Often considered the preeminent information security standard, ISO 27001 is becoming an increasingly popular certification. Upon first look, it is a prescriptive, complex and time-consuming standard consisting of detailed requirements and an annex of 114 controls. AssuranceLab is here to cut through the complexity of ISO 27001 and help anyone interested in certification gain a holistic view of what the standard expects of your organisation.
The simplest way to breakdown ISO 27001 is to break it into two lists; Mandatory Requirements and Annex A Controls.
Mandatory Requirements
The ISO 27001 requirements are the mandatory portion of the standard. The outcome of any certification audits is dependant upon these requirements being met through functional processes, adequate documentation and a management-led culture of commitment to information security. The requirement wording is prescriptive and the standard itself provides extensive detail around the expectations of each process implemented. These details are what auditors will be looking for when it comes to certification, and therefore each must be in place for an organisation to be eligible for certification.
The core documents that must be in place for the mandatory requirements to be met include:
Annex A Controls
The key difference between the ISO 27001 requirements and the Annex A Controls is that not all the 114 controls are mandatory for certification to be achieved. Prior to a stage 1 or stage 2 certification audit, an organisation must create a Statement of Applicability, whereby they assess the controls from Annex A that are and are not relevant to their implemented ISMS. For example, control A.11.1.6 speaks to the physical security of delivery and loading areas. If you are a cloud-based company that does not have any delivery or loading areas, this control is deemed not applicable. An auditor will still, however, assess the fairness and accuracy of the provided rationale against any control that is listed as not applicable. If you’re feeling stuck or overwhelmed around how to create the Statement of Applicability, our ISO 27001 readiness assessment will prove a valuable tool and help provide a clear view of the work required!
Next Steps
If you are new to ISO 27001, this article should give you a high level understanding of what the standard requires of organisations, and how to prioritise the design and implementation of both the mandatory requirements and the annex A controls. If this still seems daunting, AssuranceLab partners with consultants who have expertise in ISO 27001 implementation and can help your organisation implement processes and controls that will gain you certification.
If you have the core documents from the mandatory requirements list in place and have implemented the controls applicable to your organisation in Annex A, you are ready to begin the certification journey with AssuranceLab! Reach out to us to discuss our agile and collaborative approach to both stage 1 and stage 2 audits.