ISO/IEC 27001 is one of the most widely recognized frameworks adopted by organizations worldwide. Even if your career path isn’t directly aligned with GRC, having a solid understanding of ISO 27001 is highly beneficial.
This standard was developed to define the requirements an Information Security Management System (ISMS) must meet. It provides organizations with a structured approach to establishing, implementing, and continuously improving their ISMS.
Compliance with ISO 27001 is crucial for organizations as it demonstrates their commitment to data protection, risk management, and cybersecurity best practices. Adhering to this standard ensures that businesses have robust security measures in place, effectively managing threats while aligning with international best practices.
THE ISO 27001: 2022 comprises of 4 controls
a) Organizational controls, the general name for other details that don’t fall under people, physical, or technological
b) People controls, if it concerns people
c) Physical controls, if it concerns physical objects or things
d) Technological controls deal with technologies
Also has Annexes A and B
ISO DOMAIN CHECKLIST
A.5 Information security policies
A.6 Organization of information security
A.7 Human resource security
A.8 Asset management
A.9 Access control
A.10 Cryptography
A.11 Physical and environmental security
A.12 Operations security
A.13 Communications security
A.14 System acquisition, development, and maintenance
A.15 Supplier relationships (vendor and third-party)
A.16 Information security incident management
A.17 Information security aspects of business continuity management
A.18 Compliance
POLICY WRITING IN COMPLIANCE WITH ISO 27001
When writing a policy in alignment with the ISO framework, start by identifying the subject of the policy and reviewing the relevant domain within ISO standards to determine where it fits. This ensures that your policy is structured according to the appropriate guidelines.
For instance, if you’re tasked with drafting an Access Control policy or reviewing an existing policy for gap analysis, refer to ISO 27001 Section A.9 (Access Control) as a primary source.
If you are writing a Vendor or Third Party-related Policy, you should consider Section A:15 of the ISO 27001 to draw out needed information.
Additionally, other GRC frameworks may also guide access control. It’s essential to cross-reference these frameworks and incorporate relevant standards to strengthen your policy.
That said, which other GRC frameworks address Access Control?
Any policy involving data must comply with GDPR, and other local policies involving data processing in your country should be added.
DIFFERENT TYPES OF ISO AS RELATED TO GRC
- ISO 37000 — Governance of Organizations (Provides principles and practices for effective governance).
- ISO 38500 — Corporate IT Governance (Guidelines for governing IT in organizations).
Risk-Related ISO Standards