ISO/IEC 27001 pdf download – lnformation technology -Securitytechniques – Information security management systems —Requirements.
4.2.2 Implement and operate the ISMS The orgamzation shall do the following.
at Formulate a tisk treatment plan that Identifies the appropriate management action, resources, responsibdities and priorities for managing information secur4y risks (see 5)
b) Implement the nsk treatment plan in order to achieve the identified control obecbves, which includes consideration of funding and allocation of roles and responsibilitees
c) Implement controls selected in 4.2.lg) to meet the control objectives.
dl Define how to measure the effectiveness of the selected controls or groups of controls and specify how these measurements are to be used to assess control effectiveness to produce compab4e and reproducible results (see 42.3c)).
NOTE: Measuring the effecbveness of conlrois allows nianagers and staff to determine how well controls adhieve piarvied control obectives
a) Implement training and awareness programmes (see 5.22).
I) Manage operation of the ISMS.
g) Manage resources for the ISMS (see 5.2).
h) Implement procedures and other controls capable of enabling prompt detection of security events and
response to security incidents (see 4.2.3a)).
4.2.3 MonItor and revIew the SItS
The organization shall do the following.
a) Execute monitoring and reviewing procedures and other controls to:
1) promptly detect errors in the results of processing;
2) promptly identity attempted and successful security breaches and incidents;
3) enable management to determine whether the security activities delegated to people or implemented by Information technology are perforrnwig as expected;
4) help detect security events and thereby prevent secuflty incidents by the use of indicators; and
5) determine whether the actions taken to resoive a breach of security were efleclive.
b) Undertake regular reviews of the effectiveness of the ISMS (inckiding meeting ISMS policy and objectives, and review of security controls) taking into account resiits of security audits, incidents, results from effectiveness measurements, suggestions and feedback from all interested parties
c) Measure the effectiveness of controls to verify that security requiemants have been met.
d) Review risk assessments at planned intervals and review the residual risks and the Identified acceptable levels of nsks. taking into account changes to:
1) the organization;
2) technology;
3) business obectives and processes;
NOTE 1: Where the twin documented procedur& appears within this International Stwidard, this means that the procedure is established, doo,iniented, implemented arid maintained
NOTE 2: The estent of the ISletS documentation cat’ diftor frown one orwnizatcn to another owing to
– the size of the organization and the type of Its activities, and
– the scope and conmçlesity of time security requirements end the system belig maiaged,
NOTE 3: Documents and records may be In any form or type of medium.
4.3.2 Control of documents
Documents required by the ISMS shall be protected and controlled. A documented procedure shall be established to define the management actions needed to:
a) approve documents for adequacy prior to Issue;
b) renew and update documents as necessary and re-approve documents;
C) ensure that changes and the current revision status of documents we identwried:
d) ensure that relevant versions of applicable documents are available at points of use;
e) ensure that docmsnents remain legtle and readily identifiable;
f) ensure that documents are avadable to those mMt need them, and are transferred, stored and ultimately disposed of In accordance wth the procedures applable to their classdlcatlon,
gj ensure that documents of external origin are Identified;
h) ensure that the distribution of documents is controlled;
I) prevent the unintended use of obsolete documents, and
j) apply suitable identification to them if they are retained for any purpose.
4.3.3 Control of records
Records shall be established and maintained to provide evidence of conformity to requirements and the effectve operation of the ISMS They shall be protected and controlle& The ISMS shall tae account of any relevant legal or regulatory requirements and contractual obligations. Records shaM remain leble, readily identifiable and retnevable, The controls needed for the identification storage, protection, retneval, retention time and dispoeltion of records shall be documented and implemented
Records shall be kept of the performance of the process as outlined in t2 and of all occwrences of si,ificant security incidents related to the ISMS.
EXAMPLE
Examples of records we a visitors’ book, audit reports and completed access authorization forms.
ISO/IEC 27001 pdf download – lnformation technology -Securitytechniques – Information security management systems —Requirements
