ISO 27001-based ISMS: an implementation roadmap

1Introduction

An ISMS systematically protects confidentiality, integrity and availability; ISO/IEC 27001 defines requirements to establish, operate, maintain and improve it.

2Discussion

Implementation starts with scope and top-management commitment, followed by risk assessment of assets, threats and vulnerabilities; selected Annex A controls are documented in the Statement of Applicability.

The 2022 edition groups controls into organisational, people, physical and technological themes and adds controls such as threat intelligence, cloud security and monitoring activities.

3Conclusion

An ISMS is a continuous Plan-Do-Check-Act cycle; regular internal audits, management review and corrective action keep it alive and the certificate valid.