ISO 27001 - Monitoring Efficacy & Continuous Improvement

1. Leadership Support
2. Scope Definition and Statement of Applicability
3. Mandatory ISO requirements: Clauses 4-10
4. Needs and Expectations of Interested Parties
5. Risk Management
6. Annex A controls
7. Best practices for Training and Awareness

Documenting Continuous Improvements

Clause 10 of ISO 27001 requires a process to "continually improve the suitability, adequacy, and effectiveness of the information security management system." The best way to comply with this obligation is to document your Continuous Improvement Process.

Opportunities for improvement can come from a variety of sources, both internal and external:

• Client requests

• Industry best practices

• Internal suggestions

• New risks

• Internal Audits

• External Audits

Continuous improvement projects can also emerge from non-conformities as well as the subsequent corrective or preventive actions. In this case, the lack of conformity might be seen as an opportunity to improve a process, policy, or tool. This does not mean simply fixing problems as they occur or that risk must be continually reduced. Instead, continual improvement requires measuring the effectiveness and efficiency of technology, people, and processes and adapting to inevitable changes in the environment technical and organizational, at planned intervals.

Below are the steps which you can take to identify areas of improvement and incorporate your adjustments:

• Identify new elements or opportunities for improvement.

• Allocate responsibility for implementing change.

• Identify, analyze and evaluate (based on cost vs. benefit) possible solutions.

• Plan implementation of changes devise your remediation/improvements.

• Execute your improvements.

• Measure effectiveness of actions.

Maturity Model

The Capability Maturity Model (CMM) is a practical tool to monitor your ISMS's effectiveness and analyze if improvements are required. This capability maturity model can measure the maturity of your controls and assist in their development as they progress from the initial/ad-hoc stage to an optimized state.

To identify opportunities for improvement, you can continuously monitor the security of your systems and their operational performance in the following areas:

• Annex A controls

• Policies

• Procedures

• ISMS objectives

You can assign CMM attributes to each one of the items listed above. The classification scheme is:

1. Initial/Ad Hoc - control poorly deployed with non-documented strategies, manual management processes, and lack of integration with the other controls and systems.

2. Repeatable - processes supported by informal documentation and performed by personnel with mixed skill levels.

3. Defines - strategic management structure in place with well-defined documented processes supported by a trained team.

4. Managed - processes and controls aligned with the organizational strategic objectives.

5. Optimized - process performed at an optimal level and continuously monitored by top management.

Summary

One of the driving goals of any ISO Standard is the principle of continual improvement. Being able to demonstrate how you can continuously improve your ISMS is not only a requirement, but a huge advantage to having an ISO 27001 certified management system.

As your ISMS scales with your growing organization, auditors would expect you to revise your controls and policies as the system matures or when a new process is implemented to identify opportunities for improvement. Determining if and how your organization identifies improvement opportunities and system underperformance is essential to the longevity of your program. You can analyze data output from operational processes, maturity evaluation, audits, stakeholder review, and client suggestions to plan and deploy the necessary changes in the form of corrective and preventive actions.

How Can StandardFusion Help?

StandardFusion streamlines the management of ISO 27001 requirements and the continual improvement process. You can create a centralized database of your controls and policies, and attribute the stage of maturity to each of your mitigating controls. Once an opportunity for improvement is identified, you can create a task with the corresponding corrective/preventive work, assign them accordingly, track progress and upload any necessary documents. StandardFusion can give you an overview of all completed and pending actions associated with your continual improvement program. Connect with our team today and see how simple it is to develop, manage and monitor your ISO 27001 compliant ISMS with StandardFusion.

Guide to ISO 27001

Part 1: Implementation & Leadership Support
Part 2: Establishing Scope and Creating the Statement of Applicability
Part 3: Mandatory Clauses
Part 4: Understanding & Communicating with Stakeholders
Part 5: Risk Management
Part 6: Defining Controls
Part 7: Competence, Training and Awareness
Part 8: Monitoring Efficacy & Continuous Improvement