Primary Steps for Achieving ISO Certification

As a responsible person for information security within your organization, whether your are the CEO, the owner, CTO or Information Security Officer you should obtain a copy of the standard ISO/IEC code of practice and read it. Upon reading, you will realize that this is a management standard. It is essentially an overview of best practices to ensure integrity, confidentiality and availability of your business data.

Initiate the first round of discussions with your employees at all levels and perform information security profiling within your organization.

The ISMS stands for Information Security Management System. In the beginning it is important to define this scope, whether it is one layer of your company, a department, floor or even a process.

Define the risk assessment approach. You may want to take a look at ISO/IEC a sub section of the 2700x standard series, which is specially focused on risk assessment.

Define both the tangible and intangible assets within the scope of your ISMS. These assets can be people and buildings and everything else in between.

Perform risk assessment exercise for various assets within the scope of your ISMS. This involves identifying relevant threats towards the assets, identification of vulnerabilities of the asset towards each threat, impact of threat and the probability of a threat becoming a reality.

The relationship between an Asset and a Threat is considered a Risk. Suggest controls from ISO/IEC that Hedge against the Identified Risks. Guidelines on the implementation of these controls are in ISO/IEC You may need to define your own specific controls.

The most important report is the SOA report or the Statement of Applicability which should display the information security risk within the scope.

Develop a customized and focused information security training program to build awareness of information security for everybody in your company.

The Risk Assessment is only one part of three steps required for a full implementation of ISO/IEC The other two are Business Continuity planning and development of Organizational Manual such as procedures, processes and policies.

You get more information about ISO certification consultancy, documentation, auditor training as well as Information Security Management System (ISMS) visit global web site