Now in it’s second revision…

ISO 27001:2022
Information Security Management System

PJC ISO 27000 Implementation Streamlined Process

GAP ASSESSMENT:

• Determine internal and external issue that impact information security
• Determine the needs and expectations of interested parties
• Identify the ISMS scope and boundaries (products/activities/assets/locations)
• Assess the above against the ISMS standard and control objectives Report of findings
• Select a Certification Body (Registrar)

IMPLEMENTATION AND DOCUMENTATION PHASES:

• Prepare the Project plan
• Define criteria to perform a risk assessment and risk evaluation
• Perform Risk Assessment and Risk treatment plan
• Define ISMS Objectives and Statement of Applicability
• Establish and document Policies and Procedures (integrate with other Company processes)
• Prepare/amend Business continuity and Disaster recovery Plan
• Train persons on documented policies and user awareness
• Implement Controls, Risk Treatment Plan, Policies and Procedures

INTERNAL AUDIT:

• Prepare audit plan and conduct a full system internal audit
• Take Corrective Action on identified nonconformances
• Execute Management review Meeting
• Company is Compliant to ISO 27000 and is ready for the Certification audits to be conducted by an accredited Registrar

You do not have to be a fortune 500 company to suffer a data breach. Cyber-attacks impact everyone, businesses and American households. Each data breach costs millions us of dollars. Lawsuits against those companies where the data breach has occurred continue to lead our news stories.

If you store important information in your computer, you should consider certification to ISO 27000.

Although ISO 27000 certification alone will not guarantee a cyber-attack, it will provide you with one more level of protection. Certification to this standard indicates to your customers, your employees, stakeholders, etc. that you are taking the necessary steps in protecting important data.

About ISO 27000

ISO 27001 was first published in 2005. When it was updated in 2013 it had the distinction of being the first ISO published standard to utilize the 10 section structure and core text provided in Annex SL. This means that ISO 27001 can be easily added to a portfolio of certification that could possible include ISO 9001:2015 and ISO 14001:2015.

The new standard has achieved numerous ideals by this latest rewrite, including:

• Simplification of language;
• Consistency with other standards; and
• A flexible approach to the management of processes.

Registration to ISO 27001:2022 offers a major competitive edge for organizations that handle electronic data and is emerging as a mandatory requirement in some marketplaces such as defense and healthcare.

• Get a FREE Copy of our ISO 27000 Executive Overview booklet