How to Implement ISO 27001 Controls?

The ISO 27001 stands out from other regulatory standards like the GDPR or HIPAA. These standards put mandatory requirements on specific types of information. The ISO 27001, on the other hand, addresses the security requirements of an entire business structure.

Guide to ISO 27001 Implementation

1. Identify business objectives
2. Obtain board approval
3. Determine the scope of implementation
4. Document method of risk assessment
5. Inventory assets that need protection, and classify according to risk classification
6. Manage risks with the controls outlined in the standard. (See below regarding the SoA.)
7. Set up policies and procedures to implement risk mitigation strategies
8. Monitor the implementation for effectiveness
9. Prepare for the Certification Audit

How to Implement ISO 27001 Security Controls?

Security controls are at the crux of ISO 27001 certification. NIST defines security controls as “a safeguard or countermeasure prescribed for an information system or an organization designed to protect the confidentiality, integrity, and availability of its information”. The SoA is a foundational document that details which security controls need to be implemented to comply with ISO standards. 

What is a Statement of Applicability?

The SoA is a mandatory document that needs to be submitted in order to obtain ISO 27001 certification. The SoA, or Statement of Applicability, is the bridge between risk assessment and implementation of a risk mitigation strategy through security controls. The SoA is a constantly updated guideline that outlines an overall plan of information security implementation. ISO 27001 documentation lists 35 control objectives and 114 security controls to implement in a business’s ISMS. The SoA document is also accepted as evidence of risk management during an audit process.