-1

I'm new to ISO 27001 and my goal is to come up with an ISMS policy for an mid-size organisation. As I did not purchase the standards, I went to read up advisera's articles and went through their free foundation video course.

Now, I'm this confused state of trying to understand how to structure the contents and the documents for ISMS, and the granularity of the content.

I found 3 references online(link below) which I think it's pretty decent. However, the granularity of these documents are very different from one another.

  1. https://www.gs.unsw.edu.au/policy/documents/itsecuritypolicy.pdf

    Separate into multiple documents. Section 2, high level description of control implemented from Annex A I believe. It then reference to very detail documents of how the control is enforced. Eg. https://www.gs.unsw.edu.au/policy/documents/ITSS_15.pdf
    Do I need to provide this document(ITSS_15.pdf) with such granularity to get certified?

  2. http://openaccess.uoc.edu/webapps/o2/bitstream/10609/59325/8/prodalTFM1216mem%C3%B2ria.pdf

    All in one document. Annex 1 talks about the annex A controls I believe, not as detailed as the detailed document referenced on section 2 of link 1.

  3. http://www.easypqq.co.uk/wp-content/uploads/2016/04/ISMS-Policy.pdf

    All in one document. I think that section 6 talks about annex A control, very high level

As you can see the 3 documents above, their granularity and structure of the contents are very different. How to structure the contents and the documents for ISMS, and the granularity of the content?

| improve this question | |
  • 1
    why not buy the documents? – schroeder♦ Jul 22 '17 at 21:52
  • @schroeder Because I see people offering ISO27001 templates all over the internet. It makes me think that purchasing the standard won't answer all my queries. – ysj Jul 23 '17 at 6:04
  • but your answers will come directly from the source documents – schroeder♦ Jul 23 '17 at 8:11
3

Purchase the standard ISO 27001 & ISO 27002. If you want to certify to ISO 27001, you should at least have the standard so that you know what to do. ISO 27002 5.1.1 answers your question on what the standards committee suggest you consider.

Regarding the first link, you do not need to provide this level of detail unless it is required by the standard. About the second link, an ISMS policy is not required in ISO 27001:2013. It was in ISO 27001:2005. The third link reads like a summary of how they implemented ISO 27001:2013.

How to structure the contents and the documents for ISMS, and the granularity of the content - do so in a way that benefits your organisation and not just to certify to the standard.

| improve this answer | |
  • Hi! I was wondering if i should purchase the standards or templates offered by 3rd party online. I was worried that purchasing the standard doesnt give me a systematic approach(like what should I do next and how do I do it). – ysj Jul 23 '17 at 6:14
  • How is an ISMS policy not required in ISO 27001:2013 ? Chapter 5.2 explicitly requires one. – Tom Mar 21 '18 at 12:55
  • An information security policy perhaps but not an ISMS policy – Conor F Aug 19 '19 at 9:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.