The journey to ISO 27001 certification 13/08/2019 The journey to ISO 27001 certification Olivier Burrows, Management Systems Tutor, BSI

No owners/ shareholders … all profit reinvested into the business Who is BSI? – 10 fast facts No owners/ shareholders … all profit reinvested into the business Founded in 1901 Global independent business services organization Standards, assessment, testing, certification, training, software National Standards Body in the UK #1 certification body in the UK and USA >2,500 staff and >50% non-UK 53 offices located around the world 64,000 clients in 147 countries £244.9m revenue in 2011

The start of the journey – who will manage this?

So what is the journey to certification? At some point the business has a brainwave. Or a client asks do you have certification to ISO 27001? And of course we don’t. So what happens next? The idea of certification is then bounced around the business – do we need it? What will cost? Who will do it?

The journey to certification (cont.) And then the question is asked does it belong to the IT Director or the Quality Director or the Security Manager? And it lands on your desk, with no background of why and where. So what do we do next???? What are we going to ask?

The journey to certification: What are the questions? What is this for? What money do we have? Do we have any resources? Is there any training? Has anyone looked at the Standard? What will be the Scope of the Certification? How much time do we have?

The journey to certification: What will we need in the ISMS? Security policy Organizational security Asset classification and control Personnel security Physical and environmental security Communications and operations management Access control System development and maintenance Business continuity management Compliance

The next phase is …

The journey to ISO 27001 certification: Planning

20% of the time implementing 10 10 Planning phase We now need to spend time planning the task – We should spend 20% of the time implementing 80% of our time planning 20% of our time planning 60% of the time fire fighting 20% of the time implementing which then ends up lasting the life of the system or to our retirement which ever comes sooner. but we spend

Planning phase Security policy Organizational security Asset classification and control Personnel security Physical and environmental security Communications and operations management Access control System development and maintenance Business continuity management ISO 22301? Compliance

What are the next steps for implementation?

Project plan We will be following a defined project plan The plan has 4 stages and 18 defined steps

The journey to ISO 27001 certification Stage 1: Committee to implement

Where we are?

The journey to ISO 27001 certification Stage 2

The journey to ISO 27001 certification: Stage 2 Receive Training Perform Gap Analysis Prepare Implementation Project Plan Estimate Costs

18 18 18 Where we are …

The journey to ISO 27001 certification Stage 3

Implement and operate Support Project Monitor Project

The journey to ISO 27001 certification Stage 4

Monitor and measure Management review Prepare for Certification

The journey to ISO 27001 certification Lessons learnt

So what are the lessons learnt? We rare look at the lessons learnt, I would just like to look at some of the main lessons for us all. Time Resources Scope and boundaries creep Training and awareness- In pact to our process. Project Management – The need of good project management.

The journey to ISO 27001 certification Certification process with BSI

The registration process Contact Customer Services Helpline 0845 80 9000 Obtain quotation and submit application Client manager appointed System reviewed to ensure standard requirements addressed and registration assessment planned Initial assessment conducted Conformity and effectiveness of system to standard assessed Corrective action plan (if required) submitted Registration confirmed Certificate issued Continuous assessment programme (3 year cycle) Total client care

Consider certification

Any questions? Any questions?

Contact us Address: BSI Group Kitemark Court, Davy Avenue, Knowlhill Milton Keynes, MK5 8PP Telephone: +44 (0)845 080 9000 Email: certification.sales@bsigroup.com Links: www.bsigroup.com If you require any further information, don’t hesitate to contact us.