To comply with ISO 27001, does the Information Security Management System ought to implement the PDCA process ? or ISMS can choose another management method?

PDCA process is the Plan Do Check and Act management process. It is also called Deming cycle.


Taken from the book, CyberWar, CyberTerror, CyberCrime and CyberActivism, 2nd Edition

ISO/IEC 27003 (the ISMS default-suggested by ISO 27001), provides practical guidance for implementing a security management system based on ISO/IEC 27001:2005 by introducing a comprehensive methodology of applying the PDCA cycle to cybersecurity. This standard describes how to establish, implement, execute, observe, analyze, maintain, and improve an organization’s cybersecurity program. Although ISO 27001:2013 dropped the PDCA concept in the revision, it still has value as a decision-making aid.

A better book is Enterprise Cybersecurity: How to Build a Successful Cyberdefense Program Against Advanced Threats. This book is great because you can use it to integrate to current-running reality. If you must comply with, or obtain, official ISO 27001 certification and you must use ISO 27002/27003 as the ISMS prescriptions -- go ahead with those plans. However, it may be worth the effort to map towards this second book.

In Enterprise Cybersecurity, the frameworks are touched on in Chapter 13, including the introduction of the book's own Enterprise Cybersecurity Architecture framework, a comparative to the other frameworks, such as ISC2's CBK, ISO 27000 series, NIST SP800-53R4, et al -- which also mentions additional coverage in Appendix B. If you can get an Information Security Management program aligned with the operational architecture described thoroughly in Appendices C through G, then I think you would definitely exceed the capabilities of any other framework. Just map back to them as needed.


Mention of the PDCA cycle has been removed from ISO 27001 as of 2013, however ISO 27001 still specifies the requirement for continual improvement of your Information Security Management System (ISMS). This means that you may use another methodology as long as it does still meets the requirement of continual improvement.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy