Home

Awesome

ISO/IEC 27001:2013 Information Security Management System (ISMS)

image

Note: If you or anyone on your team have any questions, please raise them on GitHub: <br /> https://github.com/dwyl/ISO-27001-2013-information-technology-security/issues

Why?

Security of people's data stored in IT systems is critical for every organization.

Note: We have a general "introductory" tutorial: https://github.com/dwyl/learn-security <br /> if you just need some plain-english background, tips & tools for your team!

Our purpose for creating this repo is to:

What?

The ISO 27001:2013 Standard defines requirements for the confidentiality, integrity and availability of information systems.

It's meant to help people (in organizations) think about and implement "controls" which improve IT security.

This repository is our implementation of the "controls" corresponding (policy/procedure) documentation required to ensure that the control is unambiguous to everyone in our team/community!

For comprehensive details about ISO/IEC 27001:2013 see: http://www.iso27001security.com/html/27001.html

Who?

All people in the organization who have contact with Information Technology or data should be given training on IT security. There's no excuse for "naivety" or "ignorance" and "professional negligence" with security will not be tollerated.

None of the "concepts" are "complicated" if you break them down into simple steps.

ISO 27001 Awareness Training: https://youtu.be/kU7ffml7W3Y (beginner-friendly/non-technical intro)

What "qualifies" us...?

You may be reading this thinking what qualifies DWYL to prepare our own Information Security Processes/Procedures...?

While we do not (yet!) have a person "on staff" who is "certified" to "audit" our controls/processes, we do have a co-founder who put in the time/effort to read all the books/standards and work as an "Enterprise Risk Consultant" for long enough to know exactly how to implement the controls/processes. "All" we need to be "certified" is to submit an application to the ISO organization. see: https://github.com/dwyl/ISO-27001-2013-information-technology-security/issues/17

How?

Even though ISO 27001 is a "standard", annoyingly it is not free, instead we have to pay to download it! It costs CHF 118 (£92 at the time of writing).

If you do not have the funds, you can always use your Favorite Search Engine to find a PDF: <br /> https://www.google.com/search?q=iso+27001+pdf+2013

e.g: https://trofisecurity.com/assets/img/iso27001-2013.pdf (the full PDF)

Controls

Once you read through the PDF you should be able to understand all the controls we have implemented: ISO-27001-2013-controls.md

Note: As always, If you or anyone on your team have any questions, <br /> please raise them on GitHub (we'd be delighted to help clarify anything!): <br /> https://github.com/dwyl/ISO-27001-2013-information-technology-security/issues

<br /> <br />

## Further Reading