So how do we go about implementing the ISO 27001 so the very first step is to
define the context establishment so in that is to first be able to understand
what the organization is all about where are your key businesses or core
businesses areas without understanding what that is you will not be able to
find out what it is that you need to protect so different organizations will
have different values for information so it's important for you to first identify
what are the organizational businesses and then what are the information that
you are actually collecting and then what are you going to do with the
information and hence the value of the information to you and then from there
to look at what are the needs and the expectations of interested parties so in
today's age many companies are actually looking at outsourcing of of the if the
managing of the information now outsourcing of the management of the
information does not necessarily mean that it's the outsourcing of the
ownership of that information so important for an organization when you
look at what you are trying to protect is to understand what is the
expectations of those in requirements
yes
the stream stopped? oh yes we started again
okay in terms of getting leadership
commitment into this project and which is why earlier I said that it's really
important to take ISMS as a project because to ensure that you get the
traction that you need to ensure that it gets a successful implementation at the
end of the day it's really important to get the leadership's view into this so
one of the ways that we've actually done that in terms of implementing that is to
define organizational roles and responsibilities we start we start
creating or establishing and defining what an information security
organizational structure would look like to make sure that the information
security officer have a prominent role within the organization and then
outlining what those responsibilities responsibilities of everyone within the
information security organizational structure from by that method where you
then have them signed off at the very top level that's where we actually said
that that's how you get leadership's commitment right from the top in itself
and that's really important if you want to see a successful implementation of an
ISMS and then the next part from that is then to look at how do we then start
implementing some of the concepts of information security now what we said
earlier 27001 is actually a
risk-based approach into managing information security
hence obviously a big part of that is in terms of planning out how do we actually
manage the ISMS as a risk-based approach so and in this part of the
implementation it's about coming up with a risk management framework it's about
coming up with risk acceptance criteria so to what extent are you accepting
of a particular risk in the organization what into what level do you want to make
sure that actions are actually undertaken and the other thing also
about risk management is that it allows you to prioritize on the controls that
you want to put in place so ultimately what a risk management framework is
should be able to assist an organization to do is to filter down from close to a
hundred and fourteen controls potentially that you need to implement
to perhaps just half of that depending on the prioritization depending on the
maturity of the organization depending on what the risk acceptance criteria is
so all these needs to be planned out before you actually then start that
process and similarly like any other projects implementation that you have
once you've got all your plan in place that means having a context of the
organization understanding where information is the value of the
information who are interested in it having an organizational structure in
place plan out a risk management framework and then the next thing you
need to look at who are the people who be involve in that project who do I need
to have in this project so obviously for for information security project you
need to be have people who are if not well versed with information security
but to a certain extent would understand the implications of a risk now the
importance of that is that when you do a risk management process in itself the
ultimate game of it is to be able to understand those risks that have been
identified to understand the risks that you are accepting for either not
accepting not doing anything about a particular risk or to implement controls
to that you need to sign that off so it is important that whoever is in those
roles the information security rules which are defined at the outstart when
you did the organizational structure is to make sure that they
at least have a basic understanding of what information security is and what
risk means to the organization and finally it's obvious the final part of
it is actually to operationalize the whole the whole process in itself so in
this initial phase of the roadmap is is to first do the setup of the
expectations and then to plan out what are the frameworks that you need to have
in place and then the next step is of obviously to operationalize the the
implementation in itself so towards the end of that implementation so on a
yearly basis what needs to happen is that one of the things that needs to be
to be looked into is to build what we call key risk indicators or key
performances key performance indices this to enable the monitoring of the
project in itself to look at whether you are behind time or maybe there are
certain risk that have high have been highlighted during the risk management
process phase that needs to be brought up and immediate action needs to be
taken or are we actually coming to a point where our budgets have not been
enough and you need to revisit that as well so the monitoring and the
measurement face of it allows you to manage the project to ensure that you
get a successful return at the end of the day and once you've actually put all
this in place you need to have an assessment of how well you are doing in
accordance to what you have actually planned to do