One of my client has ISO 27001 audits at their disposal and they have been going through audits. Meanwhile, they are taking custom security services from our company where-in one of the deliverables happen to be Secure Network Architectural Review. While opting the services provided, they haven't informed before-hand that they did not had specific security documentations, policies and the framework in place to carry out the task.
To me viewpoint, I would had these requirements to carry out SNA or Secure Network Architectural Review process:
Information Security Policy
Network Security Policy
Application Security Policy
Information Asset Register & Classification adhere to CIA
Disaster Recover Policy (DRP)
- Change Management Policy
- Business Continuity Plan (BCP)
Since we are about to provide them information security risk assurances and they have these missing gaps, my primary question drops to few bottomline's here:
- Is it necessary to have these documents, policies, DRP, BCP's etc built from the scratch to tighten up security to carry the task at hand?
- Does the ISO 27001 require all these to be previously there? and if yes, how they still had been audited at the first place but no management had pushed forward the missing documentations, policies, etc gaps?
- If we are to provide serious risk assurances, should we provide them another service to create these docs, policies or shall it be covered along with SNA? (I know this is an executive view-point but still overall opinions needed)