iso27001-compliance

name	iso27001-compliance
description	Implement ISO 27001 Information Security Management System. Configure ISMS controls and risk management. Use when implementing enterprise security frameworks.
license	MIT
metadata	{"author":"devops-skills","version":"1.0"}

ISO 27001 Compliance

Implement an Information Security Management System (ISMS) aligned with ISO/IEC 27001:2022.

When to Use

• Establishing an ISMS for the first time in an organization
• Preparing for ISO 27001 certification audit
• Conducting risk assessments and developing risk treatment plans
• Creating the Statement of Applicability (SoA)
• Transitioning from ISO 27001:2013 to the 2022 revision
• Meeting customer or regulatory requirements for ISO 27001 certification

ISMS Plan-Do-Check-Act Cycle

pdca_cycle:
  plan:
    - Define ISMS scope and boundaries
    - Establish information security policy
    - Conduct risk assessment
    - Develop risk treatment plan
    - Produce Statement of Applicability
    - Obtain management approval and commitment
    - Define security objectives and metrics

  do:
    - Implement selected Annex A controls
    - Deploy technical security controls
    - Conduct security awareness training
    - Document all procedures and processes
    - Implement incident management process
    - Establish supplier security management

  check:
    - Conduct internal audits (at least annual)
    - Perform management review meetings
    - Monitor and measure control effectiveness
    - Review incident trends and near misses
    - Assess compliance with legal requirements
    - Evaluate security metrics against objectives

  act:
    - Address nonconformities with corrective actions
    - Implement continual improvement initiatives
    - Update risk assessment based on changes
    - Refine controls based on audit findings
    - Communicate improvements to stakeholders

ISMS Scope Definition

isms_scope:
  template:
    organization: "Company Name, Ltd."
    scope_statement: |
      The ISMS covers the design, development, operation, and support of
      the Company's cloud-based SaaS platform, including all supporting
      infrastructure, personnel, and processes at the following locations.

    included:
      locations:
        - "Primary office: 123 Main Street, City, Country"
        - "AWS us-east-1 and eu-west-1 regions"
        - "Remote workers accessing corporate systems"
      business_processes:
        - "Software development and deployment"
        - "Cloud infrastructure management"
        - "Customer data processing and storage"
        - "Customer support operations"
        - "Corporate IT and internal systems"
      information_assets:
        - "Customer data (PII, business data)"
        - "Source code and intellectual property"
        - "Employee personal data"
        - "Financial records"
        - "Security configurations and credentials"
      technology:
        - "AWS cloud infrastructure"
        - "SaaS application stack"
        - "Corporate IT systems (Google Workspace, Okta, Jira)"
         

    
       
       
     

    
       
       
       

Risk Assessment Process

risk_assessment:
  methodology:
    approach: "Asset-based risk assessment"
    risk_formula: "Risk = Likelihood x Impact"
    scale: "1-5 for both likelihood and impact (total 1-25)"

  likelihood_scale:
    1: "Rare - less than once per 5 years"
    2: "Unlikely - once per 2-5 years"
    3: "Possible - once per 1-2 years"
    4: "Likely - multiple times per year"
    5: "Almost Certain - monthly or more frequent"

  impact_scale:
    1: "Negligible - minimal operational impact, no data loss"
    2: "Minor - limited impact, small data exposure, <$10K cost"
    3: "Moderate - significant impact, data breach <1K records, <$100K cost"
    4: "Major - severe impact, large data breach, <$1M cost, regulatory action"
    5: "Critical - catastrophic, massive breach, >$1M cost, business viability at risk"

  risk_matrix:
    #        Impact: 1    2    3    4    5
    likelihood_5:  [5,  10,  15,  20,  25]
    likelihood_4:  [4,   8,  12,  16,  20]
    likelihood_3:  [3,   6,   ,  ,  ]
      [,   ,   ,   ,  ]
      [,   ,   ,   ,   ]

  
     
     
     

  
     
     
     
     

  
      
       
       
       
       
       
       
       
       [, ]
       
       
       
       

      
       
       
       
       
       
       
       
       [, ]
       
       
       
       

      
       
       
       
       
       
       
       
       [, ]
       
       
       
       

Statement of Applicability (SoA)

# ISO 27001:2022 Annex A Controls - Statement of Applicability
soa_template:
  organizational_controls_5:
    "A.5.1":
      control: "Policies for information security"
      applicable: true
      justification: "Required to establish security governance"
      implementation: "Information security policy approved by CEO, reviewed annually"

    "A.5.2":
      control: "Information security roles and responsibilities"
      applicable: true
      justification: "Required for accountability"
      implementation: "RACI matrix for security responsibilities, CISO appointed"

    "A.5.7":
      control: "Threat intelligence"
      applicable: true
      justification: "Required for proactive threat management"
      implementation: "Subscribe to threat feeds, CVE monitoring, vendor advisories"

    "A.5.15":
      control: "Access control"
      applicable: true
      justification: "Required for data protection"
      implementation: "RBAC via Okta, least-privilege IAM policies, quarterly access reviews"

    "A.5.23":
      control: "Information security for use of cloud services"
      applicable: true
       
       

    
       
       
       
       

    
       
       
       
       

  
    
       
       
       

    
       
       
       

    
       
       
       

  
    
       
       
       

  
    
       
       
       

    
       
       
       

    
       
       
       

    
       
       
       

    
       
       
       

    
       
       
       

    
       
       
       

    
       
       
       

    
       
       
       

Internal Audit Program

internal_audit:
  schedule:
    frequency: "Annual full cycle, quarterly focused audits"
    cycle: "All ISMS clauses and applicable Annex A controls audited over 12 months"

  audit_plan_template:
    audit_id: "IA-2025-Q1"
    scope: "Clauses 4-10, Annex A controls A.5.1-A.5.15"
    auditor: "Internal auditor (independent of audited area)"
    audit_dates: "2025-03-10 to 2025-03-14"
    areas:
      - area: "Access Control (A.5.15)"
        auditee: "IT Security Team"
        evidence_requested:
          - "Access review records from last quarter"
          - "Joiner/mover/leaver process records"
          - "Privileged access management logs"
      - area: "Risk Management (Clause 6.1)"
        auditee: "Risk Management Team"
        evidence_requested:
          - "Current risk register"
          - "Risk assessment methodology document"
          - "Management risk review meeting minutes"

  finding_categories:
    major_nonconformity: "Requirement not met, significant risk to ISMS effectiveness"
    minor_nonconformity: "Requirement partially met, limited risk"
     
     

  
     
     
     
     

Management Review Meeting

management_review:
  frequency: "At least annually, recommended quarterly"
  attendees:
    required:
      - "CEO or Managing Director"
      - "CISO or Information Security Manager"
      - "Department heads"
    optional:
      - "Internal auditor"
      - "Risk manager"
      - "External consultant"

  mandatory_inputs:
    - "Status of actions from previous management reviews"
    - "Changes in external and internal issues relevant to the ISMS"
    - "Information security performance (metrics and KPIs)"
    - "Audit results (internal and external)"
    - "Incident trends and nonconformities"
    - "Risk assessment results and risk treatment plan status"
    - "Interested party feedback"
    - "Opportunities for continual improvement"

  mandatory_outputs:
    - "Decisions on continual improvement opportunities"
    - "Decisions on changes needed to the ISMS"
    - "Resource allocation decisions"
    - "Updated risk acceptance decisions"

  kpis_to_report:
    - "Number and severity of security incidents"
     
     
     
     
     
     

ISO 27001 Certification Checklist

certification_checklist:
  stage_1_audit_preparation:
    - [ ] ISMS scope documented and approved
    - [ ] Information security policy published
    - [ ] Risk assessment methodology defined
    - [ ] Risk assessment completed with risk register
    - [ ] Risk treatment plan developed
    - [ ] Statement of Applicability completed
    - [ ] ISMS objectives defined with measurable targets
    - [ ] Internal audit program established
    - [ ] At least one full internal audit completed
    - [ ] Management     
     [ ]     

  
     [ ]       
     [ ]       
     [ ]        
     [ ]      
     [ ]      
     [ ]    
     [ ]    
     [ ]     
     [ ]        

  
     [ ]       
     [ ]     
     [ ]     
     [ ]        
     [ ]    
     [ ]     

Best Practices

• Secure visible management commitment with a signed information security policy
• Define ISMS scope carefully; too broad makes certification expensive, too narrow reduces value
• Use an asset-based risk assessment approach to ensure comprehensive coverage
• Maintain the Statement of Applicability as a living document aligned with the risk register
• Conduct internal audits with auditors independent of the area being audited
• Hold management review meetings quarterly rather than only annually
• Integrate ISO 27001 controls into daily operations rather than treating them as a separate compliance exercise
• Use metrics and KPIs to demonstrate ISMS effectiveness to auditors and management
• Plan for the 3-year certification cycle: certification audit, then two surveillance audits
• Start collecting evidence of control operation at least 3 months before the Stage 2 audit