Summary: ISO 27001 isn't a security benchmark.<br> <br> Show Notes: https://justinfimlaid.com/do-you-iso-27001/<br> <br> Sponsor: https://www.nuharborsecurity.com and https://iso27001certifications.com<br> <br> Contact Me: https://justinfimlaid.com/contact-me/<br> <br> Twitter: @justinfimlaid<br> <br> LinkedIn: https://www.linkedin.com/in/jfimlaid/<br> ISO 27001 Background<br> ISO 27001 is increasing in popularity mostly stemming from the exposure created by assessing the security posture of vendors and vendors trying to prove they are good data custodians. The problem, at least in the US, is most people confuse ISO 27001 as a compliance standard when in fact it's a mechanism to build your security program.<br> <br> I met with a my buddy Todd last week whom is a security analyst at mid-size manufacturing company. While none of their information is considered “regulated” or “industry sensitive”, it would still suck if they lost it. So his organization choose ISO 27001 as their security framework. We chatted about why he's struggling with ISO 27001 adoption within their organization. Here's his deal - he was trying to use the ISO 27001 Annex A controls and trying to implement all the ISO 27002 controls and was getting frustrated with the process.<br> <br> Here’s the deal ISO 27001 is not intended to be a compliance framework like PCI or HIPAA, rather it’s an information security management system - hence why ISO 27001 is commonly referred to as an ISMS. In the simplistic terms ISO 27001 is a management framework that guides you through designing a custom built security program with custom security controls right sized for your organization.<br> <br> So here’s how ISO 27001 breaks down, ISO 27001 has 10 clauses, plus an Annex -- Annex A. Annex A holds the core ISO 27001 security controls. The 10 clauses include the body of ISO 27001 mechanics, mostly how to construct the ISMS.<br> ISO/IEC 27001:2013 has ten short clauses, plus a long annex, which cover:<br> <br> 1. Scope of the standard<br> 2. How the document is referenced<br> 3. Reuse of the terms and definitions in ISO/IEC 27000<br> 4. Organizational context and stakeholders<br> 5. Information security leadership and high-level support for policy<br> 6. Planning an information security management system; risk assessment; risk treatment<br> 7. Supporting an information security management system<br> 8. Making an information security management system operational<br> 9. Reviewing the system's performance<br> 10. Corrective action<br> Annex A: List of controls and their objectives<br> <br> Within those 10 Clauses - there is mandatory things that need to be completed:<br> From Advisera, Dejan Kosutic seems to do a nice job with ISO 27001. Here are the documents you need to produce if you want to be compliant with ISO 27001. Annex A documents are only required if there's a risk that requires their implementation.<br> <br> Scope of the ISMS (clause 4.3)<br> Information security policy and objectives (clauses 5.2 and 6.2)<br> Risk assessment and risk treatment methodology (clause 6.1.2)<br> Statement of Applicability (clause 6.1.3 d)<br> Risk treatment plan (clauses 6.1.3 e and 6.2)<br> Risk assessment report (clause 8.2)<br> Definition of security roles and responsibilities (clauses A.7.1.2 and A.13.2.4)<br> Inventory of assets (clause A.8.1.1)<br> Acceptable use of assets (clause A.8.1.3)<br> Access control policy (clause A.9.1.1)<br> Operating procedures for IT management (clause A.12.1.1)<br> Secure system engineering principles (clause A.14.2.5)<br> Supplier security policy (clause A.15.1.1)<br> Incident management procedure (clause A.16.1.5)<br> Business continuity procedures (clause A.17.1.2)<br> Statutory, regulatory, and contractual requirements (clause A.18.1.
