Version 2.

ROADMAP ISO 27001

Integrity 5-step approach to 27001

CERTIFICATION
PERFORMANCE AND MONITORING
IMPLEMENTATION
DIAGNOSIS
PREPARATION

1 month + 3 years
3 to 6 months
1 to 4 months
1 to 3 months
1 to 2 months

5. CERTIFICATION
3. ISMS 4. ISMS AND MONITORING
IMPLEMENTATION AND PERFORMANCE
DOCUMENTATION
1. ISMS 2. DIAGNOSIS Third-party audits
PREPARATION To perform the to show the maturity
To create the processes and of the ISMS and
To identify, within the mandatory procedures the reduction of risk
Establishing the defined scope, the documentation defined, highlighting according to the
appropriate maturity of processes, and to start the risk the fulfilment of defined objectives.
framework for applicable controls, treatment having objectives, to ISMS monitoring
the business needs risks and mitigation the applicable identify both in the form of
and providing the control. To understand control systems opportunities for implementation
organizations with the business and to into account. improvement and and management
the required skills. determine the gap non-conformities services (planning,
between the standard and to guarantee performance
requirements and that the ISMS evaluation and
the organisation may be reviewed continuous
practice so as to by the lead improvement).
allocate resources management.
for an efficient ISMS
implementation.
 TRAINING IN
INFORMATION
SPECIFIC TRAINING SECURITY
SETTING IN ISO 27001
1. ISMS THE SCOPE
PREPARATION
To provide the project
To provide the project team with updated
To characterize team and all the
(1 to 2 months) knowledge in
the functional units, interested parties with information security
business processes, knowledge in ISMS. aligned with the
geography and assets
present moment.
to be protected.

RISK
TREATMENT
DOCUMENTING THE RISK PLANNING
METHODOLOGY OF EVALUATION
PRESENTATION RISK MANAGEMENT
SPECIFIC OF RESULTS
DIAGNOSIS The design of a risk
2. DIAGNOSIS The start of the treatment plan
To create a document continued
Present to top according to the
containing the implementation
To understand the management and methodology of
(1 to 3 months) description of the of the risk
business and to all interested parties risk management
analysis methodology analysis activities
determine the gap with the outcomes set and adopted.
and risk treatment, anticipated in the
between the standard of the analysis identifying the risk management
requirements and performed. responsibilities, the methodology.
the organization
menace sources and
practice so as to
vulnerabilities, the
allocate resources
existing control systems
for an effective
and their efficiency, as
and efficient
well as the criteria for
implementation.
risk acceptance.

DECLARATION DOCUMENTATION
DOCUMENTING OF APPLICABILITY APPROVAL
DEFINING THE THE ISMS (SOA)
3. ISMS INFORMATION PROCESSES
IMPLEMENTATION AND SECURITY POLICY
DOCUMENTATION Approval, by the
Creation of a lead management,
To create documents registry containing
To document the aims of the ISMS scope,
with the description the information on the
(1 to 4 months) of the information the security policy,
of processes applicable control
security of the risk analysis, the risk
and the respective systems, eventual
organization, as well treatment plan
responsibilities, exclusions and
as the commitment and the SOA.
identifying the the respective
of the lead adequate registry justifications.
management with and evidence.
risk reduction and
the implications of
the non-compliance
of the defined policy.

INTERNAL
ISMS AUDIT
ISMS REVIEW
PROCESS MONITORING
TRAINING AND MANAGEMENT
4. ISMS AWARENESS-RAISING Implementation
Formal revision of of a formal action
PERFORMANCE Monitoring and ISMS input and output of internal audits,
Continuous evaluation of ISMS
Planning and to be done by the analysing registries
implementation metrics and aims.
(3 to 6 months) implementation lead management and evidence of
of the tasks of the
of training and in accordance with implementation
several processes
awareness-raising the standard. of the processes
which had been
sessions for the previously defined defined.
whole organization and documented.
in the ISMS scope.

Evaluation of ISMS
performance

Training and
Awareness-raising
sessions
PRE-AUDIT MONITORING AUDIT Internal
5. CERTIFICATION (1 month) CONCESSION AUDIT (2nd and 3rd years) Auditing
AND MONITORING (1st year) CONTINUOUS
IMPLEMENTATION Risk
Audit implementation treatment
(1 month + 3 years) in the same patterns
as those of the Operational
concession audit processes and
procedures
so as to prepare the Reviews led
project team for the by the Lead
Led by the certifying entity. Management
effective certification
and optimize final
features of the system.