Would you like to implement the requirements of ISO 27001 digitally and at the same time ensure that they are lived by your employees? We'll show you how! With the GRC software Aeneis, you can set up your ISMS digitally, easily and completely networked.
Implementation and certification in accordance with ISO 27001 is often decisive for the trust of customers and partners in today's connected and digital business world. Information security is a top priority. Sensitive data must be protected. But the implementation of a holistic information security management system (ISMS) often presents companies with key challenges:
- Integration and scaling: The ISMS must be flexible enough to be integrated into existing corporate structures and keep pace with growth and changing requirements.
- Complex structures and processes: In companies with complex structures and a variety of processes, all security requirements must be identified and effectively managed. All documentation required by ISO 27001 must be recorded in detail and safety measures regularly reviewed.
- Understanding and commitment of employees: Employees must understand and implement information security policies so that the policies and control mechanisms are effective.
With the GRC software Aeneis, companies across the group can implement and manage their ISMS in accordance with ISO 27001. We will show you which key components you can use in Aeneis to set up your ISMS in a process-oriented manner, involve all employees directly and answer the following questions:
- Who is responsible for information security?
- What exactly needs to be protected?
- What it needs to be protected from?
- How should protection be provided?
- How can protective measures be reviewed and constantly improved?
Process-oriented ISMS
For ISO 27001 certification, companies must implement an information security management system (ISMS). Information security is about maintaining the confidentiality, integrity, and availability of information.
With the Aeneis process management software, you have the option to digitally map your entire corporate and process landscape and at the same time set up your ISMS in a fully integrated manner. The ISMS is contained compactly in an app, i.e. a separate area, and yet is fully networked with all relevant processes, roles and IT systems. This means that safety measures are integrated directly into everyday working life.
Who are responsible for information security?
ISO 27001 requires that responsibilities relating to information security must be clearly assigned. In the GRC software Aeneis, the ISMS app provides you with an area where you can map your organization in terms of your information security.
There, you can graphically represent how your global ISMS organization and that of each individual branch is structured and assign responsibilities in the form of roles and employees. In doing so, you not only meet the requirements of ISO 27001, but also create a clear governance structure.
Like process maps, you can create the organization as freehand diagrams, as described in this blog article and in our video.
Which data and information should be protected?
Document ISMS goals and provide manuals
According to ISO 27001, companies are required as part of their ISMS to develop and document their ISMS goals. In the ISMS app, you have the option of documenting your requirements and goals globally and for each individual branch in the manuals and making them available to your employees centrally.
There, you can edit and adapt the documents provided or create your own. In this way, you can also directly integrate relevant standards and link the appropriate standards in chapters.
Find out how to create, edit and manage documents in Aeneis in our blog article and video.
Identify IS-relevant processes and assets
The process-oriented approach of your ISMS in Aeneis is characterized by the fact that, as part of your process management, you can determine directly in the process whether it is relevant for information security. You can then assess its criticality in terms of confidentiality, integrity, availability, and authenticity. The same applies to assets such as IT systems.
All processes and assets are evaluated in the ISMS app and displayed in a graph and tables. There, you can immediately overview which processes and IT systems are critical to your information security and proceed with the classification.
Document the scope of application
Another critical step in implementing an ISMS is defining the scope of application. In chapter 4.3, ISO 27001 requires that the scope of application of the information security management system must be documented. The scope of application determines which parts of your company and which information are protected by the ISMS.
In Aeneis, you can document the scope of application for the entire company or specifically for each branch. In this area, the IS-relevant processes are also listed in a table so that you can specifically compare the documented scope with the processes and thus ensure completeness.
What risks should be prevented and what measures should be taken to protect against them?
Use standard catalogs with risks and measures
You don't have to start from scratch to consider the threats to your information security. The Aeneis compliance software provides you with standard catalogs that contain threats, vulnerabilities and threat scenarios recommended by the BSI (Federal Office for Information Security) and in ISO 27005. You can therefore quickly start looking at the risks and make assessments.
ISO 27001 also recommends measures that you can also find in the catalogues and can therefore be used directly to deal with the threats.
Perform risk management in 3 steps
Risk management is at the heart of the ISMS in the GRC software Aeneis. There, you can carry out the risk process in three steps:
Risk process in ISMS in three steps
- Risk identification
- Risk analysis
- Risk treatment
Identify risks
As already mentioned above, the ISMS in Aeneis is process-oriented. For risk identification, you can therefore go through all processes in a table and find those that pose a risk to your information security.
For risk analysis, it is also important that you link the critical processes with the relevant assets.
Analyze risks
You can record ISMS risks for any asset that you have previously classified as IS-relevant or that comes from an IS-relevant process. When recording the risk, you can in turn access the catalog of threats and assign a risk scenario. With a clear understanding of the underlying risk scenario, the next step is to take more targeted and effective risk reduction measures.
For the analysis of risks and subsequent risk treatment, you can provide a gross assessment of the ISMS risk. There, you can assess how the risk would affect confidentiality, integrity, availability, and authenticity without taking action.
Treat risks
In order to avoid or keep the probability of occurrence and the effects of risks as low as possible, measures are recorded in the last step of risk management. The measure is assigned directly to those responsible, who can then process it as a task. This not only ensures that the defined measures are implemented directly, but you also get your employees on board and create awareness.
Once measures have been recorded, you can make a net assessment of your risks. This makes immediately visible how effective the measures are and that you have demonstrably ensured that the risks to your information security have been reduced or avoided.
Document a statement of applicability
The Statement of Applicability (SoA) is another documentation required by ISO 27001. The statement must include all measures that a company has assessed as part of its ISMS.
In the ISMS software Aeneis, all measures are displayed in a separate area to explain the applicability in a table. There, you can look at each measure separately and determine whether it is applicable in your company. Like all tables in Aeneis, you can filter them and export them as an Excel spreadsheet. For example, you can filter for all applicable measures here, export the table and thus prove your documented statement of applicability in the audit.
How can protective measures be reviewed and constantly improved?
View evaluations and reports
The continuous review and improvement of your protective measures is essential for compliance with applicable laws. Certain reports make this step easier for you in your ISMS. This means that you can see directly how your information security is doing, not only in the individual areas in graphics and tables. You also have selected areas where you can overview the measures you have taken and view all risks and their status and evaluation in tables and HeatMaps.
Document security incidents
In today's digital world, in which cybersecurity plays a major role and fraudsters are setting ever more sophisticated traps, information security incidents can still occur despite the implemented and lived ISMS. In such cases, as required by ISO 27001, you can decisively document the incident in order to derive a need for action in the form of measures.
The Aeneis compliance software has a separate area for security incidents, which is once again particularly protected by restricted access rights so that no sensitive data can fall into the wrong hands there either. When recording an incident, you can enter all important information. The questions specified by the BSI are also queried there so that you do not forget any relevant information.
The recorded security incidents help you to better assess the probability of ISMS risks occurring and to identify topics for internal training and awareness-raising. In this way, you can contribute to the continuous improvement and development of your ISMS and involve your team directly in the process.
Test Aeneis now 30 days free of charge!
No installation — convenient and easy in the cloud
FAQ
Why is implementing ISO 27001 so important for companies?
Because it creates trust and systematically strengthens information security. With the GRC software Aeneis, companies can digitally map their ISMS, manage risks and efficiently meet ISO 27001 requirements.
How can companies set up an information security management system (ISMS)?
An ISMS determines how information is protected, risks assessed and measures implemented. In Aeneis, this is done digitally, networked with all relevant processes, roles and IT systems.
How are responsibilities defined in information security?
Responsibilities are clearly defined in ISO 27001 in order to make responsibilities and escalation paths transparent. In Aeneis, companies can graphically represent their ISMS organization and assign roles directly to the responsible persons, so that responsibilities are clearly documented.
How can safety-relevant processes and assets be identified?
Companies evaluate processes and IT systems according to their criticality for confidentiality, integrity and availability. In the ISMS in Aeneis, these assessments are transparent and risks are clearly presented in tables and graphics.
How can risks in the area of information security be addressed?
Risks are recorded, analysed and linked to measures in the ISMS in Aeneis. Responsible persons process tasks directly in the system so that progress and effectiveness remain measurable.
How do companies document the scope of their ISMS?
The scope of application determines which parts of the company and which data are protected. In the ISMS in Aeneis, this area is documented in a structured manner and linked to relevant processes.
How can protective measures be regularly reviewed and improved?
The ISMS in Aeneis provides evaluations, reports and heat maps to assess risks and measures. In this way, security processes are transparently monitored and continuously optimized.
How does software help document security incidents?
Incidents can be recorded in detail and in compliance with GDPR in the GRC software Aeneis. This creates a comprehensible basis for training, analyses and the development of the security strategy.
