You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 16 Next »

This section should also cover ISO 27001 chapter 10: Improvement


A guide on how to establish and implement an ISMS and the run of your ISMS (the CISO's planning for the year)

To make a yearly plan:
The CISO should make his own plan, implement it in the company,  check internal (f.i. business) external (f.i. law) changes, check compliancy and make a plan for the next year to implement findings out of the evaluation.  

1.1 Security Activities

ActivityReasonResultDateReference to Security goals in the ISMS

Status*

Implement IDSsee an increase of attacksEarly warning of an attack2 august 2018Goal nr. 2 to detect and react and mitigate security attacksIn progress






1.2 Plan for Risk assessment

DepartmentAreaDate

Status*

AccountingLogical Acces11 November 2017Planned




1.3 Awareness and Security training

Department/roleTrainingDate

Status

AllHow to detect phishing4 October 2017Completed




1.4 Internal Audit

DepartmentType of AuditDue date

Status

H.R.Questionaire18 april 2018Planned




1.5 Annual management report

Due date for reportDue date for management review

Status

30th november 201714th december 2017In progress




Establish an ISMS

what's needed to be planned is; 

  • what will be done
  • what resources will be required
  • who will be responsible
  • when it will be completed
  • how the results will be evaluated (art. 6.2 of ISO. 27.001)


Implement an ISMS


Run your ISMS

What kind of planning, measurements will you have in place when the ISMS is in place.


Evaluate your ISMS
What have I learned

What's needed to be planned and put under the points above; 

  • Make a risk registry
  • Make a risk inventory 
  • Make sure that you have an asset inventory
  • Risk assessments
  • Make sure you have a Risk Treatment
  • Awareness training
  • Plan a security training
  • Plan to make policies
  • Check compliance with policies
    • Reviewing
    • Auditing


To put in: Security by Design - What to look at when you have a new product or service run.


Legend
Status
Planned
In progress
Completed
Cancelled
  • No labels