How to implement ISO/IEC 27001: video walkthrough

What makes an ISO/IEC 27001 implementation different

ISO/IEC 27001 is the international standard for an information security management system, or ISMS: a governed, risk-based way of protecting the confidentiality, integrity and availability of the information an organisation holds and the systems that process it. Security questionnaires, tenders and procurement teams name it when they want to know whether a supplier's security is managed rather than improvised.

Its mechanism shapes the whole implementation. The standard does not hand you one fixed list of safeguards. You assess your information security risks against criteria you define, decide how each will be treated, select the controls you need, check the selection against Annex A and record the outcome in a Statement of Applicability. This short film walks through that route; the stages below follow the ISO/IEC 27001 hub.

From scope to certificate, stage by stage

Define the scope the certificate must cover: services, sites, systems, cloud platforms, headcount and the interfaces with clients and suppliers, matched to the questionnaire or tender behind the project. A gap analysis then compares existing policies, controls and records with clauses 4 to 10 and the Annex A controls of the 2022 edition, keeps what works and sets an action plan with owners and dates.

The core of the build is the asset inventory, the risk assessment against agreed criteria, the treatment decisions, the Statement of Applicability and a treatment plan the risk owners approve. Controls are put into operation, people are trained and a vulnerability assessment is carried out, with records accumulating as work is done. Internal audit across clauses and controls and a management review come next, and findings are closed with evidence before an independent certification body, accredited for ISMS certification, carries out its two-stage assessment and decides.

Sterling's expert and experienced consultants carry this with your IT and business teams under Sterling OS™: Design™ for guided implementation with ISMS templates and risk workshops, or Drive™ when Sterling consultants take on the agreed work through to audit preparation. Assets, risks, the Statement of Applicability, controls, incidents and audits are held together in Effivity.