Everything you need to know about ISO 27000

In this blog post, we'll cover:

• What is the ISO 27000 series?
• ISO 27000 framework: Summaries, scope, key elements
• How to implement ISO 27000 standards in your organisation?
• How to earn ISO 27000 certification? 
• How to manage information security the right way, and comply with ISO 27000

What is the ISO 27000 series? 

ISO  27000 is a set of standards that can facilitate an organisation’s development of a robust ISMS. Two international groups developed and published the standards:  

• The International Organisation for Standardization (ISO) 
• The International Electrotechnical Commission (IEC) 

Because both organisations collaborated to develop the standards, some documents refer to them as the ISO/IEC 27000 standards.  

These standards are not, in and of themselves, regulations. There is no legal mandate to comply with these standards, nor is compliance enforced by any professional organisation. 

But, the ISO and IEC designed the 27000 standards to help organisations meet the data security requirements set by federal and international laws, and professional governance groups. Specifically, using the ISO 27000 standards, an organisation is empowered to stay compliant with: 

• HIPAA 
• PCI DSS 
• GDPR 

HIPAA legally regulates the protection of private health data by setting security parameters for healthcare organisations and insurers. PCI DSS regulates the security practices of payment processing organisations. 

GDPR is broader. Any business or non-profit that stores the personal information of European citizens is subject to GDPR.  

If an organisation’s security is breached and it’s found out of regulation, the EU can impose fines of up to 18.7£ million (or 4% of a company’s yearly gross revenue—whichever is higher). 

Fortunately, if an organisation develops an ISMS by utilizing the ISO 27000 series standards, it’s more likely to stay compliant with each of these regulations. This compliance assurance is the key benefit of ISO 27000 certification.  

Information Security Management System (ISMS) 

The goal of a robust ISMS is to mitigate and manage two risks. The first is risk is to information. Any threat to information access one has a legal right to, and any threat to the confidentiality of personal information, is an information risk. 

The second is to mitigate and manage the risk of cybersecurity threats.  

A strong ISMS manages these risks with an array of tools. These tools cultivate optimal information-handling and interfacing practices, which improves the efficacy of an organisation’s information security—and its resistance to breaches.  Per the ISO  27000 standards, an ISMS incorporates: 

• Policies 
• Procedures  
• Workflows 

• Plans 
• Cultural norms 
• Cyber security and resilience objectives 
• Asset protection tools 
• Limits to unauthorized access 

• Supply chain risk management tools 

All tools facilitate compliance with legal and professional security regulations.  

ISO 27000 framework: Summaries, scope, key elements 

There are forty-six individual published standards within the ISO  27000 series. Each standard tackles one of the three pillars of information security:  

• People 

• Processes 
• Technology 

Every standard specifies the optimal practices regarding different facets of information security. Some standards apply broadly, while others specifically concern unique industries and types of organisations.  

This guide cannot go over all forty-six standards in detail. Instead, below, you can explore the highlights of the most widely-known and utilized standards.  

ISO  27000 (Introduction) 

ISO 27000 gives organisations an overview of the ISO 27000 series as a whole. It introduces the concept of the ISMS, and it describes its purpose. This standard is publicly available.  

Then, the ISO 27000 introduction offers a glossary. The glossary defines vocabulary terms that you'll use when implementing the standards.  

ISO 27001 

ISO 27001 was most recently updated in 2017. It provides requirements for the development of an Information Security Management System (ISMS). ISO 27001 includes content detailing: 

• Information security leadership 

• How to plan, support, and operate an ISMS 
• Performance evaluation metrics 
• Improvement processes 
• List of controls and objectives 

The ISO does not offer 27001 certification. Instead, you can find a legitimate certifying organisation using IAF Search. IAF is the International Accreditation Forum.  

ISO 27001 is not publicly available. But, there are publicly available related resources from certifying organisations. At DataGuard, we've created the ISO 27001 Implementation Roadmap, which is free to download.  

ISO 27002 

ISO 27002 standardizes information security controls. It outlines and details best practices for individuals and groups responsible for an organisation's ISMS. These practices: 

• Preserve confidentiality 
• Maintain data integrity 

• Ensure data availability (to authorized users)  

ISO 27002 covers security protocols in three layers. The first layer details best practices to establish or maintain in the organisation's physical environment. This includes physical data storage and access infrastructure. 

The second is human resource security. These practices ensure employees do not pose a threat to data security. 

The third is access control practices. These procedures standardize network design, access, and user practices when interfacing with data. 

ISO 27002 is not publicly available.  

ISO 27003 

ISO 27003 outlines and details security techniques for information technology. It focuses on the PDCA cycle. And, it articulates the best ways to apply the PDCA method when you establish or improve an ISMS.  

ISO 27004 

ISO 27004 focuses on developing assessments to measure how effective your organisation's ISMS is.    

Then, it outlines and details how to implement those assessments into your data security processes. This includes information on integrating monitoring tools effectively. 

ISO 27004 articulates best practices and metrics regarding performance measurement. This includes the best methods to analyze and evaluate your ISMS using data gathered through these measurement processes.  

ISO 27005 

ISO 27005 covers the best practices when assessing information security risks. It outlines and entails guidelines to develop, manage, and support information security risk management (ISRM) in an organisation.  

First, ISO 27005 defines the risk assessment process and key terms. Then, it notes: 

• Best information security risk treatment practices 

• Best information security risk acceptance practices 
• Best information security risk communication practices 
• Best information security risk monitoring and review practices 

It also provides examples of typical threats, and it offers specific vulnerability assessment tactics. ISO 27005 is not publicly available. 

ISO 27007 

ISO 27007 outlines and details the best practices when developing an ISMS audit program. It also details how to conduct audits. And, it offers guidance on determining the competence of ISMS auditors.  

ISO 27033 

ISO 270033 outlines and details best practices to ensure network security. Best practices include the practice of network architecture design, network security risk assessment and requirements, and network security controls. Network security applies to: 

• Security of devices 
• Security of device management activities 

• Applications and software services 
• End-user security protocols 
• Security of information in transit 

ISO 27033 is not solely relevant to network owners. It details secure procedures for who operates a network, including non-technical end-users.  

Other ISO  27000-Series Standards 

To learn more about other ISO  27000-series standards, explore ISO.org. or, talk to an information security expert.  

How to implement ISO 27000 standards in your organisation?

Implementing the ISO  27000 standards is a complex process. The complete implementation can take anywhere from three months to up to almost two years.  

Each standard within the ISO  27000 series comes with its own processes and checklist of practices an organisation must implement to comply effectively.  

For example, examine this implementation checklist for ISO 27001. Implementation follows a PDCA cycle. This stands for: 

• Plan 
• Do  
• Check 
• Act 

Develop your organisation's ISMS  

To develop your organisation’s ISMS, you’ll need an implementation resource. You’ll also need: 

• Management systems and tools 
• Actionable policies and restrictions 
• Communication and stakeholder engagement strategies 
• Supply chain management systems 

• Resources to operate and improve 

With these resources, an organisation is better equipped to assess and mitigate security risks at all levels. Explore these ISMS development resources in greater depth with this guide to ISMS.  

Develop your risk assessment process 

Developing your risk assessment process is key to successful implementation. Risk assessment best practices vary by industry. Consider consulting this 7-step guide to conducting ISO 27001 risk assessment. 

How to earn ISO 27000 certification? 

To earn ISO  27000 certification, your organisation needs to work with a credentialed auditing organisation. The security professional can walk your organisation through what’s involved in the audit process. If your ISMS passes the audit, your organisation can earn certification.  

ISO certification process phases 

The audit process begins with a pre-audit risk assessment and survey. This determines the scope of the audit. 

Then, you define the scope of your ISMS. After that, you perform a thorough risk assessment and gap analysis, within the pre-determined scope. At this point, you design and implement procedures and controls, per ISO  27000 standards.  

Complete training and document your ISMS process. Collect evidence of ISMS and compliant, secure processes. 

Finally, conduct the relevant audits.  

How to manage information security the right way and comply with ISO 27000 

With ISO 27000, your organisation can build a robust ISMS and strengthen information security.  Yet, this series of standards is elaborate and complex.  

You may have noticed that standards such as ISO 27017 are phrased in a very abstract manner and contain hardly any concrete requirements and recommendations for action. Their implementation therefore relies on industry-specific expert advice. 

With our information security platform, we support you in setting up your Information Security Management System (ISMS) and prepare your business for an external ISO 27001 audit. We'd be happy to answer any questions you might have, simply book a meeting.