ISO 27001 and ISO 27002 2022 updates
ISO/IEC 27001:2022 – the newest version of ISO 27001 – was published in October 2022.
Organisations that are certified to ISO/IEC 27001:2013 have a three-year transition period to make the necessary changes to their ISMS (information security management system).
For more information about ISO 27001:2022 and its companion standard, ISO 27002:2022, and what they mean for your organisation, please visit ISO 27001 and ISO 27002: 2022 updates
Download your copy of ISO 27001:2022 here
Download your copy of ISO 27002:2022 here
Implementing ISO 27001 takes time and effort, but it isn’t as expensive or as difficult as you may think. There are different ways of going about implementation with varying costs.
We’ve trained more than 7,000 professionals on ISMS (information security management system) implementations and audits worldwide and helped more than 600 organizations comply with and certify to ISO 27001. Our experience means we know exactly what it takes to make a project succeed.
Our ISO 27001 implementation bundles can help you reduce the time and effort required to implement an ISMS, and eliminate the costs of consultancy work, traveling, and other expenses.
View our ISO 27001 implementation bundles and pricing here >>
Need a quick introduction to the ISO 27001 implementation process?
Download our free green paper Implementing an ISMS – The nine-step approach for an introduction to ISO 27001 and to learn about our nine-step approach to implementing an ISO 27001-compliant ISMS.
Download now
ISO 27001 implementation process
Familiarize yourself with ISO 27001 and ISO 27002
Checklist
Before you can reap the many benefits of ISO 27001, you first need to familiarize yourself with the Standard and its core requirements.
The ISO/IEC 27001:2013, ISO/IEC 27002:2013 and ISO/IEC 27000:2018 standards will serve as your principal points of reference.
Assemble a project team and initiate the project
Checklist
You will first need to appoint a project leader to manage the project (if it will be someone other than yourself).
Second, you will need to embark on an information-gathering exercise to review senior-level objectives and set information security goals.
Third, you should develop a project plan and project risk register.
Solutions
The ISO 27001 Toolkit includes a range of project tools that will help you tackle the ISMS.
The Lead Implementer course teaches you how to implement an ISMS from beginning to end, including how to overcome common pitfalls and challenges.
Conduct a gap analysis
Checklist
A gap analysis provides a high-level overview of what needs to be done to achieve certification and enables you to assess and compare your organization’s existing information security arrangements against the requirements of ISO 27001.
Find out more about the gap anlaysis process >>
Solutions
This toolkit includes an ISO 27001:2013 and ISO 27002:2013 gap analysis tool that will help you assess yourself against the Standard’s requirements.
A specialist, in-person review of your current information security posture against the requirements of ISO/IEC 27001:2013.
This tool has been designed to help prioritize work areas and list all the requirements from ISO 27001:2013 against which you can assess your current state of compliance.
Scope the ISMS
Checklist
Scoping requires you to decide which information assets to ring-fence and protect. Doing this correctly is essential, because a scope that’s too big will escalate the time and cost of the project, and a scope that’s too small will leave your organization vulnerable to risks that weren’t considered.
Solutions
Find out how to scope the ISMS effectively by attending the definitive ISO 27001 Lead Implementer course.
Initiate high-level policy development and other key ISO 27001 documentation
Checklist
You should set out high-level policies for the ISMS that establish roles and responsibilities and define rules for its continual improvement. Additionally, you need to consider how to raise ISMS project awareness through both internal and external communication.
Solutions
The documentation toolkit will save you weeks of work trying to develop all the required policies and procedures.
Undertake a risk assessment
Checklist
Risk assessments are the core of any ISMS and involve five important aspects:
- Establishing a risk management framework
- Identifying potential risks
- Analyzing risks
- Evaluating risks
- Selecting risk treatment options
The risk assessment also helps identify whether your organization’s controls are necessary and cost-effective.
Learn more about ISO 27001 risk assesments >>
Solutions
This green paper will explain and unravel some of the issues surrounding therisk assessment process.
vsRisk Cloud is an online tool for conducting an information security risk assessment aligned with ISO 27001. It is designed to streamline the process and produce accurate, auditable and hassle-free risk assessments year after year.
Select and apply controls
Solutions
The documentation toolkit provides a full set of the required policies and procedures, mapped against the controls of ISO 27001, ready for you to customise and implement.
vsRisk Cloud includes a full set of controls from Annex A of ISO 27001 in addition to controls from other leading frameworks.
Develop risk documentation
Checklist
The risk treatment plan (RTP) and Statement of Applicability (SoA) are key documents required for an ISO 27001 compliance project.
The SoA lists all the controls identified in ISO 27001, details whether each control has been applied and explains why it was included or excluded. The RTP describes the steps to be taken to deal with each risk identified in the risk assessment.
Solutions
vsRisk Cloud can generate two audit-ready reports, the SoA (Statement of Applicability), and a risk treatment plan.
Conduct staff awareness training
Checklist
Human error has been widely demonstrated as the weakest link in cybersecurity. Therefore, all employees should receive regular training to increase their awareness of information security issues and the purpose of the ISMS.
Solutions
E-learning courses are a cost-effective solution for improving general staff awareness about information security and the ISMS.
Assess, review, and conduct an internal audit
Checklist
ISO 27001 requires regular audits and testing to be carried out. This is to ensure that the controls are working as they should be and that the incident response plans are functioning effectively. Additionally, top management should review the performance of the ISMS at least annually.
Solutions
Our Lead Auditor courses give you the skills to successfully undertake or lead an ISMS audit project.
Opt for a certification audit
Checklist
If you opt for certification, the certification body you use should be properly accredited by a recognized national accreditation body and a member of the International Accreditation Forum.
Your chosen certification body will review your management system documentation, check that you have implemented appropriate controls and conduct a site audit to test the procedures in practice.
Solutions
It is vital to ensure that the certification body you use is properly accredited by a recognized national accreditation body. Read our blog above to view a full list of accredited certificaiton bodies.
Achieve ISO 27001 certification with IT Governance
Backed by the team that led the implementation of the world’s first ISO 27001-compliant ISMS, we’ve helped more than 600 clients achieve ISO 27001 certification and compliance and provide a 100% certification guarantee. Start your journey to achieving certification with us today.
Speak to an expert
To find out more on how our cybersecurity products and services can protect your organization, or to receive some guidance and advice, speak to one of our experts.
ISO 27001 implementation bundles
Many organizations fear that implementing ISO 27001 will be costly and time-consuming. Our implementation bundles can help you reduce the time and effort required to implement an ISMS, and eliminate the costs of consultancy work, travelling, and other expenses.
IT Governance offers four different implementation bundles that have been expertly created to meet the unique needs of your organization, and are the most comprehensive mix of ISO 27001 tools and resources currently available.
Find out more
Speak to an expert
One of our qualified ISO 27001 lead implementers is ready to offer you practical advice about the best approach to take for implementing an ISO 27001 project and discuss different options to suit your budget and business needs.