4 Information security management system
4.1 General requirements
The organization shall establish, implement, operate, monitor, review, maintain and improve a documented ISMS within the context of the organization’s overall business activities and the risks it faces. For the purposes of this International Standard the process used is based on the PDCA model shown in Figure 1.
4.2 Establishing and managing the ISMS
4.2.1 Establish the ISMS
The organization shall do the following.
a) Define the scope and boundaries of the ISMS in terms of the characteristics of the business, the organization, its location, assets and technology, and including details of and justification for any exclusions from the scope (see 1.2).
b) Define an ISMS policy in terms of the characteristics of the business, the organization, its location, assets and technology that:
- includes a framework for setting objectives and establishes an overall sense of direction and principles for action with regard to information security;
- takes into account business and legal or regulatory requirements, and contractual security obligations;
- aligns with the organization’s strategic risk management context in which the establishment and maintenance of the ISMS will take place;
- establishes criteria against which risk will be evaluated (see 4.2.1c)); and
- has been approved by management.
NOTE: For the purposes of this International Standard, the ISMS policy is considered as a superset of the information security policy. These policies can be described in one document.
c) Define the risk assessment approach of the organization.
- Identify a risk assessment methodology that is suited to the ISMS, and the identified business information security, legal and regulatory requirements.
- Develop criteria for accepting risks and identify the acceptable levels of risk. (see 5.1f)).
The risk assessment methodology selected shall ensure that risk assessments produce comparable and reproducible results.
NOTE: There are different methodologies for risk assessment. Examples of risk assessment methodologies are discussed in ISO/IEC TR 13335-3, Information technology — Guidelines for the management of IT Security — Techniques for the management of IT Security.
d) Identify the risks.
- Identify the assets within the scope of the ISMS, and the owners2) of these assets.
- 2Identify the threats to those assets.
- Identify the vulnerabilities that might be exploited by the threats.
- Identify the impacts that losses of confidentiality, integrity and availability may have on the assets.
e) Analyse and evaluate the risks.
- Assess the business impacts upon the organization that might result from security failures, taking into account the consequences of a loss of confidentiality, integrity or availability of the assets.
- Assess the realistic likelihood of security failures occurring in the light of prevailing threats and vulnerabilities, and impacts associated with these assets, and the controls currently implemented.
- Estimate the levels of risks.
- Determine whether the risks are acceptable or require treatment using the criteria for accepting risks established in 4.2.1c)2).
f) Identify and evaluate options for the treatment of risks.
Possible actions include:
- applying appropriate controls;
- knowingly and objectively accepting risks, providing they clearly satisfy the organization’s policies and the criteria for accepting risks (see 4.2.1c)2));
- avoiding risks; and
- transferring the associated business risks to other parties, e.g. insurers, suppliers. g) Select control objectives and controls for the treatment of risks.
Control objectives and controls shall be selected and implemented to meet the requirements identified by the risk assessment and risk treatment process. This selection shall take account of the criteria for accepting risks (see 4.2.1c)2)) as well as legal, regulatory and contractual requirements.
The control objectives and controls from Annex A shall be selected as part of this process as suitable to cover the identified requirements.
The control objectives and controls listed in Annex A are not exhaustive and additional control objectives and controls may also be selected.
NOTE: Annex A contains a comprehensive list of control objectives and controls that have been found to be commonly relevant in organizations. Users of this International Standard are directed to Annex A as a starting point for control selection to ensure that no important control options are overlooked.
h) Obtain management approval of the proposed residual risks.
i) Obtain management authorization to implement and operate the ISMS.
j) Prepare a Statement of Applicability.
A. Statement of Applicability shall be prepared that includes the following:
1) the control objectives and controls selected in 4.2.1g) and the reasons for their selection;
2) the control objectives and controls currently implemented (see 4.2.1e)2)); and
3) the exclusion of any control objectives and controls in Annex A and the justification for their exclusion.
NOTE: The Statement of Applicability provides a summary of decisions concerning risk treatment. Justifying exclusions provides a cross-check that no controls have been inadvertently omitted.
4.2.2 Implement and operate the ISMS
The organization shall do the following.
a) Formulate a risk treatment plan that identifies the appropriate management action, resources, responsibilities and priorities for managing information security risks (see 5).
b) Implement the risk treatment plan in order to achieve the identified control objectives, which includes consideration of funding and allocation of roles and responsibilities.
c) Implement controls selected in 4.2.1g) to meet the control objectives.
d) Define how to measure the effectiveness of the selected controls or groups of controls and specify how these measurements are to be used to assess control effectiveness to produce comparable and reproducible results (see 4.2.3c)).
e) Implement training and awareness programmes (see 5.2.2).
f) Manage operation of the ISMS.
g) Manage resources for the ISMS (see 5.2).
h) Implement procedures and other controls capable of enabling prompt detection of security events and response to security incidents (see 4.2.3a)).
NOTE: Measuring the effectiveness of controls allows managers and staff to determine how well controls achieve planned control objectives.
4.2.3 Monitor and review the ISMS
The organization shall do the following.
a) Execute monitoring and reviewing procedures and other controls to:
- promptly detect errors in the results of processing;
- promptly identify attempted and successful security breaches and incidents;
- enable management to determine whether the security activities delegated to people or implemented by information technology are performing as expected;
- help detect security events and thereby prevent security incidents by the use of indicators; and
- determine whether the actions taken to resolve a breach of security were effective.
b) Undertake regular reviews of the effectiveness of the ISMS (including meeting ISMS policy and objectives, and review of security controls) taking into account results of security audits, incidents, results from effectiveness measurements, suggestions and feedback from all interested parties.
c) Measure the effectiveness of controls to verify that security requirements have been met.
d) Review risk assessments at planned intervals and review the residual risks and the identified acceptable levels of risks, taking into account changes to:
- the organization;
- business objectives and processes;
- identified threats;
- effectiveness of the implemented controls; and
- external events, such as changes to the legal or regulatory environment, changed contractual obligations, and changes in social climate.
e) Conduct internal ISMS audits at planned intervals (see 6).
NOTE: Internal audits, sometimes called first party audits, are conducted by, or on behalf of, the organization itself for internal purposes.
f) Undertake a management review of the ISMS on a regular basis to ensure that the scope remains adequate and improvements in the ISMS process are identified (see 7.1).
g) Update security plans to take into account the findings of monitoring and reviewing activities.
h) Record actions and events that could have an impact on the effectiveness or performance of the ISMS (see 4.3.3).
4.2.4 Maintain and improve the ISMS
The organization shall regularly do the following.
a) Implement the identified improvements in the ISMS.
b) Take appropriate corrective and preventive actions in accordance with 8.2 and 8.3. Apply the lessons learnt from the security experiences of other organizations and those of the organization itself.
c) Communicate the actions and improvements to all interested parties with a level of detail appropriate to the circumstances and, as relevant, agree on how to proceed.
d) Ensure that the improvements achieve their intended objectives.
4.3 Documentation requirements
Documentation shall include records of management decisions, ensure that actions are traceable to management decisions and policies, and ensure that the recorded results are reproducible.
It is important to be able to demonstrate the relationship from the selected controls back to the results of the risk assessment and risk treatment process, and subsequently back to the ISMS policy and objectives.
The ISMS documentation shall include:
a) documented statements of the ISMS policy (see 4.2.1b)) and objectives;
b) the scope of the ISMS (see 4.2.1a));
c) procedures and controls in support of the ISMS;
d) a description of the risk assessment methodology (see 4.2.1c));
e) the risk assessment report (see 4.2.1c) to 4.2.1g));
f) the risk treatment plan (see 4.2.2b));
g) documented procedures needed by the organization to ensure the effective planning, operation and control of its information security processes and describe how to measure the effectiveness of controls (see 4.2.3c));
h) records required by this International Standard (see 4.3.3); and i) the Statement of Applicability.
NOTE 1: Where the term “documented procedure” appears within this International Standard, this means that the procedure is established, documented, implemented and maintained.
NOTE 2: The extent of the ISMS documentation can differ from one organization to another owing to:
– the size of the organization and the type of its activities; and
– the scope and complexity of the security requirements and the system being managed.
NOTE 3: Documents and records may be in any form or type of medium.
4.3.2 Control of documents
Documents required by the ISMS shall be protected and controlled. A documented procedure shall be established to define the management actions needed to:
a) approve documents for adequacy prior to issue;
b) review and update documents as necessary and re-approve documents;
c) ensure that changes and the current revision status of documents are identified;
d) ensure that relevant versions of applicable documents are available at points of use;
e) ensure that documents remain legible and readily identifiable;
f) ensure that documents are available to those who need them, and are transferred, stored and ultimately disposed of in accordance with the procedures applicable to their classification;
g) ensure that documents of external origin are identified;
h) ensure that the distribution of documents is controlled;
i) prevent the unintended use of obsolete documents; and
j) apply suitable identification to them if they are retained for any purpose.
4.3.3 Control of records
Records shall be established and maintained to provide evidence of conformity to requirements and the effective operation of the ISMS. They shall be protected and controlled. The ISMS shall take account of any relevant legal or regulatory requirements and contractual obligations. Records shall remain legible, readily identifiable and retrievable. The controls needed for the identification, storage, protection, retrieval, retention time and disposition of records shall be documented and implemented.
Records shall be kept of the performance of the process as outlined in 4.2 and of all occurrences of significant security incidents related to the ISMS.
5 Management responsibility
5.1 Management commitment
Management shall provide evidence of its commitment to the establishment, implementation, operation, monitoring, review, maintenance and improvement of the ISMS by:
a) establishing an ISMS policy;
b) ensuring that ISMS objectives and plans are established;
c) establishing roles and responsibilities for information security;
d) communicating to the organization the importance of meeting information security objectives and conforming to the information security policy, its responsibilities under the law and the need for continual improvement;
e) providing sufficient resources to establish, implement, operate, monitor, review, maintain and improve the
ISMS (see 5.2.1);
f) deciding the criteria for accepting risks and the acceptable levels of risk;
g) ensuring that internal ISMS audits are conducted (see 6); and h) conducting management reviews of the ISMS (see 7).
5.2 Resource management
5.2.1 Provision of resources
The organization shall determine and provide the resources needed to:
a) establish, implement, operate, monitor, review, maintain and improve an ISMS;
b) ensure that information security procedures support the business requirements;
c) identify and address legal and regulatory requirements and contractual security obligations;
d) maintain adequate security by correct application of all implemented controls;
e) carry out reviews when necessary, and to react appropriately to the results of these reviews; and f) where required, improve the effectiveness of the ISMS.
5.2.2 Training, awareness and competence
The organization shall ensure that all personnel who are assigned responsibilities defined in the ISMS are competent to perform the required tasks by:
a) determining the necessary competencies for personnel performing work effecting the ISMS;
b) providing training or taking other actions (e.g. employing competent personnel) to satisfy these needs;
c) evaluating the effectiveness of the actions taken; and
d) maintaining records of education, training, skills, experience and qualifications (see 4.3.3).
The organization shall also ensure that all relevant personnel are aware of the relevance and importance of their information security activities and how they contribute to the achievement of the ISMS objectives.
6 Internal ISMS audits
The organization shall conduct internal ISMS audits at planned intervals to determine whether the control objectives, controls, processes and procedures of its ISMS:
a) conform to the requirements of this International Standard and relevant legislation or regulations;
b) conform to the identified information security requirements;
c) are effectively implemented and maintained; and d) perform as expected.
An audit programme shall be planned, taking into consideration the status and importance of the processes and areas to be audited, as well as the results of previous audits. The audit criteria, scope, frequency and methods shall be defined. The selection of auditors and conduct of audits shall ensure objectivity and impartiality of the audit process. Auditors shall not audit their own work.
The responsibilities and requirements for planning and conducting audits, and for reporting results and maintaining records (see 4.3.3) shall be defined in a documented procedure.
The management responsible for the area being audited shall ensure that actions are taken without undue delay to eliminate detected nonconformities and their causes. Follow-up activities shall include the verification of the actions taken and the reporting of verification results (see 8).
NOTE: ISO 19011:2002, Guidelines for quality and/or environmental management systems auditing, may provide helpful guidance for carrying out the internal ISMS audits.
7 Management review of the ISMS
Management shall review the organization’s ISMS at planned intervals (at least once a year) to ensure its continuing suitability, adequacy and effectiveness. This review shall include assessing opportunities for improvement and the need for changes to the ISMS, including the information security policy and information security objectives. The results of the reviews shall be clearly documented and records shall be maintained (see 4.3.3).
7.2 Review input
The input to a management review shall include:
a) results of ISMS audits and reviews;
b) feedback from interested parties;
c) techniques, products or procedures, which could be used in the organization to improve the ISMS performance and effectiveness;
d) status of preventive and corrective actions;
e) vulnerabilities or threats not adequately addressed in the previous risk assessment;
f) results from effectiveness measurements;
g) follow-up actions from previous management reviews;
h) any changes that could affect the ISMS; and
i) recommendations for improvement.
7.3 Review output
The output from the management review shall include any decisions and actions related to the following. a) Improvement of the effectiveness of the ISMS.
b) Update of the risk assessment and risk treatment plan.
c) Modification of procedures and controls that effect information security, as necessary, to respond to internal or external events that may impact on the ISMS, including changes to:
- business requirements;
- security requirements;
- business processes effecting the existing business requirements;
- regulatory or legal requirements;
- contractual obligations; and
- levels of risk and/or criteria for accepting risks. d) Resource needs.
e) Improvement to how the effectiveness of controls is being measured.
8 ISMS improvement
8.1 Continual improvement
The organization shall continually improve the effectiveness of the ISMS through the use of the information security policy, information security objectives, audit results, analysis of monitored events, corrective and preventive actions and management review (see 7).
8.2 Corrective action
The organization shall take action to eliminate the cause of nonconformities with the ISMS requirements in order to prevent recurrence. The documented procedure for corrective action shall define requirements for:
a) identifying nonconformities;
b) determining the causes of nonconformities;
c) evaluating the need for actions to ensure that nonconformities do not recur;
d) determining and implementing the corrective action needed;
e) recording results of action taken (see 4.3.3); and
f) reviewing of corrective action taken.
8.3 Preventive action
The organization shall determine action to eliminate the cause of potential nonconformities with the ISMS requirements in order to prevent their occurrence. Preventive actions taken shall be appropriate to the impact of the potential problems. The documented procedure for preventive action shall define requirements for:
a) identifying potential nonconformities and their causes;
b) evaluating the need for action to prevent occurrence of nonconformities;
c) determining and implementing preventive action needed;
d) recording results of action taken (see 4.3.3); and e) reviewing of preventive action taken.
The organization shall identify changed risks and identify preventive action requirements focusing attention on significantly changed risks.
The priority of preventive actions shall be determined based on the results of the risk assessment.
NOTE: Action to prevent nonconformities is often more cost-effective than corrective action.