ISMS – Phases of Implementation

An information security management system (ISMS) comprises the various policies, standards, procedures, practices, behaviors, and scheduled activities that a corporation implements to protect the (important) information assets it possesses. Both the organization and its external constituents are provided with clear objectives and context regarding information security.

The design and implementation of the ISMS are dependent on the organization’s requirements and goals. The organization’s size and structure, the market or service region, and the sensitivity of the information it possesses or controls on behalf of others should also be considered. It is the goal of an ISMS to identify, assess (if necessary), and manage information security threats, to protect an organization’s digital assets. This procedure shouldn’t be considered a one-time event but an ongoing risk management cycle. The measurement and reporting...

Phases of ISMS implementation

The following sections cover a step-by-step explanation of the various aspects, in sequential order, of ISMS implementation, based on the ISO 27001 standard.

1) Management support

Convincing management about an ISMS implementation can seem a daunting task. After all, management’s ultimate responsibility is the profitability of the company and decisions will be based on ROI (short for return on investment). Planning how to present the information in a way that management can understand and endorse is one of the key aspects of convincing them.

It is obvious that management will look for the benefits of the proposed ISMS. The following are the four most important benefits of an ISMS:

• Compliance: ISO 27001 can provide a methodology that enables a company to comply with multiple regulations concerning data protection, privacy, and IT governance (particularly if it is an organization in the financial sector, the healthcare industry, or...

Time, effort, and roles in an ISO 27001 implementation

It can take a few months for smaller businesses and up to a year or more for larger firms to implement an ISMS. A successful and fruitful rollout can improve operational metrics such as efficiency, effectiveness, and cost savings, and reduces the frequency with which events occur. In smaller businesses, the project manager will also serve as the security officer, but in larger businesses, the roles will be distinct. A professional project manager will oversee the project while a second person serving as the security officer will oversee overall security and take part in it.

ISO 27001 does not require creating a project team; however, doing so will be beneficial for businesses with 200 or more employees. For smaller businesses, having just a project manager who will manage the project alongside other team members will suffice.

Irrespective of the size of the company, it is good practice to include part of your employees in...

Summary

The process of implementing an ISMS may appear daunting, but it is rather simple. Formally identifying and managing threats to the organization’s information is what is at the core of an ISMS. As soon as the scope is clearly specified, it’s easy to move on to the implementation process. As with any huge project, well-thought-out plans lead to a successful outcome. It is important to ensure that the documentation is fit for purpose and targeted at the intended audience. It is important to keep in mind that clauses 4-10 of the ISMS are necessary. These clauses demand that you handle requirements in each of them.

In the next chapter, we will see the incident management process of an ISMS implementation.