7.

ISMS implementation
program
3. Inventory
information
assets
0. Start
here
2. Define
ISMS scope
6. Develop
ISMS
implementation
program
5b. Prepare
Risk
Treatment
Plan
4. Conduct
information
security risk
assessment
1. Get
management
support
N
N-1
One project
within the
program
Inventory
RTP
ISMS scope Business case
8. Information
Security
Management
System
Project plan
Project plan
Project plan
10.
Compliance
review
5a. Prepare
Statement of
Applicability
SOA
11. Corrective
actions
PDCA cycle
(one of many)
ISO/IEC 27002
12. Pre-
certification
assessment
13.
Certification
audit
ISO/IEC 27001
certificate
ISO/IEC 27001
9. ISMS operational
artifacts
Document
or output
Database Activity
Key
ISO/IEC
standard
Version 3 J anuary 2009
Copyright 2009
ISO27k Implementers Forum
www.ISO27001security.com
Report
Report
Awareness &
training
attendance &
test reports etc.
Report
Security logs
etc.
Report
Compliance &
audit reports
etc.
14. Party
on!
Policies
Standards
Procedures
Guidelines
PDCA cycle
(one of many)
7. ISMS
implementation
program
3. Inventory
information
assets
0. Start
here
2. Define
ISMS scope
6. Develop
ISMS
implementation
program
5b. Prepare
Risk
Treatment
Plan
4b. Conduct
information
security risk
assessments
Plan project
Plan project
Develop
Internal ISMS
Audit Plan
RTP
ISMS scope Business case
8. Information
Security
Management
System
Project plan
Project plan
Internal ISMS
Audit proc
10.
Compliance
review
5a. Prepare
Statement of
Applicability
SOA
11. Corrective
actions
ISO/IEC 27002
12. Pre-
certification
assessment
13.
Certification
audit
ISO/IEC 27001
certificate
ISO/IEC 27001
9. ISMS operational
artifacts
Report
Report
Awareness &
training
attendance &
test reports etc.
Report
Compliance &
audit reports
etc.
14. Party
on!
IS
Policies
Standards
Procedures
Guidelines
PLAN DO
CHECK
ACT
Records of
Management
Decisions
Mandatory
document
4a. Define risk
assessment
method/s
Risk
Assessment
Method/s
Risk
Assessment
Report/s
1. Get
management
support
Document
Control
Procedure
Preventive
Action
Procedure
Information
Security Metrics
Records of
ISMS
Management
Review
ISMS Operating
Procedures
IS Procedures
ISMS policy
Corrective
Action
Procedure
Version 3 J anuary 2009
Copyright 2009
ISO27k Implementers Forum
www.ISO27001security.com
Inventory
Report
Security logs
etc.
ISO/IEC
standard
Key
Controls
Documentation
Records Control
Procedure