Conformidade com a ISO 27001

Implemente um Sistema de Gestão de Segurança da Informação (SGSI) alinhado com a ISO/IEC 27001:2022.

Quando Usar

• Estabelecendo um SGSI pela primeira vez em uma organização
• Preparando-se para auditoria de certificação ISO 27001
• Realizando avaliações de risco e desenvolvendo planos de tratamento de risco
• Criando a Declaração de Aplicabilidade (SoA)
• Transicionando da ISO 27001:2013 para a revisão de 2022
• Atendendo a requisitos de clientes ou regulatórios para certificação ISO 27001

Ciclo PDCA do SGSI

pdca_cycle:
  plan:
    - Define ISMS scope and boundaries
    - Establish information security policy
    - Conduct risk assessment
    - Develop risk treatment plan
    - Produce Statement of Applicability
    - Obtain management approval and commitment
    - Define security objectives and metrics

  do:
    - Implement selected Annex A controls
    - Deploy technical security controls
    - Conduct security awareness training
    - Document all procedures and processes
    - Implement incident management process
    - Establish supplier security management

  check:
    - Conduct internal audits (at least annual)
    - Perform management review meetings
    - Monitor and measure control effectiveness
    - Review incident trends and near misses
    - Assess compliance with legal requirements
    - Evaluate security metrics against objectives

  act:
    - Address nonconformities with corrective actions
    - Implement continual improvement initiatives
    - Update risk assessment based on changes
    - Refine controls based on audit findings
    - Communicate improvements to stakeholders

Definição do Escopo do SGSI

isms_scope:
  template:
    organization: "Company Name, Ltd."
    scope_statement: |
      The ISMS covers the design, development, operation, and support of
      the Company's cloud-based SaaS platform, including all supporting
      infrastructure, personnel, and processes at the following locations.

    included:
      locations:
        - "Primary office: 123 Main Street, City, Country"
        - "AWS us-east-1 and eu-west-1 regions"
        - "Remote workers accessing corporate systems"
      business_processes:
        - "Software development and deployment"
        - "Cloud infrastructure management"
        - "Customer data processing and storage"
        - "Customer support operations"
        - "Corporate IT and internal systems"
      information_assets:
        - "Customer data (PII, business data)"
        - "Source code and intellectual property"
        - "Employee personal data"
        - "Financial records"
        - "Security configurations and credentials"
      technology:
        - "AWS cloud infrastructure"
        - "SaaS application stack"
        - "Corporate IT systems (Google Workspace, Okta, Jira)"
        - "Development tools (GitHub, CI/CD pipelines)"

    excluded:
      - "Physical data center operations (inherited from AWS)"
      - "Third-party SaaS platforms beyond integration points"
    exclusion_justification: "Physical data center controls are inherited from AWS, which maintains its own ISO 27001 certification."

    interfaces:
      - "Customer API endpoints"
      - "Third-party integrations (payment processor, email provider)"
      - "AWS management plane"

Processo de Avaliação de Risco

risk_assessment:
  methodology:
    approach: "Avaliação de risco baseada em ativos"
    risk_formula: "Risco = Probabilidade x Impacto"
    scale: "1-5 para probabilidade e impacto (total 1-25)"

  likelihood_scale:
    1: "Raro - menos de uma vez a cada 5 anos"
    2: "Improvável - uma vez a cada 2-5 anos"
    3: "Possível - uma vez a cada 1-2 anos"
    4: "Provável - várias vezes por ano"
    5: "Quase Certo - mensalmente ou com mais frequência"

  impact_scale:
    1: "Desprezível - impacto operacional mínimo, sem perda de dados"
    2: "Menor - impacto limitado, pequena exposição de dados, custo <$10K"
    3: "Moderado - impacto significativo, violação de dados <1K registros, custo <$100K"
    4: "Maior - impacto severo, grande violação de dados, custo <$1M, ação regulatória"
    5: "Crítico - catastrófico, violação massiva, custo >$1M, viabilidade do negócio em risco"

  risk_matrix:
    #        Impacto: 1    2    3    4    5
    likelihood_5:  [5,  10,  15,  20,  25]
    likelihood_4:  [4,   8,  12,  16,  20]
    likelihood_3:  [3,   6,   9,  12,  15]
    likelihood_2:  [2,   4,   6,   8,  10]
    likelihood_1:  [1,   2,   3,   4,   5]

  risk_appetite:

…