ISO/IEC 27002

5a. Prepare
SOA
Statement of
Applicability
4. Conduct
1. Get 3. Inventory
0. Start 2. Define information
management information
here ISMS scope security risk
support assets 5b. Prepare
assessment
Risk RTP
Treatment
Plan

Business case ISMS scope

6. Develop
ISMS
Inventory implementation
program

9. ISMS operational
artifacts Project plan
N

8. Information N-1
Project plan
Policies
Report
Security One project
Project plan
within the
Security logs
Standards Management program
etc.
Procedures System
7. ISMS implementation
Guidelines program

Report PDCA cycle

Compliance & Report (one of many)
audit reports Awareness
Report & 10.
etc. training 11. Corrective
Compliance
attendance & actions
review
test reports etc.
Key

12. Pre-
certification Activity Database
assessment

Document ISO/IEC
Version 3 January 2009 or output standard
Copyright © 2009 13. ISO/IEC 27001
ISO27k Implementers’ Forum ISO/IEC 27001 14. Party
Certification certificate
www.ISO27001security.com on!
audit
 Version 3 January 2009 Risk Risk
Copyright © 2009 ISO/IEC 27002 Assessment Assessment
ISO27k Implementers’ Forum ISMS policy Method/s Report/s
www.ISO27001security.com

5a. Prepare
SOA
Statement of
Applicability
4b. Conduct
1. Get 3. Inventory 4a. Define risk
0. Start 2. Define information
management information assessment
here ISMS scope security risk
support assets method/s
assessments 5b. Prepare
Risk RTP
Treatment
Plan
Records of Document
Business case Management Control ISMS scope
Decisions Procedure
6. Develop
ISMS
Inventory
implementation
program

Records of
ISMS
Management Project plan
IS Procedures Plan project
Review
8. Information Plan project
Project plan

Security Develop Internal ISMS

Internal ISMS Audit proc
9. ISMS operational Management Audit Plan Preventive
artifacts
Action
IS
System Procedure
Policies
Information Controls
Report Standards 7. ISMS Security Metrics Documentation
Security logs PDCA cycle implementation
etc. Procedures
(one of many) program ISMS Operating
Guidelines Procedures
Corrective
10.
11. Corrective Action Records Control
Compliance
actions Procedure Procedure
review
Report Report
Compliance & Awareness
Report &
audit reports training
etc. attendance & 12. Pre- Key
test reports etc. certification
assessment

Mandatory
document DO
PLAN

13. ISO/IEC 27001

ISO/IEC 27001 14. Party ISO/IEC
Certification certificate
on! standard ACT CHECK
audit