Professional Documents
Culture Documents
IMS-Smart Limited
https://ims-smart.com
dbrewer@ims-smart.com
Agenda
Introductory remarks
The new ISO directives
Understanding the new requirements
Transitioning to the new management system standards
Summary
Useful properties
Order of implementation is irrelevant
Useful properties
Order of implementation is irrelevant
Effectively all requirements must be satisfied
simultaneously
No duplicate requirements
IMS-Smart Limited, 2013
Discipline-specific text
Only appears in ISO/IEC 27001:2013
Deviations
Changes to identical
An addition
core text
Registered with ISO
Technical Management A deletion
Board)
Definitions
Take care
There are lots of new definitions, e.g.
Extract from ISO/IEC Directives, Part 1, Consolidated ISO Supplement, 4th edition, Appendix 2 to Annex SL
Many are taken from Annex SL and ISO 31000 and are not in ISO/IEC
27000:2012, but they will be in the next version, due imminently
If not in ISO/IEC 27000:2013, use the Oxford English Dictionary
Cant wait: they are all in An introduction to ISO/IEC 27001:2013,
plus explanations
Process orientated
Continual improvement
Corrective and
preventive action
Procedure orientated
2012
Entire MS is preventive
Issues, risks and opportunities
What not HOW
High level structure
Identical core text
1994
1979
IMS-Smart Limited, 2013
BS 7799-2:2002 (ISO/IEC
27001:2005) based on
ISO 9001:2000
Explanation
Interested parities
Replaces stakeholders
Leadership
Communication
There are explicit requirements for both internal and external communications
Information security objectives are now to be set at relevant functions and levels
Risk assessment
Risk owner
The effectiveness of the risk treatment plan is now regarded as being more important than the
effectiveness of controls
Controls
Controls are now determined during the process of risk treatment, rather than being selected
from Annex A
Documented information
Performance evaluation
Continual improvement
Background
Practical experience of transitioning a real ISMS
Work performed in support of the development of IO/IEC 27001:2013
Sabrina Feng, Head Risk & Security, AXA Group Solutions
David Brewer, IMS-Smart Limited
Types of change
Areas where changes may be minimal
Areas that potentially require a rethink
Areas requiring updating
New requirements that may be already satisfied
New requirements that may present a challenge
Policy
Risk assessment
Control of documentation
Terms of reference for top management
Responsibilities
Awareness
Internal audit
Management review
Corrective action
Improvement
At relevant functions
and levels, e.g.
Policy
ISMS process and risk
treatment plan
Management action
Need to define responsibilities
and target dates
Deleted requirements
Clause (in ISO/IEC
Deleted requirement
27001:2005)
4.3.3
5.2.1(b)
5.2.1(d)
6(d)
8.2
4.2.3(h)
8.3
8.3(d)
4.3.1
8.3(e)
4.3.1
4.3.1(c)
8.3(e)
4.3.2
4.2.1(g)
4.2.1(i)
4.2.3(a)(1)
4.2.3(a)(2)
4.2.3(a)(4)
4.2.3(a)(5)
Summary
Summary
All new and revised management system standards, e.g. ISO/IEC 27001,
must conform to new high level structure and identical core text
Greater clarity, what not how, no duplications
Purpose built for integrated management systems
Latest leap in the evolution of MSS 4th generation
New and updated concepts, read the definitions carefully
Practical advice on transitioning (the transition guide)
Good supporting documentation
IMS-Smart Limited
https://ims-smart.com
dbrewer@ims-smart.com