should be plainly evident (painfully obvious!) from the documentation that the ISMS is in normal operation, business-as-usual. Simply convince the certification auditors that the ISMS is operating sweetly. Information should be generated routinely by the risk assessment process noted in section 6.1.2. Examples include risk assessment reports, risk metrics, prioritized lists of risks, information risk inventories or catalogs or information Specified risk entries in corporate risk inventories/catalogs etc. You may have meeting 8.2 Risk assessment In draft notices/invitations, minutes of meetings, risk workshop reports, rough notes results Done from discussions arising, formal memoranda, emails expressing concerns about certain risks, or whatever. Again, collate sufficient material evidence to reassure the auditors that the process is generating useful outputs about information risks. How are you going to prove that identified information risks are being ‘treated’ in accordance with the process and decisions made? Your Risk Treatment Plan might usefully reference evidence/records confirming that risks have been and are being duly treated, such as control test reports, penetration test reports, control implementation project plans plus milestones and closure documents, Specified 8.3 Risk treatment purchasing and financial records for capital expenditure, metrics showing a In draft results reduction in the frequency and/or severity of the corresponding incidents etc., Done emails from management management review and audit reports, congratulating the ISMS team and awarding large bonuses etc. Particularly where substantial risks are accepted (including residual risks), there should be evidence such as signatures of the relevant risk or asset owners formally acknowledging that (thereby accepting accountability for any incidents arising!). The ISMS generates various metrics that are used to monitor and Specified information risks, controls and the ISMS itself in the intended direction. 9.1 Metrics In Evidence here includes security metrics in reports, systems, dashboards, Done presentations etc., plus proof that the metrics are being duly noted and acted upon e.g. memos, emails or rough notes expressing concern about adverse
should be plainly evident (painfully obvious!) from the documentation that the ISMS is in normal operation, business-as-usual. Simply convince the certification auditors that the ISMS is operating sweetly. 8.2 Risk assessment results Specified In draft Done Information should be generated routinely by the risk assessment process noted in section 6.1.2. Examples include risk assessment reports, risk metrics, prioritized lists of risks, information risk inventories or catalogs or information risk entries in corporate risk inventories/catalogs etc. You may have meeting notices/invitations, minutes of meetings, risk workshop reports, rough notes from discussions arising, formal memoranda, emails expressing concerns about certain risks, or whatever. Again, collate sufficient material evidence to reassure the auditors that the process is generating useful outputs about information risks. 8.3 Risk treatment results Specified In draft Done How are you going to prove that identified information risks are being ‘treated’ in accordance with the process and decisions made? Your Risk Treatment Plan might usefully reference evidence/records confirming that risks have been and are being duly treated, such as control test reports, penetration test reports, control implementation project plans plus milestones and closure documents, purchasing and financial records for capital expenditure, metrics showing a reduction in the frequency and/or severity of the corresponding incidents etc., management review and audit reports, emails from management congratulating the ISMS team and awarding large bonuses etc. Particularly where substantial risks are accepted (including residual risks), there should be evidence such as signatures of the relevant risk or asset owners formally acknowledging that (thereby accepting accountability for any incidents arising!). 9.1 Metrics Specified In Done The ISMS generates various metrics that are used to monitor and information risks, controls and the ISMS itself in the intended direction. Evidence here includes security metrics in reports, systems, dashboards, presentations etc., plus proof that the metrics are being duly noted and acted upon e.g. memos, emails or rough notes expressing concern about adverse
ISO27k_ISMS_Mandatory_documentation_checklist_release_1v1.docx