Laws,

regulations,
contracts
ISO/IEC 27002 ISO/IEC 27005

5a. Prepare 
Statement of  SOA
Applicability
1. Get  3. Inventory   4. Assess 
2. Define 
0. Start management  information  information 
ISMS scope 5b. Prepare 
support assets risks
Risk 
Treatment 
RTP
Plan

Business case Scope
6. Develop ISMS 
implementation  ISO/IEC 27003
Inventory program
ISO 22301
10. ISMS 
9. ISMS operational  internal 
artifacts audits

N Project plan
Report Report
Report Audit  8. Information  N‐1
Project plan
BCP
reports Security  One project 
Project plan
within the 
Management  program

Report
System
7. ISMS implementation 
Logs Policies program
Mgmt review  Standards
reports  Procedures
Guidelines

11.  Key
Report Report 12. Corrective 
Report Compliance 
actions
Metrics Incidents review
International 
Activity standard

13. Pre‐ 17. Annual 
certification  surveillance 
assessment audits Document or 
ISO/IEC 27004 Set or group record

Copyright © 2016 14.  ISO/IEC 27001  16. Operate 

ISO27k Forum  Version 4 ISO/IEC 27001 15. Party
Certification  certificate the ISMS 
on!
www.ISO27001security.com  audit routinely