In the digital age, information is a critical asset for any company. Protecting this data is crucial, and implementing an ISMS and getting it certified  (e.g. ISO27001) is a clear sign of an organization’s strong dedication to information security management. By using international standard like ISO27001 you will build a strong framework that protects company data and brings together people, processes, and technology, offering a full strategy for data security and risk management. This article outlines the first steps to get started to set up an ISMS with examples to help you gather the required information

Crafting the Foundational Documents

1. Understanding the Organization’s Context and Defining Objectives with Precision

The journey begins with a detailed business description, which paints a clear picture of what the organization does and the types of data it manages. The mission and vision statements are essential, as they link information security strategy to the company's broader ambitions. This foundation is further solidified by a strategic overview, which illustrates the critical role of information security in achieving organizational goals such as :

• Trust and Confidence: Bolstering client and stakeholder trust in the organization's information security measures.
• Competitive Edge: Distinguishing the organization in a saturated market, often swaying client and partner decisions.
• Enhanced Efficiency: Streamlining information security processes, curtailing incidents, and minimizing related expenditures.
• Global Acknowledgement: Recognizing the organization's commitment to internationally acclaimed information security standards.

You can ask questions like :

• Describe the vision for growth, market positioning, and technological advancements?
• What are your key motivators for the implementation of an ISMS
  
• What are the strategic objectives for the next 3-5 years, and how do they align with your information security initiatives?

Deliverable:

• Business context document with information security strategy and objectives

2. Engaging Leadership and Ensuring Implementation Readiness

Securing a signed leadership commitment document is essential, showcasing the top management's resolve to adopt and uphold an ISMS. This endorsement is fundamental, marking information security as a core organizational focus and commitment to action and resource dedication.

Consider asking:

• Has the organization faced any significant information security challenges or incidents in the past?
• How were they addressed, and what role did leadership play in their resolution?
• What specific resources (financial, human, technical) will leadership provide to demonstrate their commitment to the ISMS's success?

Deliverable:

• Signed document by top management on the leadership commitment to resource allocation for the implementation and maintenance of the ISMS

3. Defining the ISMS Scope with Clarity and Precision

Defining your ISMS's scope meticulously is crucial. This definition encompasses:

• Information and Assets: Enumerating the assets and information under the ISMS's protection.
• Processes Covered: Identifying processes that interact with these assets, highlighting data processing, storage, and transmission.
• Physical and Digital Boundaries: Highlighting the ISMS's operational boundaries within the organization.

To obtain a comprehensive overview of the business, consider asking:

• Can you provide a detailed overview of each organizational unit within the company?
• What are the primary functions and responsibilities of each unit in relation to the company's overall operations?
• Can you list the core business processes and services your organization provides?
• How do these processes and services interact with information systems and data?
• Can you provide a comprehensive map or description of the current IT and network infrastructure?
• How is sensitive data identified, stored, transmitted, and protected within this infrastructure?
• Are there any of the standard's clauses that can be excluded? (eg in case of no internal development, no physical delivery locations, ...)

Deliverable:

• A document that clearly document the scope of the ISMS
• Exclusions of clauses with justification

4. Identifying Roles and Responsibilities within the ISMS Framework

A critical aspect of establishing an effective Information Security Management System (ISMS) is the clear identification and documentation of roles and responsibilities related to information security. This clarity ensures that all personnel are aware of their specific obligations towards maintaining the organization's security posture, fostering a culture of accountability and continuous improvement. Here’s a structured approach to defining these roles and responsibilities within an ISMS. It is essential that contracts and job descriptions explicitly articulate these responsibilities to align individual objectives with the overall goals of the ISMS.

Key Roles and Responsibilities

1. Chief Information Security Officer (CISO) or ISMS Manager:
   • Overview: Serves as the leader and primary point of accountability for the ISMS, overseeing its development, implementation, and continuous improvement.
   • Responsibilities: Developing the ISMS strategy, policy formulation, risk management, ensuring compliance with legal and regulatory requirements, and reporting to executive management.
2. IT and Network Security Managers:
   • Overview: Responsible for the technical aspects of the ISMS, focusing on the integrity, confidentiality, and availability of information assets.
   • Responsibilities: Implementing security measures, managing security incidents, overseeing operational security practices, and ensuring the security of network and IT infrastructure.
3. Data Protection Officer (DPO) or Privacy Manager (where applicable):
   • Overview: Focuses on compliance with data protection laws and regulations, particularly relevant in organizations handling personal data.
   • Responsibilities: Ensuring compliance with data protection regulations, advising on data privacy issues, and serving as a point of contact for supervisory authorities.
4. Human Resources Manager:
   • Overview: Plays a crucial role in embedding information security into the organization's culture and personnel management practices.
   • Responsibilities: Incorporating information security awareness into employee onboarding and training programs, managing confidentiality agreements, and ensuring that roles and responsibilities related to ISMS are reflected in job contracts.
5. Department Heads and Managers:
   • Overview: Responsible for implementing and maintaining the ISMS within their respective areas of the organization.
   • Responsibilities: Ensuring their teams understand and comply with information security policies and procedures, identifying and managing risks, and reporting security incidents.
6. All Employees:
   • Overview: Each employee has a role to play in maintaining the organization's information security.
   • Responsibilities: Adhering to information security policies and procedures, reporting security incidents, and participating in security awareness and training programs.

Deliverables:

• One document with all roles and responsibilities related to ISMS that have been identified
• Update or addendum to the employee's contracts to ensure commitment to this role
• Evidences on the competences and qualifications of the different roles (CVs, Diploma's, Certificates, ...)

5. Defining Stakeholders and Their Requirements for the ISMS

Identifying and understanding the stakeholders and their specific requirements for the Information Security Management System (ISMS) is critical. This not only ensures compliance with relevant legislations and standards but also aligns with the expectations and needs of those who have a vested interest in the organization's information security framework. Here’s how stakeholders and their requirements can be systematically addressed:

• Understanding Stakeholder Expectations:
  • Engage with stakeholders to identify their specific requirements for confidentiality, integrity, and availability (CIA) of information within the scope of the ISMS. This includes understanding the expectations from various internal and external parties, such as customers, regulatory bodies, partners, and employees.
• Compliance and Accreditation Requirements:
  • Identify any specific legislations, regulations, or standards that mandate certain information security practices or accreditation. For example, the Medical Device Regulation (MDR) for healthcare products, or the Digital Operational Resilience Act (DORA) and Digital Services Act (DSA) for digital services, can dictate the scope and requirements of the ISMS. Knowing these requirements early on will guide the development of the ISMS to ensure compliance.
• Stakeholder Groups and Their ISMS/CIA Requirements:
  • Executive Management (CEO/Managing Director, CIO/CTO): Understand the strategic direction of the organization and how information security aligns with broader business goals. Ensure their requirements for information security governance and resource commitment are clearly defined and integrated into the ISMS.
    
  • Information Security Team (CISO/IT Manager): Collaborate to define the technical and operational aspects of the ISMS, ensuring that policies and objectives meet the practical aspects of information security management and compliance requirements.
    
  • Legal and Compliance Officers: Work together to incorporate legal, regulatory, and contractual requirements into the ISMS, ensuring that all information security practices are in full compliance with current laws and standards.
    
  • Human Resources Management: Engage to understand the requirements for employee involvement in the ISMS, including training, awareness, and adherence to information security policies.
    
  • Facilities Management and Business Unit Leaders: Determine the physical security and process-related requirements that support the ISMS, ensuring that all aspects of the organization's operations are covered by the ISMS scope.
    
• Customer and Partner Requirements:
  • Engage with customers and partners to understand their expectations and requirements for information security. This may include specific ISMS certifications like ISO 27001, which can influence trust and contractual relationships.
• Other Examples Of Stakeholder
• • Government, Emergency Services, Employees, Competitors, Legislators & regulators, Data subjects (People behind the data, e.g. patients), End users (Users of our products/services), Sales prospects (potentials users of our services), Research partners, Development teams (Digital, firmware, hardware), Marketing (influences, external platform), Retailer (sales of our products), Shareholders, External auditors/accreditors, Distributors, GDPR Supervisory authority, Board of directors, Product quality & compliance (product quality), Insurers, Infrastructure critical suppliers, Strategic business suppliers
    

For more guidance on this section, consider taking inspiration from the following examples:

• (CEO,CIO/CTO) What are your strategic objectives for information security within our organization?
• (CISO, IT Manager) What technical and operational challenges do you anticipate in implementing the ISMS?
• (HR) What role do you see HR playing in the implementation and maintenance of the ISMS?
• (Customers and Partners) Are there any contractual information security requirements we need to be aware of in our relationship?
• (Customers and Partners) What are your main concerns regarding information security when partnering with our organization?
• What is the power (how can they force certain things, such as regulators or auditors) and interest (how important is this for their own success, such as customers or investors) of these stakeholders. This allows you to prioritise stakeholders on X/Y matrix

Deliverable:

• One document listing all stakeholders and their ISMS expectations (e.g. legal, regulatory, confidentiality, integrity, availability, ...)
• Stakeholder prioritisation map based on power/interest

6. Navigating Internal and External Challenges

A nuanced analysis, subsequent to scope definition, carefully addresses both internal and external challenges that could influence the ISMS. This entails:

• Internal Issues: Assess the technological, legal, financial, operational, and human resource dimensions within your organization to identify their potential impacts on information security. This assessment should aim to uncover both risks that need mitigation and opportunities that could enhance security measures.
• External Issues: Evaluating external forces using for example the PESTLE methodology to assess those who could impact the ISMS. This includes:
  • Political: Government policies and international relations that could influence data protection laws.
  • Economic: Market conditions, economic trends, and financial factors affecting information security.
  • Socio-cultural: Social trends and cultural aspects that might impact employee behavior or customer expectations regarding privacy.
  • Technological: Advancements and innovations that could pose new threats or offer new security solutions.
  • Legal: Regulations and legal changes at both national and international levels affecting data protection.
  • Environmental: Consideration of how environmental factors or disasters could impact information security infrastructure.

Deliverable:

• A document detailing the internal and external challenges currently know to the company related to information security, acting as a basis for further development of the ISMS and detailed risk assessment in a second stage.

7. Security Policy

The combination of all previous document allows you to define a General Information Security Policy on what you expect from the ISMS.

• Policy Overview:
  • Goal: The primary goal of the information security policy is to safeguard the organization's information assets against unauthorized access while ensuring the confidentiality, integrity, and availability of information for business processes.
  • Leadership Approval: The CEO or equivalent leadership figure must officially approve the information security policy, underscoring the organization's top-level commitment to information security.
  • Key Provisions: The policy should explicitly state that:
    • Information will be protected against unauthorized access.
    • The confidentiality and integrity of information will be maintained.
    • Availability of information for business processes will not be compromised.
    • All legislative and regulatory requirements will be met.
    • Business continuity plans will be meticulously developed, maintained, and tested.
    • Information security awareness and training will be provided to all employees.
    • Any actual or suspected information security breaches must be reported to the Chief Information Security Officer (CISO) for investigation.
• Supporting Elements:
  • Detailed Policies and Procedures: An Information Security Management System (ISMS) with detailed policies and procedures supports the overarching policy, aligning with ISO/IEC 27001:2017 standards.
  • Objectives and Risk Management: The ISMS objectives and risk assessments are clearly defined and measured to meet ISO/IEC 27001:2017 requirements.
  • Alignment with Business Goals: Information security requirements will continuously align with the organization's business goals, taking into account internal and external issues as well as the needs of interested parties.
  • Roles and Responsibilities: The policy delineates specific responsibilities for maintaining and implementing the policy, including:
    • The CISO's role in policy maintenance and implementation support.
    • The ISMS Board's oversight of the risk treatment plan and risk management activities.
    • Managers' responsibilities for policy implementation and ensuring staff compliance within their departments.
  • Compliance: Adherence to the Information Security Policy is mandatory for all staff, reinforcing the importance of information security in the organizational culture.
• Commitment to Certification: The organization commits to achieving and maintaining ISO 27001:2017 certification, among other relevant accreditations, with regular policy reviews to adapt to business changes, risk assessments, or treatment plans.

This policy not only serves as a foundation for achieving ISO 27001 certification but also significantly enhances the organization's security posture and resilience against information security threats.

Deliverable:

• Information security policy singed by CEO (which can be published internally and put in the offices for all to see)

8. Conclusion and Forward-Look

Achieving ISO 27001 certification marks an organization's allegiance to securing its invaluable digital assets in an increasingly digital-centric world. Through meticulous planning and execution, organizations not only elevate their security posture but also gain operational excellence and a competitive stance.

Looking Ahead

Our next blog article will delve into Primary and Support Assets Identification, a critical phase in ISO 27001 preparation. This segment will explore the identification and cataloging of essential assets and their dependencies, laying the groundwork for a robust and effective ISMS tailored to the organization's unique needs and challenges, ensuring a strategic path to certification.

Start for free now! 

Streamline your GRC work using our all-in-one management solution and get access to our network of local specialists

Start your free account