Book Image

Mastering Information Security Compliance Management

By : Adarsh Nair, Greeshma M. R.
1 (1)
Book Image

Mastering Information Security Compliance Management

1 (1)
By: Adarsh Nair, Greeshma M. R.

Overview of this book

ISO 27001 and ISO 27002 are globally recognized standards for information security management systems (ISMSs), providing a robust framework for information protection that can be adapted to all organization types and sizes. Organizations with significant exposure to information-security–related risks are increasingly choosing to implement an ISMS that complies with ISO 27001. This book will help you understand the process of getting your organization's information security management system certified by an accredited certification body. The book begins by introducing you to the standards, and then takes you through different principles and terminologies. Once you completely understand these standards, you’ll explore their execution, wherein you find out how to implement these standards in different sizes of organizations. The chapters also include case studies to enable you to understand how you can implement the standards in your organization. Finally, you’ll get to grips with the auditing process, planning, techniques, and reporting and learn to audit for ISO 27001. By the end of this book, you’ll have gained a clear understanding of ISO 27001/27002 and be ready to successfully implement and audit for these standards.
Table of Contents (19 chapters)
1
Part 1: Setting the Stage – Definitions, Concepts, Principles, Standards, and Certifications
4
Part 2: The Protection Strategy – ISO/IEC 27001/02 Design and Implementation
10
Part 3: How to Sustain – Monitoring and Measurement
Appendix – Terms and Definitions

Performing an Audit

Auditing is important in maintaining trust and efficiency in a company’s management system. An organization must foster a culture of continual improvement. They will be making worthwhile efforts for success, whether it be planning, scheduling, creating checklists, or carrying out or following up on audits, if they can pinpoint the areas to be audited. You can prevent inconsistencies between procedures and team member unavailability for the audit by creating a plan and schedule in advance. An audit plan assists your teams in organizing their operations and work properly. Scheduling audits will ensure that no procedure or area is overlooked.

Future audits should be announced to all departments as a courtesy so that they can be ready with the necessary documentation and other resources, such as evidence of the accomplished action plans, for the reviewer. Except in cases when there is a surprise audit of questionable behavior, your staff has every right to...