ISO 27000 FAQs

ISO27k FAQ quick links

• Information security vs. IT security
• Do the ISO27k standards only apply to IT?
• Must we involve members from all aspects of the business in the ISMS?
• Learning more about the ISO27k standards
• Where can I obtain [insert name of ISO27k standard here]?
• Is there a book or college that teaches ISO27k, or an exam?
• Are there any qualifications for ISO27k?
• ISO/IEC acronyms
• What does “ISO” mean? And what about “ISO/IEC”?
• What do “WD”, “CD”, “FDIS” and other ISO/IEC acronyms mean?
• What is “JTC/1 SC27” and what are “WG’s”?
• Keeping up with security standards developments
• How can I keep up with developments to ISO27k?
• How can I get involved in the development of security standards?
• Can I see and contribute to draft ISO27k standards?
• Getting started on your ISO27k implementation
• Should we aim for ISO27k conformance, alignment, compliance or certification?
• How many man-years are needed to implement an ISMS?
• Is it necessary to appoint an Information Security Manager?
• If we limit the scope of our ISMS, how do we treat out-of-scope risks?
• What are the differences between SOA, RTP and AP?
• What does an RTP look like?
• What kinds of things should be included in our asset inventory?
• Should the risk assessment process cover all our information assets?
• ISMS documentation
• What documents are normally part of an ISMS?
• What format and style is appropriate for ISMS documentation?
• What should our [information] security policy cover?
• How can I make ISO/IEC 27002 reflect the reality of our controls?
• How big should our policies be - one page or a whole manual?
• Maturing your ISMS
• What Content Management System should we use for the ISMS?
• Is control X mandatory [for various values of X]?
• Which laws & regs do we need to comply with?
• What should the ISMS implementation project manager do to succeed?
• What ISMS metrics should we measure?
• Information security risk analysis and management
• Which information security risk analysis/GRC methods/tools are there?
• How should I choose a risk analysis tool or method?
• How should management define the organization’s risk appetite?
• The ISO/IEC 27001 certification process
• How does my organization get certified against ISO/IEC 27002?
• OK then, how do we get certified against ISO/IEC 27001?
• What is really involved in becoming ISO/IEC 27001 certified?
• Will the controls we already have be sufficient for certification?
• Who can certify us against ISO/IEC 27001?
• How does the certification process work?
• Why isn’t there a simple checklist we can follow?
• ISMS internal audits and certification audits
• What considerations should we take into account for the ISMS internal audits?
• How can we confirm the implementation of controls in the SOA?
• Will the certification auditors check our information security controls?
• How will the certification auditors check our ISMS internal audit processes?
• What do we need to prepare for a recertification audit?
• Information security glossary [opens in a separate browser tab]

Download the FAQ as a PDF

(It’s better for printing but lacks many of the hyperlinks and is months out of date, sorry)

Source