ISO/IEC 27002 5a. Prepare Statement of Applicability 0. Start here 1. Get management support 2. Define ISMS scope 3.

Inventory information assets 4. Conduct information security risk assessment

SOA

5b. Prepare Risk Treatment Plan

RTP

Business case

ISMS scope 6. Develop ISMS implementation program

Inventory

9. ISMS operational artifacts

Project plan N-1 One project within the program Project plan Project plan

Policies Report Security logs etc. Standards Procedures Guidelines Report Compliance & audit reports etc.

8. Information Security Management System

PDCA cycle (one of many)
10. Compliance review 11. Corrective actions

7. ISMS implementation program

Report Awareness & Report training attendance & test reports etc.

Key 12. Precertification assessment

Activity

Database

Version 3 January 2009 Copyright 2009 ISO27k Implementers Forum www.ISO27001security.com

ISO/IEC 27001

13. Certification audit

ISO/IEC 27001 certificate

Document or output 14. Party on!

ISO/IEC standard

Version 3 January 2009 Copyright 2009 ISO27k Implementers Forum www.ISO27001security.com

ISO/IEC 27002 ISMS policy

Risk Assessment Method/s

Risk Assessment Report/s 5a. Prepare Statement of Applicability SOA

0. Start here

1. Get management support

2. Define ISMS scope

3. Inventory information assets

4a. Define risk assessment method/s

4b. Conduct information security risk assessments

Business case

Records of Management Decisions

Document Control Procedure

5b. Prepare Risk Treatment Plan

RTP

ISMS scope 6. Develop ISMS implementation program

Inventory

IS Procedures

Records of ISMS Management Review

Plan project

Project plan Project plan Internal ISMS Audit proc Preventive Action Procedure Information Security Metrics ISMS Operating Procedures Controls Documentation

9. ISMS operational artifacts IS Policies Report Security logs etc. Standards Procedures Guidelines

8. Information Security Management System

PDCA cycle (one of many)
10. Compliance review 11. Corrective actions

Plan project Develop Internal ISMS Audit Plan

7. ISMS implementation program Corrective Action Procedure

Records Control Procedure

Report Compliance & audit reports etc.

Report Awareness & Report training attendance & test reports etc.

12. Precertification assessment Mandatory document

Key

PLAN

DO

ISO/IEC 27001

13. Certification audit

ISO/IEC 27001 certificate

14. Party on!

ISO/IEC standard

ACT

CHECK