© xxx

SAFER, SMARTER, GREENER

TEN STEPS TO INFORMATION SECURITY WITH ISO 27001

1. Study 27001Start by familiarizing yourself with the standard and its purpose. It is not uncommon for organizations to introduce an information security management system before they have a full understanding of what the standard is about and its requirements. This way it is easy to use the standard as a checklist of requirements that must be ticked off. With this strategy you can easily spend time preparing documentation that ISO 27001 does not require. In addition, you risk to only partly meet the requirements of the standard and that the work becomes unsystematic. Preparations are essential to obtain a successful certification.

2. Ensure that management is involved and has approved the projectSuccess requires that management is involved and committed.Management must commit to plan, implement, monitor, review,maintain and continually improve the management system.Management should also ensure that resources are available towork with the information security management system and thatthe employees responsible for developing, implementing andmaintaining the system have the necessary competence and receive appropriate training. With these prerequisites in place, you can:nDevelop an information security policynDetermine objectives and plans relating to information securitynDefine and allocate roles and responsibilities within

information security

3. Determine policy and scope of the information securityWhen management is involved and committed, work with the information security management system can start.In this step the company determines the scope of the information security management system. You need to define:nA policy for information securitynObjectives for information securitynClear roles/responsibilities with respect to information security

When these issues are defined you need to decide which parts of the organization should be included in the management system - areas, locations, resources, techniques etc.

4. Choose a method for risk assessmentA risk assessment will help you identify potential information security risks, how they can affect your sensitive information and the probability for these security risks to become a reality.The choice of risk assessment model is one of the most important elements when implementing an information security management system. The standard does not specify which risk assessment model that should be used. Instead, the standard requires that the chosen model works to:nAssess risks related to confidentiality, integrity and availabilitynSet goals to keep risks at an acceptable levelnEstablish criteria that defines when a risk is acceptablenAssess risks

In this guide, you will learn step by step how to implement an information security management system.

BUSINESS ASSURANCE

DNV GL – Business Assurance, Palace House, 3 Cathedral Street, London SE1 9DE www.dnvgl.com/assurance/ © DNV GL AS. 2016. All rights reserved.

5. Identify, analyze and assess riskWhen the risks have been identified they need to be analyzed and assessed.nEvaluate how the organization would be damaged if the

identified security risks become a reality. Evaluate what the consequences would be if the confidentiality, integrity or availability of your assets (information resources) would be compromised or damaged.

nComplete an estimate of the different risk levels.nDetermine whether the risks are acceptable or require action

by following previously defined criteria for acceptability.

Choose one of the following actions:nAccept the risk. For example, if the actions are too costly or if

it’s not possible for the organization to take action (i.e. in the event of natural disasters or political revolutions).

nTransfer the responsibility for the risk to someone else. For example, an external provider or an insurance company.

nEnable control mechanisms to keep risk at an acceptable, low level.

6. Define actions and objectives for riskmanagementTo meet the requirements identified during the risk assessmentprocess, objectives and actions must be identified and implemented. This identification needs to take into account the criteria for acceptable and unacceptable risks as well as legal, regulatory and contractual obligations.

7. Final implementation of ISO 27001Implement a plan that includes:nA description of the risk management where management

actions, resources, responsibilities and the order of priority for actions with respect to information security is provided.

nA risk management plan to reach the objectives. This includes both funding and allocation of roles and responsibilities.

nThe measures necessary to meet the objectives.nTrainingnImplementation of the management system and resources.

8. Educate employees and allocate resourcesSufficient resources (staff, time and money) must be assigned toimplement an information security management system and associated safety measures properly. It is also important that employees that work with the information security management system (for example with system maintenance, documentation and security) receive correct training.

9. Internal audits, management review and improvementsTo ensure that the information security management system isand remains effective, the standards include the following requirements:nExecute internal auditsnManagement must execute regular evaluations of the

information security management system to ensure that the system remains complete and to facilitate finding improvements in the information security management system procedures.

10. Start your road to certification early andconsider a pre-assessmentThe certification process can take a few months, from the request for quote until the certification audit is completed. Please contact us at DNV GL Business Assurance early (during step 9) to request a quote for the entire certification process.

It is common that much energy is devoted to perfecting thingsthat already work well, while other, essential elements don’t getthe attention they need. Plan an external pre-assessment a fewmonths before the certification audit even if your managementsystem is not completely finished. Identifying areas of non-conformance at an early stage will allow you to correct these before you move on to the certification audit.

Keep in mind that the management system does not have to beperfect for the first audit - it is enough that all elements are compliant with the requirements of the standard. Notify DNV GL Business Assurance that the pre-assessment should be included in the contract and schedule it for the last phase of step 9.

Why partner with us?DNV GL - Business Assurance is a world leading certification body. We work with our customers to assure the performance of their products, processes and organizations through certification, assessment and training services. Our services help customers build stakeholder trust and create a platform for sustainable business performance.

DNV GL - Business Assurance, 1400 Ravello Drive, Katy, Texas 77449 www.dnvglcert.com ©DNV GL AS. All rights reserved