    likelihood_2:  [2,   4,   6,   8,  10]
    likelihood_1:  [1,   2,   3,   4,   5]

  risk_appetite:
    accept: "Score 1-4 (low risk, accept with monitoring)"
    mitigate: "Score 5-14 (medium risk, implement controls to reduce)"
    escalate: "Score 15-25 (high/critical risk, immediate action required)"

  treatment_options:
    mitigate: "Implement controls to reduce likelihood or impact"
    transfer: "Insurance or contractual transfer to third party"
    avoid: "Eliminate the risk by removing the activity or asset"
    accept: "Accept with documented management approval"

  example_risk_register:
    - id: "RISK-001"
      asset: "Customer database"
      threat: "SQL injection attack"
      vulnerability: "Insufficient input validation"
      likelihood: 3
      impact: 4
      inherent_risk: 12
      treatment: "mitigate"
      controls: ["A.8.28 Secure coding", "A.8.8 Vulnerability management"]
      residual_likelihood: 1
      residual_impact: 4
      residual_risk: 4
      risk_owner: "CTO"

    - id: "RISK-002"
      asset: "Source code repository"
      threat: "Insider theft of intellectual property"
      vulnerability: "Excessive access permissions"
      likelihood: 2
      impact: 5
      inherent_risk: 10
      treatment: "mitigate"
      controls: ["A.5.15 Access control", "A.8.3 Information access restriction"]
      residual_likelihood: 1
      residual_impact: 5
      residual_risk: 5
      risk_owner: "VP Engineering"

    - id: "RISK-003"
      asset: "Cloud infrastructure"
      threat: "Cloud provider outage"
      vulnerability: "Single-region deployment"
      likelihood: 3
      impact: 3
      inherent_risk: 9
      treatment: "mitigate"
      controls: ["A.5.30 ICT readiness for business continuity", "A.8.14 Redundancy"]
      residual_likelihood: 3
      residual_impact: 2
      residual_risk: 6
      risk_owner: "Head of Infrastructure"

Statement of Applicability (SoA)

# ISO 27001:2022 Annex A Controls - Statement of Applicability
soa_template:
  organizational_controls_5:
    "A.5.1":
      control: "Policies for information security"
      applicable: true
      justification: "Required to establish security governance"
      implementation: "Information security policy approved by CEO, reviewed annually"

    "A.5.2":
      control: "Information security roles and responsibilities"
      applicable: true
      justification: "Required for accountability"
      implementation: "RACI matrix for security responsibilities, CISO appointed"

    "A.5.7":
      control: "Threat intelligence"
      applicable: true
      justification: "Required for proactive threat management"
      implementation: "Subscribe to threat feeds, CVE monitoring, vendor advisories"

    "A.5.15":
      control: "Access control"
      applicable: true
      justification: "Required for data protection"
      implementation: "RBAC via Okta, least-privilege IAM policies, quarterly access reviews"

    "A.5.23":
      control: "Information security for use of cloud services"
      applicable: true
      justification: "Primary infrastructure is cloud-based"
      implementation: "AWS security baseline, CSP shared responsibility documented"

    "A.5.29":
      control: "Information security during disruption"
      applicable: true
      justification: "Business continuity requirement"
      implementation: "BCP/DR plans tested annually, multi-AZ deployment"

    "A.5.30":
      control: "ICT readiness for business continuity"
      applicable: true
      justification: "Ensure technology supports continuity"
      implementation: "DR runbooks, RTO/RPO defined, failover tested quarterly"

  people_controls_6:
    "A.6.1":
      control: "Screening"
      applicable: true
      implementation: "Background checks for all employees before hiring"

    "A.6.3":
      control: "Information security awareness, education and training"
      applicable: true
      implementation: "Annual security training, phishing simulations quarterly"

    "A.6.5":
      control: "Responsibilities after termination or change of employment"
      applicable: true
      implementation: "Offboarding checklist, access revoked within 24 hours"

  physical_controls_7:
    "A.7.1":
      control: "Physical security perimeters"
      applicable: false
      exclusion_justification: "No company-operated data centers, inherited from AWS"

  technology_controls_8:
    "A.8.1":
      control: "User endpoint devices"
      applicable: true
      implementation: "MDM enrollment, disk encryption, screen lock policy"

    "A.8.5":
      control: "Secure authentication"
      applicable: true
      implementation: "MFA required for all systems, SSO via Okta"

    "A.8.8":
      control: "Management of technical vulnerabilities"
      applicable: true
      implementation: "Weekly vulnerability scans, 30-day patch SLA for critical"

    "A.8.9":
      control: "Configuration management"
      applicable: true
      implementation: "Infrastructure as code, AWS Config rules, baseline hardening"

    "A.8.15":
      control: "Logging"
      applicable: true
      implementation: "Centralized logging via CloudWatch + SIEM, 12-month retention"

    "A.8.16":
      control: "Monitoring activities"
      applicable: true
      implementation: "SIEM alerting, 24/7 on-call rotation, anomaly detection"

    "A.8.24":
      control: "Use of cryptography"
      applicable: true
      implementation: "TLS 1.2+, AES-256 at rest, KMS key management"

    "A.8.25":
      control: "Secure development lifecycle"
      applicable: true
      implementation: "SAST/DAST in CI, code review required, dependency scanning"

    "A.8.28":
      control: "Secure coding"
      applicable: true
      implementation: "OWASP guidelines, security code review, automated linting"

Internal Audit Program

internal_audit:
  schedule:
    frequency: "Annual full cycle, quarterly focused audits"
    cycle: "All ISMS clauses and applicable Annex A controls audited over 12 months"

  audit_plan_template:
    audit_id: "IA-2025-Q1"
    scope: "Clauses 4-10, Annex A controls A.5.1-A.5.15"
    auditor: "Internal auditor (independent of audited area)"
    audit_dates: "2025-03-10 to 2025-03-14"
    areas:
      - area: "Access Control (A.5.15)"
        auditee: "IT Security Team"
        evidence_requested:
          - "Access review records from last quarter"
          - "Joiner/mover/leaver process records"
          - "Privileged access management logs"
      - area: "Risk Management (Clause 6.1)"
        auditee: "Risk Management Team"
        evidence_requested:
          - "Current risk register"
          - "Risk assessment methodology document"
          - "Management risk review meeting minutes"

  finding_categories:
    major_nonconformity: "Requirement not met, significant risk to ISMS effectiveness"
    minor_nonconformity: "Requirement partially met, limited risk"
    observation: "Area for improvement, no requirement breach"
    positive_finding: "Notably effective implementation"

  corrective_action:
    major: "Root cause analysis within 10 days, corrective action within 30 days"
    minor: "Corrective action within 60 days"
    observation: "Address in next ISMS review cycle"
    verification: "Auditor verifies corrective action effectiveness"

Management Review Meeting

management_review:
  frequency: "At least annually, recommended quarterly"
  attendees:
    required:
      - "CEO or Managing Director"
      - "CISO or Information Security Manager"
      - "Department heads"
    optional:
      - "Internal auditor"
      - "Risk manager"
      - "External consultant"

  mandatory_inputs:
    - "Status of actions from previous management reviews"
    - "Changes in external and internal issues relevant to the ISMS"
    - "Information security performance (metrics and KPIs)"
    - "Audit results (internal and external)"
    - "Incident trends and nonconformities"
    - "Risk assessment results and risk treatment plan status"
    - "Interested party feedback"
    - "Opportunities for continual improvement"

  mandatory_outputs:
    - "Decisions on continual improvement opportunities"
    - "Decisions on changes needed to the ISMS"
    - "Resource allocation decisions"
    - "Updated risk acceptance decisions"

  kpis_to_report:
    - "Number and severity of security incidents"
    - "Vulnerability remediation SLA compliance"
    - "Security awareness training completion rate"
    - "Access review completion rate"
    - "Audit finding closure rate"
    - "Risk treatment plan progress"
    - "Patch compliance percentage"

ISO 27001 Certification Checklist

certification_checklist:
  stage_1_audit_preparation:
    - [ ] ISMS scope documented and approved
    - [ ] Information security policy published
    - [ ] Risk assessment methodology defined
    - [ ] Risk assessment completed with risk register
    - [ ] Risk treatment plan developed
    - [ ] Statement of Applicability completed
    - [ ] ISMS objectives defined with measurable targets
    - [ ] Internal audit program established
    - [ ] At least one full internal audit completed
    - [ ] Management review conducted with minutes documented
    - [ ] Document control process in place

  stage_2_audit_preparation:
    - [ ] All Annex A controls implemented per SoA
    - [ ] Evidence of control operation for 3+ months
    - [ ] Corrective actions from internal audit tracked and closed
    - [ ] Security awareness training delivered and recorded
    - [ ] Incident management process operational with records
    - [ ] Supplier security assessments performed
    - [ ] Business continuity plan tested
    - [ ] All mandatory documented information available
    - [ ] Employees aware of security policy and their responsibilities

  surveillance_audit_readiness:
    - [ ] All corrective actions from certification audit closed
    - [ ] Continuous internal audit schedule maintained
    - [ ] Management reviews conducted per schedule
    - [ ] Risk register updated with new threats and changes
    - [ ] Metrics demonstrate ISMS effectiveness
    - [ ] Changes to ISMS scope documented

Best Practices

• Secure visible management commitment with a signed information security policy
• Define ISMS scope carefully; too broad makes certification expensive, too narrow reduces value
• Use an asset-based risk assessment approach to ensure comprehensive coverage
• Maintain the Statement of Applicability as a living document aligned with the risk register
• Conduct internal audits with auditors independent of the area being audited
• Hold management review meetings quarterly rather than only annually
• Integrate ISO 27001 controls into daily operations rather than treating them as a separate compliance exercise
• Use metrics and KPIs to demonstrate ISMS effectiveness to auditors and management
• Plan for the 3-year certification cycle: certification audit, then two surveillance audits
• Start collecting evidence of control operation at least 3 months before the Stage 2 audit