To comply with ISO standards, you need to follow a formula that will ensure that you have all your safety and security protocols in place and that your employees are aware of them. <\/p>\n\n\n\n
The process starts with a clear understanding of your Information Security Management System (ISMS). <\/p>\n\n\n\n
We\u2019ve provided a comprehensive ISO 27001 checklist that you can use to make sure you\u2019ve got all your bases covered as well as a sneak peak of some of the content from our Wiki (the guidebook that supports our online tool, Compleye Online). <\/p>\n\n\n\n
Complete checklist for ISO 27001 compliance<\/h2>\n\n\n\n1. Define your ISO 27001 strategy and ambitions<\/h3>\n\n\n\n
To do #1 – Organisation & Context <\/strong><\/p>\n\n\n\n Organisation and Context is a mandatory topic. A good way to get insights for Organisation & Context content is to define your products by defining (per product): <\/p>\n\n\n\n This will lead you to ask:<\/p>\n\n\n\n If you can answer (and document) these questions, you are complying with ISO 27001.<\/p>\n\n\n\n To do #2 – ISMS Objectives<\/strong><\/p>\n\n\n\n You\u2019ll need to define, implement and review (on at least an annual basis) your ISMS objectives.\u202f In their article Information Security Objectives in ISO 27001<\/a>, ISO27001guide.com<\/a> says that \u201cinformation security objectives in ISO 27001 allow organisations to set their requirements from the outset and to continuously monitor to ensure they are achieving them.\u201d<\/p>\n\n\n\n To do #1 – Interested Parties & Legal Requirements<\/strong><\/p>\n\n\n\n Here, you\u2019ll dive into legal requirements that you\u2019ll need to fulfil for your third parties and define the expectations on both sides. The external auditor will expect that you\u2019ve documented how you\u2019ve established this process.<\/p>\n\n\n\n Examples of interested parties (https:\/\/www.iso9001help.co.uk\/<\/a>)<\/p>\n\n\n\n To do #2 – Intellectual Property<\/strong><\/p>\n\n\n\n Intellectual property (IP) is a category of property that includes intangible creations of the human intellect. Typical IP for tech companies could be your\u202fsource code, AI models, certain databases or a method of working. In brief, IP is anything you want to keep secret for your customers and competitors and that needs to be protected when your team is using it.\u202f <\/p>\n\n\n\n To do #3 – Contracts<\/strong> <\/p>\n\n\n\n Make sure you have 1 folder with all your contracts so that you have a good overview – and use different folders within that folder for different types of contracts (or stakeholders). Limit the access to these contracts within your organisation. The external auditor can ask to view 1 or 2 contracts (samples) during the audit. <\/p>\n\n\n\n To do #4 – Global Impact<\/strong><\/p>\n\n\n\n Entering new markets will need some research on privacy and security requirements. Personal data privacy regulations need to be taken into consideration when contracting or expanding outside of the GDPR geographical area. Additional requirements for your ISMS can be ruled by:<\/p>\n\n\n\n To do #5 \u2013 GDPR<\/strong><\/p>\n\n\n\n If you\u2019re a company based in \u2013 or performing business in – Europe, you need to comply with GDPR. As you prepare for certification, you\u2019ll need to:<\/p>\n\n\n\n To do #1 – Define IT Infrastructure Components<\/strong><\/p>\n\n\n\n ISO 27001 requests a scope for your ISMS, so you\u2019ll need to define what you\u2019ll take in scope. Defining the components of your IT Infrastructure will help you to define your scope. <\/p>\n\n\n\n To do #2 – Define ISMS Scope<\/strong><\/p>\n\n\n\n Check out Compleye\u2019s article, \u2018How to Write an ISO 27001 Scope Statement (+3 Examples)\u2019<\/a>.<\/p>\n\n\n\n To do #1 – Suppliers Overview<\/strong><\/p>\n\n\n\n When implementing a set of controls and processes to address suppliers\u2019 risks, the following could be considered:<\/p>\n\n\n\n To do #2 – Suppliers Assessment<\/strong><\/p>\n\n\n\n Supplier Assessment is a very important topic in ISO 27001, especially for technology companies because they make use of so many suppliers. You\u2019ll need to be in control of your suppliers \u2013 assess the high risk suppliers on a yearly basis on a number of topics. The owner of the supplier will need to review the supplier on basic information and contracts. <\/p>\n\n\n\n To do #3 – Vendor Assessment<\/strong><\/p>\n\n\n\n Follow the following steps:<\/p>\n\n\n\n To do #4 – Data Classification<\/strong><\/p>\n\n\n\n In the context of information security, data classification is based on its level of confidentiality and the impact on the organisation should that data should be disclosed, altered or destroyed without authorisation. Consider the following questions when classifying your information:<\/p>\n\n\n\n To do #5 – Business Continuity Plan<\/strong><\/p>\n\n\n\n At Compleye, we advise that you perform the BCP before internal audit and management review as this assessment will probably result in the last improvements you need to have in place to be ready for certification. Alternatively, perform the BCP twice: first, when you start implementing your ISMS and second, before your external audit. <\/p>\n\n\n\n To do #6 \u2013 ISRA<\/strong><\/p>\n\n\n\n The Information Security Risk Assessment (ISRA) is the most important risk assessment in the ISMS and must be performed with your ISMS team. You\u2019ll need to perform an ISRA on a yearly basis using the same method every year so that you can compare outcomes and results.\u202f <\/p>\n\n\n\n To do #7 – DRP & PEN Tests<\/strong><\/p>\n\n\n\n Here\u2019s a quick exercise for defining your crisis\/disaster DRP: <\/p>\n\n\n\n Define what you (for your business) consider: <\/p>\n\n\n\n When it comes to pentesting, Breachlock says it best with this great infographic:<\/p>\n\n\n\n To do #8 – GDPR Assessment<\/strong><\/p>\n\n\n\n GDPR risks and opportunities abound. Three of each can be explored in this comprehensive Comforte article: \u201cThree Risks and Opportunities of GDPR\u201d.<\/a><\/p>\n\n\n\n Compleye Online provides a 22-question GDPR Assessment template. <\/p>\n\n\n\n To do #9 – Data Privacy Impact Assessment<\/strong><\/p>\n\n\n\n A DPIA might be needed if you have multiple products: perform a DPIA per product (or service). If you work with different types of projects (eg Proof of Concept) you will also need to perform a new DPIA per project. When performing business with e.g. governmental organisations, it is likely that they will ask you to share a copy of your DPIA.<\/p>\n\n\n\n To do #1 – Security Policies & Procedures<\/strong><\/p>\n\n\n\n Before you can add records, you will need to adopt Policies & Procedures. One of the ISO 27001 mandatory policies is the Security Policy \u2013 describing the intentions and ambition (objectives) you have defined for your ISMS. <\/p>\n\n\n\n To do #2 \u2013 Templates<\/strong><\/p>\n\n\n\n There are numerous mandatory policies and procedures that need to be implemented in your ISMS. Creating this documentation can be time consuming and you might not be sure that you\u2019ve covered all the necessary items. Using templates such as those supplied by an online tool like Compleye Online will provide the guidance that you need to meet the requirements to achieve certification. <\/p>\n\n\n\n To do #3 \u2013 Checklists<\/strong><\/p>\n\n\n\n Your ISMS needs continuous improvement and maintenance. <\/p>\n\n\n\n Creating checklists is a lean way of keeping track of activities and steps when following improvement and maintenance procedures. <\/p>\n\n\n\n To do #1 – Security Metrics<\/strong><\/p>\n\n\n\n Security Metrics are \u2018KPIs\u2019 defined to check if the information security management system is working effectively. <\/p>\n\n\n\n You will need to:<\/p>\n\n\n\n To do #2 – Asset Management<\/strong><\/p>\n\n\n\n Hardware assets that carry information, servers and data are all assets. To manage these you need to keep track of all of your assets and know what assets are being used and whether they are company-owned. You also need to keep track of changes and the movement of assets.<\/p>\n\n\n\n To do #3 \u2013 Controls<\/strong><\/p>\n\n\n\n Annex A consists of 114 controls. You\u2019ll need to adopt, implement and maintain controls. There are 2 ways that you can define and implement controls: <\/p>\n\n\n\n To do #4 – Access Management<\/strong><\/p>\n\n\n\n Access Management in general is an important topic for your ISMS. Not being in control of software access can easily cause incidents turning into data breaches. To do #1 – Security Meetings<\/strong><\/p>\n\n\n\n During Security Meetings with your ISMS team, you can make decisions on all topics related to your ISMS. You will need to assign a security meeting owner, document changes, check controls and evaluate improvements.<\/p>\n\n\n\n To do #2 – Calls to action for follow-ups<\/strong><\/p>\n\n\n\n Security meetings are a mandatory part of the operational ISMS where the team gets to align, perform periodic checks, work collaboratively on tasks, planning, etc. All follow up tasks required from the ISMS team are defined with Calls to Action following the security meeting. <\/p>\n\n\n\n To do #1 – Assign ISMS Roles<\/strong><\/p>\n\n\n\n ISO 27001 requires that you have an ISMS team for set up, implementation and maintenance. You must also have an overview of all team members so security and privacy can be created around people and processes.<\/p>\n\n\n\n To do #2 – Assign Mandatory Security Roles<\/strong><\/p>\n\n\n\n We advise that you start by assigning a minimum of 2 team members responsible for your ISMS.\u202f Always ensure that there is knowledge of technology and business within your ISMS.\u202f <\/p>\n\n\n\n Also assign a Security Officer (SO), Privacy Officer (PO) and Compliance officer (CO).\u202f <\/p>\n\n\n\n To do #3 – Office Security<\/strong><\/p>\n\n\n\n If you have an office, you\u2019re responsible for the physical security of your office and for keeping track of who\u2019ll have access to the office (by key\/card\/code).<\/p>\n\n\n\n To do #4 – New Hires and Contracts<\/strong><\/p>\n\n\n\n If you hire people, ISO 27001 expects that you\u2019re in control of the number of team members, their job titles and who will lead\/mentor each person.\u202f\u202fYou\u2019ll need to be in control of your labour contracts. If you\u2019re in the scaling phase, it\u2019s handy to have expiry dates etc. in one place.\u202f\u202f<\/p>\n\n\n\n To do #5 \u2013 Training<\/strong><\/p>\n\n\n\n You will need to:<\/p>\n\n\n\n To do #6 – HR & Organisation<\/strong><\/p>\n\n\n\n ISO specific HR\/Organisation requirements include:<\/p>\n\n\n\n Chapter 5: Top Management Responsibilities<\/p>\n\n\n\n Chapter 7: Resources- Determine and provide the resources needed for the ISMS implementation, maintenance & continuous improvement.<\/p>\n\n\n\n To do #1 – Internal Audi<\/strong>t<\/p>\n\n\n\n The goal of internal audit is to make sure that your ISMS conforms to your organisation\u2019s own requirements (information security policy, procedures, security objectives, etc.) as well as to the requirements in ISO 27001 and evaluates whether the ISMS is effectively implemented and maintained. Check out our \u2018It\u2019s Internal Audit Time\u2019<\/a> article to learn more. <\/p>\n\n\n\n To do #2 – Management Review<\/strong><\/p>\n\n\n\n A management review is performed on an annual basis and you will need to assign a person who is responsible for the review. The process, although complex, can be distilled into three steps:<\/p>\n\n\n\n To do #3 \u2013 Documentation<\/strong><\/p>\n\n\n\n Next to the mandatory policies, procedures and records, there are 4 Mandatory Documents that need to be available and ready for the external audit certification: <\/p>\n\n\n\n To do #4 – Statement of Applicability<\/strong><\/p>\n\n\n\n The SoA is a summary of your organisation\u2019s implementation status on each of the 114 controls of Annex A of ISO 27001 and must define which controls are identified by your organisation to tackle the risks involved in the business. This can be done by conducting an ISO 27001 gap analysis and risk assessment.<\/p>\n\n\n\n To do #1 – Accredited Lead Auditor<\/strong><\/p>\n\n\n\n Once you\u2019re ready for audit, assign an accredited lead auditor. Lead auditors have been through extensive training, so you\u2019re in good hands.<\/p>\n\n\n\n To do #2 – Plan to Maintain Certification<\/strong><\/p>\n\n\n\n Once an organisation achieves ISO 27001 certification, it\u2019s important to maintain the Information Security Management System (ISMS) on an ongoing basis to ensure it remains effective, relevant, and aligned with the organisation\u2019s objectives. This is where the Compleye ISO 27001 maintenance package<\/a> comes in. <\/p>\n\n\n\n Learn more about how Compleye can help you with your ISO 27001 compliance.<\/p>\n\n\n\n\n
\n
2. Determine legal & compliance requirements<\/h3>\n\n\n\n
![\"internal](\"https:\/\/lh4.googleusercontent.com\/YPv9C8FwwC5JqpLWxsKSQT0U7-WOEl2p4hea2GXO84zc5V4Mgp6gPCsg7xy7b_k9uJNUDR1rpc8XAMw3usopS-6GDUAk9Q-z5PqjJXosOGavacy78Mh4oP2tVPpoBQIZPezQX-b7RvsXNjaBXDC3XQ\")
\n
\n
3. Define scope<\/h3>\n\n\n\n
4. Chart all risks and opportunities<\/h3>\n\n\n\n
\n
\n
\n
\n
![\"\"\/](\"https:\/\/lh3.googleusercontent.com\/cewvVkMl13z5lVWZZQdXUihySyg3SyJz_iGMdZoAHEmycI7yZJjRi1Xd5va3EK-IyrKzLjzNpJA6TooE9UmU4ZZY7HOuMSiluS_-A-FKrcf5HxZ6TJ5zM5K3JkFicEU3gZApqlrZatDhwMY61-mjXQ\")
5. Decide on security policies & procedures<\/h3>\n\n\n\n
6. Set up a system for measures and controls<\/h3>\n\n\n\n
\n
\n
You will need an Access Management Policy and must be in control of different types of access: <\/p>\n\n\n\n\n
7. Implement operational checkpoints and follow-ups<\/h3>\n\n\n\n
8. Take care of roles, responsibilities, leadership and management<\/h3>\n\n\n\n
\n
\n
\n
9. Prepare for the actual ISO 27001 certification<\/h3>\n\n\n\n
\n
\n
10. Organise real-time ISO 27001 certification audit <\/h3>\n\n\n\n
![\"How](\"https:\/\/lh3.googleusercontent.com\/lXsSvTuZ61ii1YRYFaF6i3e3bbQUd3KG_qFrRVy094fzgkOm9qcOeBEh9rrsnLnMGKUnVHzcCZdgUJqvf6JQA9wNscDx5TDsd5Fzavz9CnPtnZtfc9lOE6891lxgQF1Ur8O-vlul7R1UauCPO24t6w\")
You\u2019re ready to start ticking off your Complete Checklist For ISO 27001 Compliance (2023)<\/h2>\n\n\n\n