ISO 27001:2022 Introduction
11 likes28,276 views
This document provides an overview and agenda for a presentation on ISO 27001 and information security management systems (ISMS). It introduces key terms like information security, the CIA triad of confidentiality, integrity and availability. It describes the components of an ISMS like policy, procedures, risk assessment and controls. It explains that ISO 27001 specifies requirements for establishing, implementing and maintaining an ISMS. The standard is popular because it can be used by all organizations to improve security, comply with regulations and build trust. Implementing an ISMS also increases awareness, reduces risks and justifies security spending.
ISO 27001:2022 Introduction
- 1. ISO 27001 Introduction by Andrey Prozorov, CISM, CIPP/E, CDPSE, LA 27001 www.patreon.com/AndreyProzorov 1.0, 23.11.2022
- 2. Agenda 2 1. Intro and main terms 2. The ISMS family of standards 3. Why is ISO 27001 so popular? 4. Benefits of implementing the ISMS 5. ISO Survey 2021 (certificates) 6. ISMS Implementation Phases 7. Required activities (desired state) 8. Annex A. Information Security Controls 9. What you need to know about the ISMS 10. ISMS Implementation Plan and the first steps
- 3. Organizations of all types and sizes: a) collect, process, store, and transmit information b) recognize that information, and related processes, systems, networks and people are important assets for achieving organization objectives c) face a range of risks that can affect the functioning of assets d) address their perceived risk exposure by implementing information security controls ISO 27000 3
- 4. 4 Information Security Confidentiality Integrity Availability Information security: preservation of confidentiality, integrity and availability of information In addition, other properties, such as authenticity, accountability, non-repudiation, and reliability can also be involved ISO 27000
- 5. 5 The CIA triad Confidentiality Integrity Availability Confidentiality: property that information is not made available or disclosed to unauthorized individuals, entities, or processes Availability: property of being accessible and usable on demand by an authorized entity Integrity: property of accuracy and completeness ISO 27000
- 6. An Information Security Management System (ISMS) is a systematic approach for establishing, implementing, operating, monitoring, reviewing, maintaining and improving an organization’s information security to achieve business objectives 6 ISO 27000
- 7. Components of an ISMS 7 a) Policy c) Management processes related to: 1. Policy establishment 2. Awareness and competence provision 3. Planning 4. Implementation 5. Operation 6. Performance assessment 7. Management review 8. Improvement b) Persons with defined responsibilities d) Documented information e) Information security risk assessment f) Information security risk treatment, including determination and implementation of controls a-d: common components of any management systems e-f: additional ISMS components
- 8. Risk: effect of uncertainty on objectives Risk is often expressed in terms of a combination of the consequences of an event and the associated “likelihood” of occurrence Information security risk is associated with the potential that threats will exploit vulnerabilities of an information asset or group of information assets and thereby cause harm to an organization 8 ISO 27000
- 9. An ISMS is based on a risk assessment and the organization’s risk acceptance levels designed to effectively treat and manage risks Analysing requirements for the protection of information assets and applying appropriate controls to ensure the protection of these information assets, as required, contributes to the successful implementation of an ISMS 9 ISO 27000
- 10. The benefits of implementing an ISMS primarily result from a reduction in information security risks (i.e. reducing the probability of and/or impact caused by information security incidents)… 10 see other benefits later in this presentation
- 11. ISO 27001 is the commonly used standard for ISMS implementation and certification 11
- 12. The ISMS family of standards (ISO 27k) 12 The ISMS family of standards includes standards that: a) define requirements for an ISMS and for those certifying such systems b) provide direct support, detailed guidance and/or interpretation for the overall process to establish, implement, maintain, and improve an ISMS c) address sector-specific guidelines for ISMS d) address conformity assessment for ISMS 70+ standards
- 13. ISO 27000 Overview and vocabulary 13 ISO/IEC 27000:2018 provides the overview of information security management systems (ISMS). It also provides terms and definitions commonly used in the ISMS family of standards. This document is applicable to all types and sizes of organization (e.g. commercial enterprises, government agencies, not-for-profit organizations). The terms and definitions provided in this document • cover commonly used terms and definitions in the ISMS family of standards; • do not cover all terms and definitions applied within the ISMS family of standards; and • do not limit the ISMS family of standards in defining new terms for use. https://standards.iso.org/ittf/PubliclyAvailableStandards
- 14. This standard specifies the requirements for establishing, implementing, maintaining and continually improving an information security management system (ISMS) within the context of the organization. This document also includes requirements for the assessment and treatment of information security risks tailored to the needs of the organization. The requirements set out in this document are generic and are intended to be applicable to all organizations, regardless of type, size or nature. Excluding any of the requirements specified in Clauses 4 to 10 is not acceptable when an organization claims conformity to this document. 14 ISO 27001 ISMS Requirements
- 15. ISO 27002 Information Security controls 15 This document provides a reference set of generic information security controls including implementation guidance. This document is designed to be used by organizations: a) within the context of an information security management system (ISMS) based on ISO/IEC 27001; b) for implementing information security controls based on internationally recognized best practices; c) for developing organization-specific information security management guidelines.
- 16. ISO 27003 ISMS Guidance 16 This document provides guidance on the requirements for an information security management system (ISMS) as specified in ISO/IEC 27001 and provides recommendations (‘should’), possibilities (‘can’) and permissions (‘may’) in relation to them. It is not the intention of this document to provide general guidance on all aspects of information security.
- 17. ISO 27005 Guidance on managing IS risks 17 This document provides guidance to assist organizations to: • fulfil the requirements of ISO/IEC 27001 concerning actions to address information security risks; • perform information security risk management activities, specifically information security risk assessment and treatment. This document is applicable to all organizations, regardless of type, size or sector.
- 18. ISO 27701 Extention for privacy 18 This document specifies requirements and provides guidance for establishing, implementing, maintaining and continually improving a Privacy Information Management System (PIMS) in the form of an extension to ISO/IEC 27001 and ISO/IEC 27002 for privacy management within the context of the organization. This document specifies PIMS-related requirements and provides guidance for PII controllers and PII processors holding responsibility and accountability for PII processing. This document is applicable to all types and sizes of organizations, including public and private companies, government entities and not-for-profit organizations, which are PII controllers and/or PII processors processing PII within an ISMS.
- 19. Why is ISO 27001 so popular? 1. Applicable to all organizations, regardless of type, size or nature 2. It is short (21 pages) and simple (ISMS + IS controls) 3. It is aligned with other management systems (e.g., QMS, PIMS, SMS, BCMS) 4. It is time-tested (BS 7799-1 was published in 1995) 5. It contains simple but valuable principles (e.g., understanding the needs and expectations of interested parties, leadership and commitment, continual improvement, process approach, risk-based approach) 6. You can find many additional recommendations, guidelines and courses 7. You can certify your ISMS (for some countries / industries this is a mandatory requirement) 8. Many other IS standards and frameworks are inspired by ISO 27001 9. Many IS professionals use this standard, so they speak the same language… 19
- 20. Benefits of implementing the ISMS 1. Improved overall security (including incident response and cyber resilience) 2. Raising awareness and information security culture 3. Reducing business risks 4. Building stakeholder trust (external and internal) 5. Legal, regulatory and contractual compliance (information security and data protection) 6. A common approach to compliance with different information security requirements 7. Increasing the maturity of related processes (e.g., IT, HR, Governance) 8. Increasing the transparency and justification of information security budgets 9. Marketing opportunities 20
- 21. 21 Clients / Partners: How are you doing on information security and data protection? Our company: We have implemented and certified an Information Security Management System (ISMS) in accordance with ISO 27001. See our Information Security Policy and Data Protection Policy. Clients / Partners: Super! J
- 22. ISO Survey 2021 22 The latest results of the Survey shows an estimation of the number of valid certificates as of 31 December 2021. Global 2020: 44486 (+32%) / 84166 Finland 2020: 102 (+76%) / 185 www.iso.org/the-iso-survey.html Total valid certificates Total number of sites ISO 9001:2015 1,077,884 1,447,080 ISO 14001:2015 420,433 610,924 ISO 45001:2018 294,420 369,897 ISO IEC 27001:2013 58,687 99,755 ISO 22000:2005&2018 36,124 42,937 ISO 13485:2016 27,229 38,503 ISO 50001:2011&2018 21,907 54,778 ISO 20000-1:2011&2018 11,769 13,998 ISO 37001:2016 2,896 7,982 ISO 22301:2012&2019 2,559 5,969 ISO 39001:2012 1,285 2,357 ISO 28000:2007 584 1,106 ISO 55001:2014 488 1,993 ISO 20121:2012 253 712 ISO 29001:2020 157 795 ISO 44001:2017 136 186
- 23. 23 TOP 15 Countries Certificates Sites China 18446 18569 Japan 6587 17784 United Kingdom of Great Britain and Northern Ireland 5256 8647 India 2775 6024 Italy 1924 3474 United States of America 1742 4504 Germany 1673 3486 Netherlands 1508 2421 Taiwan, Province of China 1129 3147 Israel 1056 1083 Romania 951 1211 Spain 949 1444 Poland 876 2210 Australia 775 2311 Turkey 706 1169
- 24. 24
- 25. ISMS Implementation Phases 1. Understanding the organization’s needs and the necessity for establishing information security policy and information security objectives 2. Assessing the organization’s risks related to information security 3. Implementing and operating information security processes, controls and other measures to treat risks 4. Monitoring and reviewing the performance and effectiveness of the ISMS 5. Practising continual improvement 25 ISO 27003 Context Risks Controls Monitoring Improvement
- 26. 26 Required activity: presents key activities required in the corresponding subclause of ISO 27001 ISO 27003
- 27. Required activities: 4. Context of the organization 27 4.1 Understanding the organization and its context The organization determines external and internal issues relevant to its purpose and affecting its ability to achieve the intended outcome(s) of the information security management system (ISMS). 4.2 Understanding the needs and expectations of interested parties The organization determines interested parties relevant to the ISMS and their requirements relevant to information security. 4.3 Determining the scope of the information security management system The organization determines the boundaries and applicability of the ISMS to establish its scope. 4.4 Information security management system The organization establishes, implements, maintains and continually improves the ISMS.
- 28. Required activities: 5. Leadership 5.1 Leadership and commitment Top management demonstrates leadership and commitment with respect to the ISMS. 5.2 Policy Top management establishes an information security policy. 5.3 Organizational roles, responsibilities and authorities Top management ensures that responsibilities and authorities for roles relevant to information security are assigned and communicated throughout the organization. 28
- 29. Required activities: 6. Planning 6.1 Actions to address risks and opportunities When planning for the ISMS, the organization determines the risks and opportunities considering issues referred to in 4.1 and requirements referred to in 4.2. The organization defines and applies an information security risk assessment process. The organization defines and applies an information security risk treatment process. 6.2 Information security objectives and planning to achieve them The organization establishes information security objectives and plans to achieve them at relevant functions and levels. 6.3 Planning of changes The organization determines the need for changes to the information security management system, the changes shall be carried out in a planned manner. 29
- 30. Required activities: 7. Support 7.1 Resources The organization determines and provides the resources for establishing, implementing, maintaining and continually improving the ISMS. 7.2 Competence The organization determines the competence of persons needed for information security performance, and ensures that the persons are competent. 7.3 Awareness The persons doing work under the organization’s control are made aware of the information security policy, their contribution to the effectiveness of the ISMS, benefits of improved information security performance and implications of not conforming to the requirements of the ISMS. 7.4 Communication The organization determines the needs for internal and external communications related to the ISMS. 7.5 Documented information The organization includes documented information in the ISMS as directly required by ISO/IEC 27001, as well as determined by the organization as being necessary for the effectiveness of the ISMS. When creating and updating documented information, the organization ensures its appropriate identification and description, format and media, and review and approval. The organization manages documented information throughout its lifecycle and makes it available where and when needed. 30
- 31. Required activities: 8. Operation 8.1 Operational planning and control The organization plans, implements and controls the processes to meet its information security requirements and to achieve its information security objectives. The organization keeps documented information as necessary to have confidence that processes are carried out as planned. The organization controls planned changes and reviews the consequences of unintended changes, and ensures that outsourced processes are identified, defined and controlled. 8.2 Information security risk assessment The organization performs information security risk assessments and retains documented information on their results. 8.3 Information security risk treatment The organization implements the information security risk treatment plan and retains documented information on the results of the information security treatment. 31
- 32. Required activities: 9. Performance evaluation 9.1 Monitoring, measurement, analysis and evaluation The organization evaluates the information security performance and the effectiveness of the ISMS. 9.2 Internal audit The organization conducts internal audits to provide information on conformity of the ISMS to the requirements. 9.3 Management review Top management reviews the ISMS at planned intervals. 32
- 33. Required activities: 10. Improvement 10.1 Continual improvement The organization continually improves the suitability, adequacy and effectiveness of the ISMS. 10.2 Nonconformity and corrective action The organization reacts to nonconformities, evaluates them and takes corrections as well as corrective actions if needed. 33
- 34. Annex A. Information Security Controls 34 Control: measure that maintains and/or modifies risk Total number of controls – 93, 11 new (2022) Controls are categorized as: a) People, if they concern individual people b) Physical, if they concern physical objects c) Technological, if they concern technology d) otherwise they are categorized as Organizational Five attributes only in ISO 27002:2022 (#): 1. Control type (Preventive, Detective, Corrective) 2. Information security properties (CIA) 3. Cybersecurity concepts (Identify, Protect, Detect, Respond and Recover) 4. Operational capabilities 5. Security domains
- 35. 35 93 controls
- 36. What you need to know about the ISMS 1. The requirements set in ISO 27001 are generic, flexible and useful to all types of organizations 2. The ISMS focuses on interested parties, their needs and expectations 3. The ISMS uses a risk-based approach 4. The ISMS is about processes and continual improvement 5. Processes are more important than policies and other documents! Start collecting records (evidence) right now! 6. Don't focus on certification in the beginning, implement the processes first. It usually takes 1-2 years, see the next slide 7. Implementing an ISMS is a long and complicated project 36
- 38. 38 The first steps • Share and discuss this presentation with the top management, IT and IS teams • Download ISO 27000, purchase ISO 27001 and ISO 27002 • Take courses (Udemy, LinkedIn Learning, BSI, PECB), study additional materials and articles • Establish an IS committee • Conduct a Gap analysis
- 40. My ISMS Implemantation Plan + templates 40 www.patreon.com/posts/isms-plan-iso-74660190