Organizational units: department, service project, subsidiary, etc.

Organizational structures and responsibilities of managers

Business Process: Sales management. Procurement process, hiring, etc

All physical locations, both internal and external, that are included in the ISMS should be considered.

Identify area (data centre/server rooms/specific area)

In the case of outsourced physical sites, the interfaces with the ISMS and the applicable service agreements have to be considered.

Networks: internal networks, wireless networks, etc.

Operating Systems: Windows, Linux, etc.

Applications: CRM, software management payroll, ERP. utilities, database

Data: customer records, medical data, research and development, etc.

Processes: Consider processes that transport, store or process information.

Telecommunications equipment: routers, firewalls, etc.

Evaluated

Approved

Documented

Select the relevant controls from the standard

Create a document with the objectives/exceptions for the selected controls

technology perimeter assessment

physical security assessment

assessment of critical applications

interview department head

interview mid-level employee in the department

analyse process and practices

Risk Treatment Plan

Perform risk assessment

Procedure for Risk Calculation

Change Management Policy

Obtain management approval

Incident Handling Policy

Obtain management objectives

Wireless Security Policy

Acceptable Use Policy

Refer individual policies

Internet Use Policy

Email Use Policy

Mobile Use Policy

Create the policy

Security Policy

Document review

1 day

Mandatory

Control review

Multi-day based on scope

Mandatory