A E-guide about ISO 27000 certification

1. NQA ISO 27001:2013(Implementation guide)

2. Introduction to the Standard: Many more businesses hold or to access sensitive and valuable information. Failures protect information for the serious operation. In some instances they lead to total business failure. ISO 27001 is an internationally recognized standard for information security management systems (ISMS). It gives a framework for the protection of information they can adapt to all types and the size of an organization. 27001 family: The 27000 family started life in 1996 as a BS 7799 and this is written by the UK's department of trade and industry (DTI). They are maintained and developed jointly by two bodies. The first body is ISO(the international organization for standardization) and the second body is IEC(the international electrotechnical commission).

3. Regular Reviews and Updates ISO standard are the subject for the reviews in a every five years to assess a updated is required. The most recent update to the ISO 27001 standard in 2013 brought a very significant change in the adoption of “Annex SL” structure. There are some minor changes in made a wording in 2017 to clear the requirement of maintaining an information asset inventory.

4. BENEFITS OF IMPLEMENTATION Benefits of implementation mainly in three areas. The three areas are commercial, operational, peace of mind. Commercial • The third independent party endorsed a ISMS and provided an organization with a competition advantage, an enable to grab up the competitors. for this organization they want to work with in this type of customer. Having under a ISO 27001 and to their increase a commercial total revenue. Operational • The whole approach of ISO 27001 support to develop an internal culture they are alerting to the information security risks and other many things. Peace of mind • Most organizations have information that a mission is critical to the operation and they have vital sustaining to their competition advantages and to the financial value.

5. Key Principles And Terminology The main purpose of an ISMS is to protect sensitive or valuable information. • In this type of risk they are sensitive and valuable information is generally divided into mainly three parts. • The first is confidentiality second is integrity and the third one is availability. •

6. PDCA CYCLE ISO 27001 is based on a Plan-Do-Check-act (PDCA) cycle, also known as the deeming wheel and Shewhart cycle. The PDCA cycle is not only applicable in the management system and as a whole system.

7. MODEL OF PDCA ISO 27001: ❖ Plan-do-check-act is a closed loop system. ❖ They ensure the learning from the do and check and the used informed the act plan. RISK BASED THINKING/AUDITS Audits are a systematic system. This is an evidence based process to approach the evaluation to your information security management system. ✓ They are three party in the system ✓ First parties\internal audits ✓ Second parties\external audits ✓ Third parties\certification audits

8. ANNEX SL There are many changes in and also in 2013 revision of ISO 27001 they are adoption of ANNEX SL are used in under the standard writers. High level structure They are 10 clause in the ANNEX SL ✓ Support ✓ Planning ✓ Normative references ✓ Leadership ✓ Operation ✓ Improvement ✓ Performance Evaluation ✓ Context of the organization ✓ Terms and Definitions

9. THE 10 CLAUSES OF ISO 27001: 2013 CLAUSE 1: SUPPORT In a 1 clause support to a management system an they apply a management, developed and a physical resources such as tools, materials etc. the three major type of support clause. Awareness- all the staff and the supplier should be aware for this this following term That you have an ISMS and why you have an ISMS. ● That you have an information security policy and the particular one element and they are relevant to them. ● How to protect our information, how to contribute to our organization and why we help our nation and achieve information security objectives. ● Which policies, procedure and control are relevant to them and what are the main consequences of not complying with them.

10. Communication- you will need to ensure that the communication activities. And they are managed and planned. ➢ What are need to be communicated ➢ When it is need to communicated ➢ To whom it need to be communicated ➢ who is responsible for the communicated ➢ What is the processes of communication Competence- the very most common implementation of the effective information security and the controls. ➢ To define a what knowledge and skills are actually required ➢ To determine the who have need to knowledge and skills; ➢ Set to the how you can assess or verify the right people to have a right knowledge and skills

11. CLAUSE 2: PLANNING In ISO 27001 is a most common heart risk of a system in an organization and to verify the driver of its information security. A risk assessment is a core of any effective ISMS. for all the organization's risk assessment are essential to: To increase a likelihood of identifying the all potential risks and through the involvement of key individual Allocate the resources and to tackle the highest priority areas; Ro make the strategic decisions and how the manage an information security ▪ ▪ ▪ ▪ RISK TREATMENT For each a risk identified in our risk assessment, so you must try the determine the weather you should To accept the risk To treat the risk(called a treatment) Avoidance Removal Change the likelihood Transfer the risk Accept the risk ● ● ● ● ● ● ●

12. CLAUSE 3: NORMATIVE REFERENCES Some of the terms and the conditions are used to require detail in ISO 27001 and are explained further in iso 27001 is a very useful and a help to understand the requirement better and to identify the best way. CLAUSE 4: LEADERSHIPS Importance of leaderships: Ensure that the objectives of ISMS and aligned and clear all the planning Then the clarity on responsibilities and accountabilities The risk based thinking is a heart of all decision making The information and the security policy may be the references and the security and or include such policies. The key control of the ISMS.

13. CLAUSE 5: OPERATION To implement effective processes the following practices are crucial: They are systematic processes to identify the adapting or formalizing an organization “business or usual” activities. The clear definition of communication and set to the activities required. Clear all the assignments responsible for carrying out the activities. Adequate allocation of resources to ensure that the related activities can take a place. ✓ ✓ ✓ ✓ CLAUSE 6: IMPROVEMENT Root cause analysis They mainly identify the effective corrective action, it is strongly advisable to complete a full analysis of root causes. And to improve the security management. Problem statement: This organization are mostly affected by the winna cry virus Why? The manager of training on maternity in an organization has not implemented the cover for all of them. Why? Someone clicks on this link and in an email and they automatically download the virus in our pc. Why? They click on the link and they are not expected to receive it.

14. CLAUSE 7: PERFORMANCE EVALUATION ➢ They are three main ways to the performance of ISMS is evaluated. ➢ Monitoring the effectiveness in the ISMS control ➢ Through which the internal audit ➢ And last is management review meetings CLAUSE 8: SCOPE ➢ The scope part of the ISO 27001 is sets out ➢ They are mainly purpose of the standard ➢ This type of a organization is designed to applied. ➢ The section of the standard is called clause they are contain a many requirement for the organization.

15. CLAUSE 9: CONTEXT OF THE OGANIZATION ✓ Internal context ✓ They are following terms ✓ Maturity ✓ Organization culture ✓ Management ✓ Resources size ✓ Resources maturity ✓ Information asset formats ✓ Information asset sensitivity ✓ External context ✓ Competition ✓ Landlord ✓ Regulators ✓ Economic ✓ Environmental consideration ✓ Shareholder ✓ Information security attack

16. CLAUSE 10: TERMS AND DEFINATION Actually they are not term and definition in ISO 27001. In addition of the in the term explain and the key principle and terminology. ✓ Access controls ✓ Risks ✓ Risk assessment ✓ Risk treatment ✓ Top management

17. About us Rajstartup is a genuine and trustworthy organization of India where a company can get all the services such as ISO Certification, FSSAI Registration, MSME registration, GST Registration Company Registration, Trademark Registration, etc. We provide all the services at the lowest and affordable prices as possible and our charges are also pocket-friendly that any entrepreneur can afford the services. We also help people and guide new startups to give them information about the requirements and procedures to set up their company. We have a good network through which we work faster and give results to our customers in a few days and do the registration processes in less time.