{"id":1384,"date":"2018-11-20T11:32:47","date_gmt":"2018-11-20T11:32:47","guid":{"rendered":"https:\/\/iso27001.solutions\/?p=1384"},"modified":"2019-03-11T17:41:43","modified_gmt":"2019-03-11T17:41:43","slug":"the-iso-27001-checklist","status":"publish","type":"post","link":"https:\/\/ismsalliance.com\/trends\/iso-27001-implementation\/the-iso-27001-checklist\/","title":{"rendered":"The ISO 27001 Checklist"},"content":{"rendered":"

Everyone looking to be ISO 27001 certified is searching for an \u201cISO 27001 Checklist\u201d.<\/h2>\n

Ignoring what everyone wants is a bad idea but ignoring the advice of our expert consultants is a bad idea as well…<\/p>\n

We offer you\u00a0a list of questions that will help frame your mind around how your organization is currently positioned if you were to be considered for ISO 27001 certification<\/a>.<\/p>\n

These questions are meant ONLY to help frame the ISO standard around your organization but provide wee … limited… little… scant value in telling you how close you are to certification.<\/p>\n

Whether you work with us or not, we believe knowing you\u2019re secure and proving you\u2019re compliant is important for all organizations.<\/p>\n<\/div>

<\/a><\/span><\/div><\/div>
<\/div><\/div><\/div><\/div><\/div>
<\/i><\/div><\/div><\/div>
<\/div><\/div><\/div>

Context<\/strong> \u2013 Do you know what needs to be protected?<\/h3>\n<\/div>
\n
\n
\n

Have you documented: <\/strong><\/p>\n

    \n
  1. All external and internal issues that affect your ISMS<\/a>?<\/li>\n
  2. Information security stakeholders and their information security requirements?<\/li>\n
  3. Dependencies on other organizations that must be considered when determining what needs to be protected and where?<\/li>\n<\/ol>\n<\/div>\n<\/div>\n<\/div>\n<\/div><\/div><\/div>
    <\/div><\/div><\/div><\/div><\/div>
    <\/i><\/div><\/div><\/div>
    <\/div><\/div><\/div>

    Leadership<\/strong> \u2013 Do you know management\u2019s vision?<\/h3>\n<\/div>
    \n
    \n
    \n

    Can you provide evidence of leadership’s vision for: <\/strong><\/p>\n

      \n
    1. What information & how information should be protected?<\/li>\n
    2. How roles, responsibilities & authorities required for information security will be established?<\/li>\n
    3. How the vision will be made available, communicated, maintained and understood by all parties?<\/li>\n<\/ol>\n<\/div>\n<\/div>\n<\/div>\n<\/div><\/div><\/div>
      <\/div><\/div><\/div><\/div><\/div>
      <\/i><\/div><\/div><\/div>
      <\/div><\/div><\/div>

      Planning<\/strong> \u2013 Do you have a plan to fulfill the vision?<\/h3>\n<\/div>
      \n
      \n
      \n

      Have you conducted a comprehensive risk assessment that analyzed risk and determined probability of potential impacts to achieving objectives & management\u2019s vision?<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div><\/div><\/div>

      <\/div><\/div><\/div><\/div><\/div>
      <\/i><\/div><\/div><\/div>
      <\/div><\/div><\/div>

      Support<\/strong> \u2013 Do you have the support the plan needs to be successful?<\/h3>\n<\/div>
      \n
      \n
      \n

      Can you demonstrate you have the following pieces to support your plan: resources, competencies, awareness, document management process, ability to communicate the plan internally & externally?<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div><\/div><\/div>

      <\/div><\/div><\/div><\/div><\/div>
      <\/i><\/div><\/div><\/div>
      <\/div><\/div><\/div>

      Operation<\/strong> \u2013 Have you executed your plan?<\/h3>\n<\/div>
      \n
      \n
      \n

      Can you prove your plan has been executed, per the plan? Have you: <\/strong><\/p>\n

        \n
      1. Carried out operational planning and control processes?<\/li>\n
      2. Confirmed information security risk assessments were conducted as planned?<\/li>\n
      3. Confirmed information security risk treatment plans were documented and implemented?<\/li>\n<\/ol>\n<\/div>\n<\/div>\n<\/div>\n<\/div><\/div><\/div>
        <\/div><\/div><\/div><\/div><\/div>
        <\/i><\/div><\/div><\/div>
        <\/div><\/div><\/div>

        Performance Evaluation<\/strong> \u2013 Is your plan successful?<\/h3>\n<\/div>
        \n
        \n
        \n

        Have you demonstrated: <\/strong><\/p>\n

          \n
        1. A process for management review of the ISMS?<\/li>\n
        2. Have you conducted\u00a0internal audits to determine the information security management process complies with your organization\u2019s requirements?<\/li>\n
        3. The ability to track security metrics?<\/li>\n<\/ol>\n<\/div>\n<\/div>\n<\/div>\n<\/div><\/div><\/div>
          <\/div><\/div><\/div><\/div><\/div>
          <\/i><\/div><\/div><\/div>
          <\/div><\/div><\/div>

          Improvement<\/strong> \u2013 Are you making corrective actions and continual improvements?<\/h3>\n<\/div>
          \n
          \n
          \n
            \n
          1. Do you have corrective action plans?<\/li>\n
          2. Are you reacting to nonconformities identifying their root causes and implementing corrective actions to ensure a consistent, improvable, effective & repeatable ISMS is in place?<\/li>\n<\/ol>\n<\/div>\n<\/div>\n<\/div>\n<\/div><\/div><\/div>
            <\/div><\/div><\/div><\/div><\/div>

            Need to fill gaps to achieve ISO 27001 certification…<\/h3>\n

            Simplified ISO 27001 Certification + Continued Management all for a Fixed Monthly Fee.<\/p>\n<\/div>

            <\/div>
            <\/div>
            <\/div>