An Overview of How to Implement ISO 27001
In this section, I will guide you through the project management approach I use to implement ISO 27001.
Each section will then take you into a detailed exploration of that area.
Table of Contents
Before We Start
Before we start with my ISO 27001 implementation overview, let’s acknowledge that there are many routes to success.
There’s no definitively ‘right’ way to implement ISO 27001 – so long as you adhere to the standard – but there are ‘wrong’ ways. I know; I’ve been there.
I also know that whatever you do, an auditor will find something to mark up for improvement – they have to; it’s their job to identify areas for improvement. Sometimes, the trick is allowing them to find something minor (but I never said that).
I’ve documented my essential advice separately, but I strongly suggest having a robust plan with multiple engaged stakeholders and getting something out there that might not be perfect on day one but can evolve, just like the standard suggests.
Going it alone without solid support around you can result in two things;
1) Pushback from others: Failure to obtain senior support and stakeholder involvement will likely result in resistance to change, and with ISO 27001, that can be project-killingly detrimental. For example, if you don’t get stakeholders to contribute to your policies, they will likely tear them down if the first time they see them is when they are published.
2) Dependency upon an individual: Without a robust framework and support, the whole ISO standard and ISMS will fall apart when you leave the organisation.
There are many other reasons, but these are my top two.
On another note, I won’t go into detail about how to manage projects. That’s all documented elsewhere on my website!
In supporting articles, I’ve previously summarised The ISO 27001 Annex A Organisational Controls and the Clauses of ISO 27001.
Let’s get on then……
An Overview of the Implementation Process Stages
The first year of implementation is broadly in 5 key stages;
| Stage | Key Activities |
|---|---|
| 1. Initiation Phase | Establish a project framework and resources and define your scope. |
| 2. Planning Phase | Establish a project framework and resources, and define your scope. |
| 3. Implementation Phase | Creating the policies, procedures and controls that support your risk assessments. |
| 4. Monitoring & Review Phase | Checking that your actions have a positive impact |
| 5. Continuous Improvement Phase | Review outcomes and plan how to improve the performance of the ISMS. |
An Overview of the Project Management Phases for An ISO 27001 Project
Step 1: Initiation
The Initiation phase of ISO 27001 implementation focuses on establishing a solid foundation for the Information Security Management System (ISMS).
This phase ensures that all necessary preparatory steps are taken to set up the ISMS effectively, including understanding the organisation’s context, defining the scope, and ensuring leadership commitment.
I’ve suggested setting up the Steering Group early because you’ll need a location to review your scope and, in the next step, risk assessments and treatments for approval. A group can act as a review body and issue directions from the outset. Otherwise, you’ll likely find yourself rudderless or acting like a dictator.
The major inputs to this phase include the organisational context, internal and external issues, statutory and regulatory requirements, and the expectations of interested parties.
The main outputs include establishing a project plan, a steering group, an Information Security Management System (ISMS) scope, and the initial information security policies and objectives.
Step 2: Planning
The Planning phase in the ISO 27001 implementation process is crucial for identifying, assessing, and treating risks to ensure effective information security management within the defined Information Security Management System (ISMS) scope.
This phase establishes a structured approach to managing information security risks by defining methodologies, documenting risks, and determining appropriate treatments.
The major inputs include the ISMS scope and the initial Statement of Applicability (SoA).
The main outputs are documented risk management methodologies, risk logs, risk treatment plans, and an updated SoA.
Step 3: Implementation
The Implementation phase of ISO 27001 is where the planning comes to fruition, as it involves implementing the necessary controls and measures to effectively manage information security risks.
This phase is focused on developing and implementing policies, procedures, and controls, conducting awareness campaigns, and providing training to ensure the ISMS is operational.
The major inputs include the Statement of Applicability (SoA), risk treatment plans, and ISMS objectives.
The main outputs are a comprehensive resource plan, documented policies and procedures, implemented controls, and trained staff.
Stage 4: Monitoring & Review
The Monitoring and Review phase of ISO 27001 implementation focuses on continuously evaluating the ISMS to ensure its effectiveness and alignment with organisational objectives.
This phase involves regular monitoring, measurement, and auditing activities to identify areas for improvement and ensure compliance with the established policies and controls.
The key inputs include scope changes and ISMS objectives.
The main outputs are ISMS performance reports, management review minutes, and audit plans and findings.
Step 5: Continuous Improvement
The Continuous Improvement phase in ISO 27001 focuses on maintaining and enhancing the effectiveness of the ISMS by systematically addressing non-conformities and implementing improvements.
This phase ensures the ISMS evolves with the organisation’s changing needs and continuously improves its information security posture.
The major inputs include ISMS performance reports, management review minutes, and audit findings.
The primary output is the improvement plan, which addresses identified non-conformities and outlines steps for ongoing improvement.
Explore the Project Phases of an ISO 27001 Implementation
The ISO 27001 Project Initiation Phase
The ISO 27001 Project Planning Phase
The ISO 27001 Project Implementation Phase
