Information Security Management System

Before proceeding with developing processes or procedures we need to understand the business in regards to how the business is run and what factors can hinder or contribute to the running of the business, in other words what does the business do? In determining the context we will identify internal and external issues, interested parties and the scope of the Information Security Management System.

The leadership clause requires the company’s top management to actively lead the Information Security Management System and be able to demonstrate this through policies and responsibilities. Leadership has an emphasis on customer focus with specific applications ranging from support for customer regulatory requirements, risks and enhancing customer satisfaction. The top management’s responsibilities include establishing and communicating an Information Security policy, the importance of the Information Security and assigning responsibilities to ensure the ongoing effectiveness of the Information Security Management System.

Addresses the process of determining the activities required to achieve a desired goal. Planning also involves thinking about the risks that may occur in future and addressing these through adequate control measures. Clause 6 of ISO 27001 deals with this critical activity and requires an organisation to take a risk-based approach and plan for the uncertainties pro-actively to prevent undesired effects. Another aspect of planning is to identify objectives which can be used to monitor and track our progress. Additionally, this clause requires an organisation to plan for changes and follow a structured approach for any changes required in the management system.

Requires the organisation to determine and provide the resources needed for the establishment, implementation, maintenance, and continual improvement of the Information Security Management System. In doing so the organisation should consider the capabilities of, and constraints on, existing internal resources and what needs to be obtained from external providers. This will include people, infrastructure, the working environment, monitoring and measuring resources, organisational knowledge, competence & awareness, communication, documented information.

Requires the organisation to plan, implement and control the processes needed to meet the requirements for the provision of products and services and to meet the requirements of the Information Security Management System. These include aspects of design, control of externally provided processes, production and service provision, release of products and services and control of nonconforming outputs.

Requires an organisation assess its own performance in meeting customer and regularity requirements as well as its performance in meeting the requirements of its own Information Security Management System and the ISO 27001 standard. These will include activities such as, establishing what needs to be monitored and measured, customer satisfaction, analysis and evaluation of data, completing internal audits and top management carrying out a formal review on the performance of the Information Security Management System.

Requires an organisation to determine and select opportunities for improvement and implement any necessary actions to meet customer requirements to enhance customer satisfaction. These activities may also include improving products and services to meet requirements and address future needs and expectations, correcting, preventing, or reducing undesired effects, improving the performance and effectiveness of the health and safety management system and investigating and correcting non-conformance.