ISO 27001 Compliance

Implement an Information Security Management System (ISMS) aligned with ISO/IEC 27001:2022.

When to Use

• Establishing an ISMS for the first time in an organization
• Preparing for ISO 27001 certification audit
• Conducting risk assessments and developing risk treatment plans
• Creating the Statement of Applicability (SoA)
• Transitioning from ISO 27001:2013 to the 2022 revision
• Meeting customer or regulatory requirements for ISO 27001 certification

ISMS Plan-Do-Check-Act Cycle

pdca_cycle:
  plan:
    - Define ISMS scope and boundaries
    - Establish information security policy
    - Conduct risk assessment
    - Develop risk treatment plan
    - Produce Statement of Applicability
    - Obtain management approval and commitment
    - Define security objectives and metrics

  do:
    - Implement selected Annex A controls
    - Deploy technical security controls
    - Conduct security awareness training
    - Document all procedures and processes
    - Implement incident management process
    - Establish supplier security management

  check:
    - Conduct internal audits (at least annual)
    - Perform management review meetings
    - Monitor and measure control effectiveness
    - Review incident trends and near misses
    - Assess compliance with legal requirements
    - Evaluate security metrics against objectives

  act:
    - Address nonconformities with corrective actions
    - Implement continual improvement initiatives
    - Update risk assessment based on changes
    - Refine controls based on audit findings
    - Communicate improvements to stakeholders

ISMS Scope Definition

isms_scope:
  template:
    organization: "Company Name, Ltd."
    scope_statement: |
      The ISMS covers the design, development, operation, and support of
      the Company's cloud-based SaaS platform, including all supporting
      infrastructure, personnel, and processes at the following locations.

    included:
      locations:
        - "Primary office: 123 Main Street, City, Country"
        - "AWS us-east-1 and eu-west-1 regions"
        - "Remote workers accessing corporate systems"
      business_processes:
        - "Software development and deployment"
        - "Cloud infrastructure management"
        - "Customer data processing and storage"
        - "Customer support operations"
        - "Corporate IT and internal systems"
      information_assets:
        - "Customer data (PII, business data)"
        - "Source code and intellectual property"
        - "Employee personal data"
        - "Financial records"
        - "Security configurations and credentials"
      technology:
        - "AWS cloud infrastructure"
        - "SaaS application stack"
        - "Corporate IT systems (Google Workspace, Okta, Jira)"
        - "Development tools (GitHub, CI/CD pipelines)"

    excluded:
      - "Physical data center operations (inherited from AWS)"
      - "Third-party SaaS platforms beyond integration points"
    exclusion_justification: "Physical data center controls are inherited from AWS, which maintains its own ISO 27001 certification."

    interfaces:
      - "Customer API endpoints"
      - "Third-party integrations (payment processor, email provider)"
      - "AWS management plane"

Risk Assessment Process

risk_assessment:
  methodology:
    approach: "Asset-based risk assessment"
    risk_formula: "Risk = Likelihood x Impact"
    scale: "1-5 for both likelihood and impact (total 1-25)"

  likelihood_scale:
    1: "Rare - less than once per 5 years"
    2: "Unlikely - once per 2-5 years"
    3: "Possible - once per 1-2 years"
    4: "Likely - multiple times per year"
    5: "Almost Certain - monthly or more frequent"

  impact_scale:
    1: "Negligible - minimal operational impact, no data loss"
    2: "Minor - limited impact, small data exposure, <$10K cost"
    3: "Moderate - significant impact, data breach <1K records, <$100K cost"
    4: "Major - severe impact, large data breach, <$1M cost, regulatory action"
    5: "Critical - catastrophic, massive breach, >$1M cost, business viability at risk"

  risk_matrix:
    #        Impact: 1    2    3    4    5
    likelihood_5:  [5,  10,  15,  20,  25]
    likelihood_4:  [4,   8,  12,  16,  20]
    likelihood_3:  [3,   6,   9,  12,  15]
    likelihood_2:  [2,   4,   6,   8,  10]
    likelihood_1:  [1,   2,   3,   4,   5]

  risk_appetite:

…