Guidelines on Requirements and Preparation for ISMS Certification Based on ISO/IEC 27001

In line with the new edition of ISO/IEC 27001, this book provides guidance on the requirements specified in the ISMS standard ISO/IEC 27001:2013 and the best practice described in ISO/IEC 27002:2014 to support the appropriate use of these standards. Based on the 'Plan, Do, Check, Act' model, Guidelines on Requirements and Preparation for ISMS Certification based on ISO/IEC 27001 includes new references and definitions, additional information about the latest developments regarding certification criteria and other related standards developments. Discover industry accepted best practice methods for providing and demonstrating evidence required by an assessment auditor so you are fully prepared. This book provides guidance on the complete "life cycle" of ISMS activities required to establish, implement, monitor and continually improve a set of management controls and processes to achieve effective information security. It explains the transition from the old to the new edition and this will help those involved in certification audits, both ISMS implementers and ISMS auditors. The book is applicable to organizations of any size, government departments and agencies, certification and accreditation bodies, training organizations, academic institutions, implementers, auditors, consultants, trainers and lecturers.

Table of Contents:
INTRODUCTION The essence of information security Information security management system (ISMS) ISMS concept Delivering effective information security ISMS Certification ISO/IEC 27001: 2013 Scope Field of application Compatibility with other management system standards Normative references Terms and definitions Context of the organization - Understanding the organization and its context, Understanding the needs and expectations of interested parties, Determining the scope of the information security management system, Information security management system Leadership - Leadership and commitment, Policy, Organizational roles, responsibilities and authorities Planning - Actions to address risks and opportunities, Information security risk assessment, Information security risk treatment, Information security objectives and plans to achieve them Support - Resources, Competence, Awareness, Communication, Documented information, General, Creating and updating, Control of documented information Operation - Operational planning and control, Information security risk assessment, Information security risk treatment Performance evaluation - Monitoring, measurement, analysis and evaluation, Internal audit, Management review Improvement - Nonconformity and corrective action, Continual improvement INTRODUCTION TO ISMS CERTIFICATION ISMS certification process Preparation for ISMS certification TRANSITION (Old edition to New edition) - Differences between ISO/IEC 27001:2005 and ISO/IEC 27001:2013

About the Author :
Edward Humphreys (Chartered Fellow of the BCS - FBCS CITP, CISM) is Director of XiSEC Consultants Ltd, a UK company providing Information Security Management consultancy services around the world. He has been an expert in the field of information security and risk management for more than 35 years. During this time he has worked for major international companies (in Europe, North America and Asia), as well organisations such as the European Commission and the OECD. He is the editor of BS 7799 Part 1:1999, ISO/IEC 17799:2000, the 1999 and 2002 editions of BS 7799 Part 2 the ISMS standard and the EA 7/03 the ISMS accreditation guidelines. He is the Founder and Director of the ISMS International User Group and is responsible for the International Register of BS 7799/ISMS Certificates. In 2002 he was honoured with the Secure Computing Lifetime Achievement Award.