The Statement of Applicability (SoA) lays out the information risk and security controls that are relevant and applicable to your organization’s ISMS, as determined by your risk assessments or as required by laws, regulations or good practice. Cross-reference them against the controls recommended in ISO/IEC 6.1.3 Information 27001 Annex A and ISO/IEDC 27002, plus any alternative/supplementary security risk Specified sources such as NIST SP800-53, ISO 31000, ISO/IEC 20000, ISO 22301 and 22313, treatment In draft IT-Grundschutz, the ISF Standard of Good Practice, assorted privacy laws and Done (d) Statement of principles etc. Clarify whether the controls recommended in ISO/IEC 27001 Applicability Annex A are in scope and appropriate to your organization, if not providing reasoned justifications (e.g. strategic management decisions, formally recorded) to convince the auditors that you haven’t simply neglected, ignored or arbitrarily excluded them. Again it is up to you to determine precisely what is appropriate for your organization, using clause 6.1.3 plus guidance from and ISO 31000. Risk treatment decisions (e.g. selecting treatments including applicable controls) and the actions arising (e.g. implementing the controls or sharing risks) may be an 6.1.3 Information integral part of the risk assessment process, or a distinct activity or phase. It security risk Specified could be a dedicated activity for information risk, or an integral part of treatment In draft enterprise risk management etc. Typical evidence includes a written policy Done and/or procedure for consistently deciding on and implementing appropriate Risk treatment information risk treatments. Convince the auditors that the process is operating process correctly by providing relevant reports, your Risk Treatment Plan, entries in etc. You may prefer some sort of list, matrix or your risk register, metrics database structure, a program or project plan, or something else to explain the process through which information risks are being or to be controlled 6.2 Information Specified The ISO requirement to documented information on the information “retain security In draft security objectives” is vague too, so once more you have some latitude. A good objectives and Done approach is to start with the organization’s high level business objectives, plans
6.1.3 Information security risk treatment (d) Statement of Applicability Specified In draft Done The Statement of Applicability (SoA) lays out the information risk and security controls that are relevant and applicable to your organization’s ISMS, as determined by your risk assessments or as required by laws, regulations or good practice. Cross-reference them against the controls recommended in ISO/IEC 27001 Annex A and ISO/IEDC 27002, plus any alternative/supplementary sources such as NIST SP800-53, ISO 31000, ISO/IEC 20000, ISO 22301 and 22313, IT-Grundschutz, the ISF Standard of Good Practice, assorted privacy laws and principles etc. Clarify whether the controls recommended in ISO/IEC 27001 Annex A are in scope and appropriate to your organization, if not providing reasoned justifications (e.g. strategic management decisions, formally recorded) to convince the auditors that you haven’t simply neglected, ignored or arbitrarily excluded them. 6.1.3 Information security risk treatment Risk treatment process Specified In draft Done Again it is up to you to determine precisely what is appropriate for your organization, using clause 6.1.3 plus guidance from and ISO 31000. Risk treatment decisions (e.g. selecting treatments including applicable controls) and the actions arising (e.g. implementing the controls or sharing risks) may be an integral part of the risk assessment process, or a distinct activity or phase. It could be a dedicated activity for information risk, or an integral part of enterprise risk management etc. Typical evidence includes a written policy and/or procedure for consistently deciding on and implementing appropriate information risk treatments. Convince the auditors that the process is operating correctly by providing relevant reports, your Risk Treatment Plan, entries in your risk register, metrics etc. You may prefer some sort of list, matrix or database structure, a program or project plan, or something else to explain the process through which information risks are being or to be controlled 6.2 Information security objectives and plans Specified In draft Done The ISO requirement to “retain documented information on the information security objectives” is vague too, so once more you have some latitude. A good approach is to start with the organization’s high level business objectives,
ISO27k_ISMS_Mandatory_documentation_checklist_release_1v1.docx