journey to_iso_27001_new_2013

Copyright © 2013 BSI. All rights reserved.

The journey to ISO 27001 certification

Copyright © 2013 BSI. All rights reserved.2

The start of the journey –who will manage this?


So what is the journey to certification?

• At some point the business has a brainwave

• Or a client asks ‘do you have certification to ISO 27001?’

• And of course we don’t

• So what happens next?

• The idea of certification is then bounced around the business – do we need it? What will cost? Who will do it?


The journey to certification (cont.)

• And then the question is asked does it belong to the IT Director or the Quality Director or the Security Manager?

• And it lands on your desk, with no background of why and where.

• So what do we do next?

• What are we going to ask?

• Who are we going to turn to for help?


The journey to certification: What are the questions?

• What is this for?

• What money do we have?

• Do we have any resources?

• Is there any training?

• Has anyone looked at the Standard?

• What will be the Scope of the Certification?

• How much time do we have?


The journey to certification: What will we need in the ISMS?

• Security policy

• Organizational security

• Asset classification and control

• Personnel security

• Physical and environmental security

• Communications and operations management

• Access control

• System development and maintenance

• Business continuity management

• Compliance


The journey to ISO 27001 certification: Planning

30/01/2015


Planning phase

We now need to spend time planning the task –We should spend:

But we spend:

80% of our time planning

20% of the time implementing

20% of our time planning

60% of the time fire fighting

20% of the time implementing

Which then ends up lasting the life of the system or to our retirement which ever comes sooner.


Planning phase

• Security policy

• Organizational security

• Asset classification and control

• Personnel security

• Physical and environmental security

• Communications and operations management

• Access control

• System development and maintenance

• Business continuity management, ISO 22301

• Compliance


What are the next steps for implementation?


Project plan

• We will be following a defined project plan

• The plan has 4 stages and 18 defined steps



Stage 1: Commitment to implement


Commitment to Implement



Stage 2


The journey to ISO 27001 certification: Stage 2

• Receive Training

• Perform Gap Analysis

• Prepare Implementation Project Plan

• Estimate Costs


Where we are …



Stage 3


Implement and Operate

• Support Project

• Monitor Project



Stage 4


Monitor, Measure and Review

• Management review

• Prepare for Certification



Lessons Learned


So what are the lessons learned?

We rarely look at the lessons learned. Let’s look at some of the main lessons for us all.

1. Lack of Commitment

2. Time

3. Resources

4. Scope and boundaries creep

5. Training and awareness – Impact to our process.

6. Project Management – The need of good project management.



Certification process with BSI


The registration process

• Obtain quotation and submit application

• Client manager appointed

• System reviewed to ensure standard requirements addressed and registration assessment planned

• Initial assessment conducted

• Conformity and effectiveness of system to standard assessed

• Corrective action plan (if required) submitted

• Registration confirmed

• Certificate issued

• Continuous assessment programme (3 year cycle)

• Total client care


Consider certification

Contact BSI

Stage I Assessment

Stage II Assessment

Certification

• www.bsiamerica.com• 1-888-429-6178• Ask your Account Manager

• Documentation Review• Assessment of the MS Planning and readiness• Corrective action (if applicable)• Planning for Stage II

• Assessment of the implementation of the MS• Assessment of risk management• Corrective action (if applicable)• Certification recommendation

• Clear corrective actions• Certification review process• Surveillance assessments• 3-yearly recertification assessments

http://www.bsiamerica.com/


Contact Us

Address: BSI Group America Inc.

12110 Sunset Hills Road, Suite 200

Reston, VA 20190

Main Office Telephone: 888-429-6178

Fax: 703 437 9001

Email: [email protected]

Links: http://www.bsiamerica.com

http://www.bsi-global.com/

journey to_iso_27001_new_2013

Documents

certification stage

defined steps copyright

time planning

certification cont

idea of certification

security manager

time implementing20

time implementingwhich