How do we know that our information is secure? Because we're holding a lot of
client information, a lot of sensitive client information, and that organization
itself has got a lot of important information customer data, IP information, and so
forth. So how do we really know ourselves whether we've got the right things in
place to protect that information. In this video we're going to go through
this Best Practice gap analysis, and this gap analysis, this document will take
you through all the key clauses of the ISO 27001 standard and as
you go through each one you'll be able to document whether, where your
organization is positioned, in terms of do you feel you meet these standards, or you
don't - as a result of this to start forming your own gap analysis - so
although you may not necessarily have a requirement to get certified but this
checklist at least enables you to give yourself some assurance that what you
have in place is either very closely aligned or is perfectly aligned to a
standard and then you've got the systems to process
the procedures and policies in place as per the clauses here that would
potentially meet certification.
This documents useful in that an organization may be at a position that
they feel they've got a number of that they feel they've got information
security in place, they got the infrastructure in place, the process and
procedures in place, the policies, the infrastructures and all the necessary
controls to safeguard information for their organization or for their clients.
The next step is the organization may then want to go to next
step further and actually acquire a certification, an ISO 27001 certification
from a certification body like a Best Practice. So they may want to get an
understanding where they are today and what versus what the standard is asking
them to be certified. So by looking at this document - this gap analysis document -
where it takes you step by step, as in the checklist, step by step for each
of the clauses of the standard for example the context of the organization
so they'll give you an understanding, it gives you a brief description of what is
a context of the organization, meaning what are your internal issues the main
fact it's the safeguard of your information, what are some interested
parties - are they government regulations, are there technologies, what does your
customers needs and expectations of your organization to protect their
information - so you'll have an understanding what you've got in place
today and what the standard is asking and it's as simple as do you feel you've
got what it takes today to meet the standard if it's a yes you take yes if
it's a no then you know this will give you an indication what you've got a gap
between what you have today and what the standard is asking and it's also useful
to justify yourself if you think you do have the capabilities to write down here
what documentation you may have or what evidence you may have to support that of
answering yes. This is just the first part of a clause 4, then as you go
along on each page there's all these sections
called leadership and commitment that basically says is your top management
executive c-level management committed to an information security
management system, have they set policies and endorse policies, do they promote the
policy throughout the organization, is it easily accessible to the people in the
organization. So that's just one part of it but there's many aspects to that you
should go through that and as we go through further this is part section six
called planning, that's where you would look at your risks and opportunities
what are the risks that may, the information would lead to a loss to
confidentiality, integrity and availability of information. It could be
you know you may have risks in terms of security of data centres, you may have
risks in your networks, have you got the necessary firewalls and protections in
place to ensure that you're protected against viruses, malware and so forth.
So each organization will have their own set of risks and opportunities depending
on the scope of your ISMS and depending the type of organization that you are
and as you're looking in doing a risk assessment and opportunities here and
along continuing to the next page essentially this is asking you, have you
done a risk assessment - in other words - if you look at a particular risk what's the
likelihood of that risk occurring and what's the consequence if that risk was
to materialize, then you go through a process of risk ranking putting a score
against them and then looking at what are your risk options, do you
want to accept the risk, do you want to transfer the risk, do you want to mitigate
the risks, or do you want to eliminate the risk. From then on it goes
through a further exercise here, then what controls would you put in place to
address those risks and as you're going through each section here, again it's an
easy tick box of yes, you've got these in place or no, you don't have these in place
and as you get coming along and as you're progressing along and you're
finding give ticking a lot of yes then I'll give you a kind of a bit of comfort
that you are aligning very well to the ISO 27001 standard and perhaps
you are very good position to begin the process of certification. Next section is
seven it's basically resources competence
levels of your staff, that's looking after your roles and responsibilities
have you got the right people in place, the right qualification experience
or training, for them to be you know to be part of the ISMS, to be part of the
management system, and here section seven it's about documentation control. Have
you got good traceability of your documents, version control, naming
conventions and so forth is your documentation available to all staff.
Number eight, operational, this is where one will demonstrate how your controls
are actually implemented and are they effective. Number nine here is what's
called monitoring, measuring and analysis and evaluation. Here your example
monitoring your capacity management have you got enough capacity infrastructure,
are you monitoring the effectiveness of how your controls are working and really
once you get more familiar with this standard there's a section called Annex A
of controls and basically here for eight and nine you'll be looking at
measuring and monitoring how effective those controls from Annex A are
effectively working in your organization and in relation to your information
management system. Section nine is and the combined all the section nine is
about the organization performing there on internal audit on the information
security management system in other words performing your internal audit on
ISO 27001 internally, then once you've established your audit program you've
conducted the audit, you've documented your findings, the next step is for
management review. For the management to review the other findings to see
where there is areas of improvement or weathers non-conformities in which
Action Plans needs to take place and then finally section ten is about
correcting those findings from the internal audit and where you can
improve your management system because what you'll find is with the management
system ISMS it's continual improvement. It's a cycle of what they
call a PDCA plan-do-check-act and a number of these sections, the first
sections first four to seven sections of the clauses you're planning to implement
your information management system, eight is when you're applying the controls
implementing controls, it's the do, the check is the actual internal auditor or
internal auditing, measuring, monitoring and the action is addressing any
non-conformance and continually improving the management system.
So that's you know a very good checklist to gauge where your organization is, where it is
today and how much you need to do to bridge the gap to be able to
start the journey or certification. In brief ISO 27001 ensures you've got a
system - a management system - a system in place that ensures you protect
information against loss of confidentiality, integrity and
availability. If you're looking to be certified for ISO 27001 or you're just
simply interested in doing your own gap analysis click on click on the link
below this video. 👍