Implementing an Information Security Management System - Implementation
(Page 4 of 4 )
Once the planning and structuring phases have been completed successfully, implementation is primarily a matter of setting in train the required actions, and monitoring them to ensure they are being carried out as specified. Since the responsible teams and individuals will have been identified, all parties should understand their roles and be in a state of readiness to move forward when the time for implementation arrives.
To support this, a second strand to implementation is often the provision of training and awareness programs to bring people up to speed with the implications of the ISMS. This will include validating and distributing documentation relating to the project, conducting sessions to make people aware of their responsibilities, and any technical training required to ensure the successful implementation of specific aspects of the system, for example a migration to new software or the development of a new firewall.
Certification
In many cases, certification will be a key goal of the ISMS. When this is so, the selection of an appropriate certifying body becomes a decision of key importance. Close integration is necessary between the organization seeking certification and the one providing it. The applicant organization must be prepared to expose its inner workings to the assessors, including potentially sensitive data and every aspect of how it conducts its business. It must, therefore, be able to establish a strong relationship of trust with the certifying body. For this reason it is recommended that as many potential certification candidates as practical are considered.
Certification in itself doesn't require any steps other than those necessary to implement the ISMS. When implementation is complete, assessors will thoroughly examine the system against the ISO/IEC 27001 standard. The certification process consists of the following six steps:
Primary audit, during which the assessors will thoroughly examine all the ISMS documentation.
Actions and modifications resulting from the primary audit.
Secondary audit. This is carried out on site, and involves a thorough examination of the implementation of the documented ISMS.
Post-audit corrections.
Issuing of certification.
Follow up to ensure continued compliance.
| DISCLAIMER: The content provided in this article is not warranted or guaranteed by Developer Shed, Inc. The content provided is intended for entertainment and/or educational purposes in order to introduce to the reader key ideas, concepts, and/or product reviews. As such it is incumbent upon the reader to employ real-world tactics for security and implementation of best practices. We are not liable for any negative consequences that may result from implementing any information covered in our articles or tutorials. If this is a hardware review, it is not recommended to open and/or modify your hardware. |
