As we roll through the mid-way point of the calendar year, and hit the start of the Australian financial year, a lot of Australian businesses are mapping out when their next ISO 27001 audit may be, and how they can get ahead of the compliance curve.
We’ve developed a quick checklist for you to follow as you plan for the year:
Establish an Information Security Management System (ISMS):
- Define the scope and boundaries of the ISMS (note: this might be tricky to do if you have a hybrid environment, geographical dispersion of offices or a large remote team. Seek advice from a cybersecurity specialist if needed).
- Appoint a management representative responsible for the ISMS.
- Obtain management commitment and support.
Conduct a Risk Assessment:
- Identify and document assets, threats, vulnerabilities, and impacts across your infrastructure, cloud, applications and mobile environments (note: outsource this if it proves too lengthy and time consuming)
- Assess the likelihood and potential impact of risks.
- Prioritise risks based on their significance.
- Implement controls to mitigate identified risks and seek a standardised policy setting, and automated approach to manage these controls. You will find a service like this with a managed cybersecurity services company such as Cythera.
Develop Information Security Policies:
- Define and document information security policies. Either develop these from scratch (time consuming) or use specialist tooling that can provision global policies, and scalable security policies that fit your organisation and Australian legislation.
- Communicate policies to all employees and stakeholders and automate as much of the policy implementation process as possible. Speak with Cythera about a solution to this.
- Regularly review and update policies at frequent intervals as Australian regulatory standards change.
Establish Roles and Responsibilities:
- Define and document roles and responsibilities for information security (note: a RACI model works well here).
- Clearly assign ownership and accountability for assets, policy implementation, policy adherence, reporting and tracking.
- Communicate roles, responsibilities and policies in a robust way that ensures everyone demonstrates awareness and commitment to (i.e. don’t just send an email and assume everyone has read it).
Manage Supplier Relationships:
- Assess the security risks associated with third-party suppliers and how they can impact your ISO 27001 accreditation.
- Establish criteria for selecting suppliers based on security requirements and roll this out through a simple interface that is easy to use for third parties.
- Implement policies into agreements, procurement policies and contracts with all suppliers.
- Monitor and review the security practices of suppliers regularly either manually or through software platforms that automate security reporting tasks.
Implement Compliance Control Measures:
- Document compliance control procedures and assess for inefficiencies or lack of adherence.
- Delegate compliance control responsibilities (i.e. HR documentation to the HR team) and ensure frequent communication, ideally across a platform and not just through conversation or email.
- Automate as much of the information gathering process as possible. Develop central repositories or alert based automation systems to reduce the time it takes to execute and run compliance control.
Monitor and Review:
- Implement monitoring and logging mechanisms for information security events or look to outsource this function if the inhouse team is at capacity. Outsourcing options include cybersecurity managed services providers such as Cythera.
- Regularly review and analyse security logs for anomalies and incidents.
- Conduct periodic internal audits to ensure compliance.
- Perform management reviews to assess the effectiveness of the ISMS.
Please note that this checklist provides a general overview of the key areas to consider for ISO 27001 compliance and is not a full and approved list issued by ISO 27001 standards.
Is there a way to make this easier?
Yes, Cythera works with leading ISO 27001 compliance technologies, coupled with expert cybersecurity capability, to provide businesses with a comprehensive and optimised approach to compliance, that gives time back to IT teams without replacing jobs. We do this by:
- Automating the creation, management, and version control of documentation required for ISO 27001 compliance specific to Australian organisations.
- Providing templates, workflows, and collaboration tools to streamline the process of developing policies, procedures, and control documentation applicable to ISO 27001 and other Australian cybersecurity legislation.
- Automating risk assessment, risk analysis, calculation of risk levels, and frameworks for implementing risk management.
- Automating control implementation and monitoring, including the assignment of responsibilities, tracking of progress, and reports that can be used across the organisation for proactive communication purposes.
Cythera can also monitor, in real-time, the effectiveness of controls, identifying gaps and potential non-compliance issues before they become damaging.
Want to know more? Download our latest business case guide template or meet with us to discuss in person or via video.
