ISO27001 and The Annex A Clauses - Clause A5

ISO27001:2013 Annex A for Information Security Management Systems may seem like a bit of a long list of controls, there are 114 of them after all! However, it is fair to say that Annex A of the standard is quite possibly the most important section of the standard because it list's the controls that you need to consider and where appropriate have in place if you are going to meet this standard. These are all linked back to Clause 6.1.3 Information Security Risk Treatment that we talked about previously. In fact, even if you decided not to get certified to ISO27001 for Information Security Management Systems just working through Annex A on its own will be a huge aid to your organisation.

Each Clause of Annex A relates to a specific element in terms of control objectives and controls, in each clause you get a great explanation of what the objective of the clause is, what it should help you achieve and the controls that should be in place.

Over the next few ISO27001 Blogs we will talk through the various clauses a little to highlight what they mean and how they can help you. The clauses can be grouped into 5 main areas which help when you want to think about who are the right, suitably qualified resources to be assigned to review and implement controls:

• Organisational Controls: A5, A6, A8, A15
• Human Resources Controls: A7
• IT Related Controls: A9, A10, A12, A13, A14, A16, A17
• Physical Security Controls: A11
• Legal Controls: A18

Annex A Clause 5.1 Management direction for information security.

The Objective of the Annex A Clause A5.1 is simple: 

Like every ISO Management System, in fact like every business objective that you want to succeed management buy in, direction and support is critical if it is really going to succeed. By Succeed we do not just mean getting a certificate for the wall or that you can show clients, we mean genuinely embedding it into the organisational culture. The fastest way for any system, and Information Security Management Systems (ISMS) to fail is for the senior management to take a hands-off approach and abdicate the process to other sin the organisation.

There are two items you need to think about with this clause, 1) The Policies for information security and 2) ensuring that there are Review of the policies for information security.

The controls for the Policies state that

What that means is simple, as a management team you need to approve any policies (try to just make it 1 if you can!) that will drive your ISMS, these need to be published / available to your organisation but more importantly you need to communicate them. That means talking to be people about them, often, and explaining what they mean to them and how the policy or policies impact what they do and how they impact the organisation.

The second requirement is:

In other words, you need to plan to keep checking that what you have documented in the policies are still working for your organisation and for the risks that are around at that time. Life, especially when it comes to Information Security moves pretty fact so your planned intervals may be 3 months, 6 months or perhaps a year, but unlikely to be more. When we talk about Significant change things like take overs, not just of your organisation but suppliers or customers may have an impact. New IT Viruses or key logging or Denial of Service attacks or change in technology within your organisation may all be triggers for another review.

The best bit about these clauses is that you probably already did all the work needed way back when you did the work to meet clause 5.