ISMS for NRENs: Risk treatment & Selection of Controls

Inputs/prerequisites/requirements

• Understand the context and internal and external requirements of the organisation (ISO/IEC 27001 section 4)
• A defined risk management process (ISO/IEC 27001 section 6)

The model for an ISMS as set out in these documents and ISO/IEC 27001 is just a model, and it not intended to be proscriptive. You can make  some decisions related to controls without having first used your risk management process. You might do this when thinking about the overall control set or controls needed to meet customer requirements. It is equally as valid to perform a complete risk assessment before considering control sets and risk treatment options. You may also require:

• A completed risk assessment, analysis of the identified risks and prioritisation (ISO/IEC 27001 §6.1.2)
• A list of risk owners

If this is not first time you are thinking about controls then you will need to take into account:

• The effectiveness of previously selected controls
• The results of previous risk assessments
• The evaluation of monitoring and measuring activities

This page aims to address ISO/IEC 27001 §6.1.3 Information Security Risk Treatment

i.e. select treatment options (not necessarily controls - e.g. accept, insure, stop certain activities/behaviour, etc.), determine applicable controls to mitigate risk (ref lists below), produce a statement of applicability for implementing the controls. 

Control sets

You will need to decide on what set of controls is most appropriate to use in your organisation. It is from this set that you will select the controls necessary to control risks, and meet internal and external requirements. Sets of controls include:

• ISO/IEC 27001:2013 Annex A
• CIS Critical Security Controls
• The Australian "Essential Eight" maturity model (technical controls)

There may be also be controls specific for your country. The UK specifies five controls for basic cyber hygiene in the Cyber Essentials standard, and controls/objectives for operators of essential services under the NIS Directive are published by NCSC.

Domains and activities may also have their own control sets: scientific collaboration environments have https://www.eugridpma.org/sci/, telecommunications sector ISO/IEC 27011, and cloud computing ISO/IEC 27017

ISO/IEC 27001:2013 allows for the selection of controls from any source (you can also create your own controls). However, you must justify the exclusion of any controls from Annex A which you have chosen not to implement, and ensure that no necessary controls from Annex A are overlooked.

Consequently most organisations will chose Annex A as their normal set of controls, with additional controls chosen for particular business requirements. It is unusual for an organisation to do something different to this.

Prioritisation/Triage

When establishing an ISMS, the number of controls you need to implement may be overwhelming. It is advisable to focus on the controls needed to address the biggest risks, or that provide the greatest overall reduction in risk, and then come back to other controls at a later stage. Your NREN is also likely to have existing controls in place, particularly around the operation and monitoring of the network. A good tip is to remember that it is not necessary to get things complete or perfect at the outset - this is what continual improvement is for.

Presentation / A framework for linking controls to risk

ISO/IEC 27001:2013 Annex A can be overwhelming to our colleagues. It is a very technical and bureaucratic list of things that must be done with no direct relationship to the organisation's objectives, activities, and risks. You may need to think about how you present controls within your organisation. You could group your selected controls by

• Activities: running a data centre, operating a network, administering a server
• Risks: fire, theft, hacking, malware
• Business units: financial, human resources, operations

It is helpful to get input from a wide variety of sources at all levels within your organisation who can present different perspectives and expertise on the choice and implementation of controls. It can be too easy just to focus on the inputs of more technical colleagues.

Selection

All controls must be selected for a reason. The core reason in ISO 27001 is to address a specific risk. The control must do something to reduce the risk.

Controls may also be selected because a customer has asked you to implement it, or because a law or regulation requires it. You should try to understand these external factors in Section 4 of the standard. Selected controls should be implemented in a lawful manner.

Effectiveness

Your selection of controls must be practical for your organisation and staff to implement and manage, otherwise they will not be effective at reducing risk. You should think about how you will monitor and measure the controls as set out in section 9 of the standard.

Risk treatment options

Not all risks need to be controlled. Some may be acceptable, some can be insured against, or the activity leading to the risk can be stopped. You should pick the most acceptable treatment option, but it is likely that in most cases you will chose to control the risk.

Cost

ISO/IEC 27001 does not going into detail on the costs of implementing controls, but controls should be appropriate. You should assume this includes the cost of controls. The cost of a control should be less than the expected loss of the risk it is attempting to control. In practice it should much less than this. 

Training/Awareness

It is sensible to provide training to those responsible for implementing, managing, or monitoring controls. This should cover the reasons why the controls are implemented, how they are intended to reduce risk, and the different ways in which the control can be implemented. It cab be a useful way to get feedback on the suitability of controls. Consider making this training available to your internal auditors.

Risk acceptance

The selection of controls to treat risks must be accepted by risk owners, and they must also accept any residual risk remaining after treatment. You must have a risk treatment plan that details the risks, selected controls, acceptance by the risk owner, and the implementation of the control (or not - it is fine to have selected a control but not yet implemented it). 

Statement of applicability

ISO/IEC 27001 requires that you produce a statement of applicability (SoA). It must contain the necessary controls (those you have chosen and Annex A), detail the controls you have selected and why, and the justification for controls you have excluded from Annex A. Many organisations decide to provide internal and external facing SoAs with different levels of confidential information. Your SoA must be subject to version control.

SOA - Template

Outputs

• Risk treatment plan
• Statement of applicability
• An understanding of residual risk after control selection