![]()
CHAPTER 1: GENERAL
1.1 Scope of this guide
This guide provides instructions on the implementation of ISMS control requirements and on auditing existing control implementations to help organisations prepare for certification in accordance with ISO/IEC 27001.
The contents of this guide include the ISMS control requirements that should be addressed by organisations considering certification. Part 2 of this guide discusses each of the controls in Annex A of ISO/IEC 27001 from two different viewpoints:
•implementation guidance – what needs to be considered to fulfil the control requirements when implementing the controls from ISO/IEC 27001, Annex A. This guidance is aligned with ISO/IEC 27002, which gives advice on the implementation of the controls;
•auditing guidance – what should be checked, and how, when examining the implementation of ISO/IEC 27001 controls to ensure that the implementation covers the essential ISMS control requirements.
It is important to emphasise that this guide does not cover the implementation or auditing of the ISMS process requirements (the main body of ISO/IEC 27001). This is discussed in more detail in 1.3, Meeting ISO/IEC 27001 requirements.
1.2 Field of application
1.2.1 Usage
This guide is intended to be used by those involved in:
•designing, implementing and/or maintaining an ISMS;
•preparing for ISMS audits and assessments;
•carrying out internal ISMS audits and assessments1; and
•carrying out ISMS audits and assessments of other organisations.
This guide makes reference to the following standards:
•ISO/IEC 27001 – the requirements specification for an ISMS. This International Standard is used as the basis for accredited certification.
•ISO/IEC 27002 – a reference for selecting controls as part of the implementation of an ISMS, and a guidance document for organisations implementing commonly accepted security controls.
This guide will be updated following any changes to these standards. Organisations should therefore ensure that the correct version is being used for compliance checks related to pre-certification, certification and post-certification purposes.
1.2.2 Compliance
To claim compliance with the requirements of ISO/IEC 27001, the organisation needs to demonstrate that it has all the processes in place and provides appropriate objective evidence to support such claims. Any exclusion of controls found to be necessary to satisfy the risk acceptance criteria needs to be justified. Evidence also needs to be provided that the associated risks have been knowingly and objectively accepted by those in management who have the executive responsibility and are accountable for making such decisions.
Excluding any of the requirements specified in ISO/IEC 27001, Clauses 4–10 is not acceptable.2
The implementation of ISMS processes results in the organisation deploying a system of controls based on a risk management approach to manage its risks. The organisation should have implemented an effective system of management controls and processes as part of its ISMS, and should be able to demonstrate this by providing evidence to the ISMS auditor (whether it be a first-, second- or third-party audit).
This guide can be used by those who might not have an immediate need for an audit, but require a specification for establishing and implementing an ISMS based on industry accepted best practice processes. However, claiming compliance with ISO/IEC 27001 does require the organisation to have at least an internal ISMS audit in place, whether or not it goes for a third-party audit at a later stage. The organisation may not have a business case for a third-party audit, but in order to be compliant with ISO/IEC 27001, an internal ISMS audit process is mandatory. This guide can, of course, also be used by those preparing for a second-party or third-party audit.
1.3 Meeting ISO/IEC 27001 requirements
ISO/IEC 27001 has two main parts:
•the requirements for processes in an ISMS, which are described in Clauses 4–10 (the main body of the text); and
•a list of ISMS controls, which is given in Annex A. These controls are described in more detail in ISO/IEC 27002.
The ISMS process requirements address how an organisation should establish and maintain its ISMS. An organisation that wants to achieve ISO/IEC 27001 certification needs to comply with all of these requirements – exclusions are not acceptable.
The ISMS controls listed in ISO/IEC 27001, Annex A are not mandatory. They are expected to be used as an aide-memoire to assist the organisation in identifying where it might have missed a risk or relevant security control in its risk assessment and creation of its risk treatment plan. This is stated in ISO/IEC 27001 as follows:
“The organisation shall… produce a Statement of Applicability that contains the necessary controls… and justification for inclusions, whether they are implemented or not, and the justification for exclusions of controls from Annex A.”
1 Auditors deployed by the organisation to carry out an internal ISMS audit, auditors from certification bodies and assessors from accreditation bodies engaged in assessing certification bodies.
2 See ISO/IEC 27001, 1.
![]()
CHAPTER 2: IMPLEMENTING AND AUDITING ISMS CONTROL OBJECTIVES AND CONTROLS
In this section, each of the control objectives and control requirements in ISO/IEC 27001, Annex A are discussed from implementation and auditing viewpoints, taking into account the implementation advice given for each control in ISO/IEC 27002, the code of practice for information security management. The complete control objectives from ISO/IEC 27002 are included in this document to clarify the requirements.
Readers are encouraged to read both the implementing and auditing sections to obtain a clear view of what is required and how it might be tested.
2.1 Information security policies (ISO/IEC 27001, A.5)
2.1.1 Management direction for information security (ISO/IEC 27001, A.5.1)
“Objective: To provide management direction and support for information security in accordance with business requirements and relevant laws and regulations.”
2.1.1.1 Policies for information security (ISO/IEC 27001, A.5.1.1)
“A set of policies for information security shall be defined, approved by management, published and communicated to employees and relevant external parties.”
Implementation guidance
Guidance on what an information security policy should contain can be found in ISO/IEC 27002, 5.1.1.
Organisational policies should be simple and to the point. It may not be appropriate to combine every level of policy into one document. In this case, the top level information security policy can easily refer to more detailed policies, e.g., using hyperlinks. Indeed, the top level policy should normally be capable of expression within a single piece of paper. It might also be part of a more general policy document. The top level information security policy should be distributed and communicated to all staff, and to all relevant external parties, e.g., others regularly working on the organisation’s premises.
The lower level policies should be available to appropriate staff as needed, dependent on their job function and the associated security requirements, and classified accordingly. The top level information security policy and several, or all, of the lower level policies could be delivered to staff within a security policy manual.
The information security policies should be subject to version control, and should be part of the ISMS documentation. It should be ensured that all those with responsibilities for information security have access to all necessary policies. Information security policies should also be made available to anyone with appropriate authorisation on request, and they should be protected from tampering and unintentional damage.
When an information security policy is distributed outside the organisation, it should be redacted, with any sensitive information that might have been contained in it removed before such distribution.
Auditing guidance
The top level information security policy does not need to be extensive, but should clearly state senior management’s commitment to information security, be under change and version control, and be signed by the appropriate senior manager. The policy should at least address the following topics:
•a comprehensible definition of information security, its overall scope and objectives;
•the reasons why information security is important to the organisation;
•a statement of top management’s support for information security;
•a summary of the practical framework for risk assessment, risk management and for selecting control objectives and controls;
•a summary of the security policies, principles, standards and compliance requirements;
•a definition of all relevant information security responsibilities (see also 2.2.1.1 below);
•reference to supporting documentation, e.g. more detailed policies; and
•how non-compliances and exceptions will be handled.
The auditor should confirm that the policy is readily accessible to all employees and all relevant external parties, and that it is communicated to all relevant persons, checking that they are aware of its existence and understand its contents. The policy may be a stand-alone statement or part of more extensive documentation (e.g. a security policy manual) that defines how the information security policy is implemented in the organisation. In general, most, if not all, employees covered by the ISMS scope will have some responsibility for information security, and auditors should review any declarations to the contrary with care.
The auditor should also confirm that the policy has an owner who is responsible for its maintenance (see also 2.1.1.2), and that it is updated appropriately following any changes affecting the information security requirements of the organisation, such as changes in the original risk assessment.
Topic-specific policies that underpin the top level policy should be clearly linked to the needs of their target group(s), and cover all topics that are necessary to provide a foundation for other security controls.
2.1.1.2 Review of the policies for information security (ISO/IEC 27001, A.5.1.2)
“The policies for information security shall be reviewed at planned intervals or if significant changes occur to ensure their continuing suitability, adequacy and effectiveness.”
Implementation guidance
This control forms an important part of the continuous maintenance, review and updating of the ISMS, which is also addressed in Clause 9 of ISO/IEC 27001 ‘Performance evaluation’.
This maintenance process should detect all changes that affect th...
