ISO 27001 and ISO 27002 Compliance and Cybersecurity

What are the ISO 27001 security controls?

By virtue of Clause 6.1.2, ISO 27001 requires organizations to perform an ongoing risk assessment, along with a risk treatment process described in Clause 6.1.3.
There are no specific security controls in the standard, with organizations able to select their own security controls to mitigate any risks. However, Annex A of ISO 27001 contains a non-exhaustive list of recommended security controls, as a way of providing more specific technical guidance to organizations. Implementation of these security controls are elaborated by ISO 27002.

ISO 27001:2022 Annex A currently contains 93 controls grouped in 4 sections (A.5 – A.8) in:

A.5 Organizational controls
A.6 People controls
A.7 Physical controls
A.8 Technological controls

The wide spectrum of security controls, spanning from physical safeguards and security training to supply chain risk management and meeting regulatory requirements, makes ISO 27001 one of the most comprehensive data protection standards.

For instance, 534Elsewhere A.5.32 addresses intellectual property requirements by preventing negligent or unwitting infringement of licensing agreements or violation of copyright law. Privacy legislation is covered by the control A.5.34 that mandates protection of personal data (PII) as prescribed by the applicable privacy laws, such as LGPD in Brazil or PDPA in Singapore. Thus, a violation of applicable law or industry standard, such as HIPAA or PCI DSS, may potentially trigger a major non-conformity with ISO 27001 and even lead to a suspension of certification if spotted during an annual audit.

It is important to note that the foregoing controls from the Annex A may be excluded if irrelevant for the ISMS scope or non-applicable for the organizational context. Nonetheless, it is good practice to consider all of the controls, avoid exclusions and properly document risk mitigation controls in case a currently non-applicable control becomes necessary one day.
One should also bear in mind that the controls from Annex A are not a ceiling but rather a bottom line. When a risk assessment requires additional security controls in order to adequately mitigate identified risks to an acceptable level, additional controls must be implemented even if they are not expressly mentioned in the Annex.

How to implement ISO 27001?

Cybersecurity professionals commonly follow divergent checklist approaches to tactically implement the ISO 27001 standard, depending on the location, industry or size of the business seeking certification. The underlying strategy is, however, pretty similar and consistent.
First, the organization wishing to be ISO 27001 certified should analyze and agree on the underlying needs and the desired outcomes of the ISMS within the context of its business (Clause 4.1). When doing so, the organization should likewise consider “relevant” needs and concerns of the so-called interested parties (Clause 4.2). The interested parties can include clients, partners, employees or regulators who may be positively or negatively affected by the ISMS implementation. For instance, customers will certainly appreciate more assurance that their data is adequately protected, while suppliers may be wary of additional due diligence requirements.

The organization must then define the actual scope of the ISMS (Clause 4.3). ISO 27001 scoping is somewhat similar to the PCI DSS scoping of the Cardholder Data Environment (CDE), but, in contrast to the clearly imposed guidelines for the CDE scope, ISO 27001 may apply to any part, office or specific site of the covered entity. It’s essential to properly determine the boundaries of the ISMS, considering organizational context and needs, as well as involvement of third parties in the business processes (e.g. external cloud storage or outsourced credit card processing). Commonly, small and medium-sized organizations select their entire infrastructure to be in the ISMS scope, while large international businesses may exclude some offices or locations, where no sensitive data is processed or stored, to reduce costs. Any unjustified or excessively wide exclusions (e.g. of regional offices or departments that have access to the data that the ISMS aims to protect) will likely be a red flag – so it’s important to take care with the scoping process.
The next step is to obtain a long-term commitment from the organizational leadership (Clause 5.1) to continuously support and adequately maintain the ISMS through the allocation of requisite resources and promoting a healthy security culture within the organization. Clause 5.2 is probably one of the most straightforward; it requires the creation of detailed documentation, including numerous policies and procedures to describe the ISMS, underlying processes and implemented security controls. Eventually, the organization should unambiguously assign roles and responsibilities, and grant necessary authority to employees to fulfill their ISMS-related duties, pursuant to Clause 5.3 of the standard.

Crucial ISMS implementation steps derive from Clause 6.1 that includes risk assessment, analysis and treatment. In a nutshell, subclauses 6.1.1 to 6.1.3 require the organization to cautiously identify and assess the applicable risks, define a reasonably acceptable risk level and then determine and implement security controls to efficiently mitigate those risks. During this phase, the Statement of Applicability (SoA) comes into play. This foundational ISMS document should contain a list of necessary controls, justifications for their inclusion and implementation status, as well as justifications for exclusions (if any). From a practical viewpoint, the SoA may be a Microsoft Excel file providing easily understood information about the current ISMS status.
Akin to some privacy laws that impose specific qualifications or experience requirements for Data Protection Officers (DPO), Clause 7.2 of ISO 27001 requires covered organizations to determine necessary experience, training or education for personnel who will implement and maintain the ISMS. There are no specific requirements under the standard, but the skills must be sufficient to execute ISMS-related tasks in a competent and qualified manner.

Subsequent Clauses 7.3 and 7.4 require personnel to be aware of the ISMS existence and its requirements, and as well as an effective communication process within the organization to ensure efficient promulgation of ISMS-related information and updates internally. Clause 7.5 provides guidance on maintenance and safeguarding of the ISMS documentation, including role-based access, version control and retention. Ideally, all people within the organization should be familiar with the relevant policies and procedures and share their feedback with the ISMS management team for continuous improvement purposes.
Practical implementation of the security controls, interrelated processes and procedures is described by Clauses 8.1 to 8.3. Success of the ISMS implementation and achievement of its goals shall be measured in an ongoing manner as stipulated by Clauses 9.1 to 9.3, including effectiveness evaluation, internal audit and subsequent management review.
Finally, Clauses 10.1 and 10.2 guide organizations on how to mitigate the identified non-conformities by taking corrective actions in a continual and incremental manner.