ISO27001:2005 sets out the required structured approach to establishing an Information Security Management System – an ISMS:

• Define what areas, elements or systems within your business are covered – the scope of the ISMS

• Define an Information Security Policy setting out the information security objectives of your business

• Define a systematic approach to assess information security risk

• Identify the important information assets of the company within the scope of ISMS

• Assess the risks to these assets

• Identify and evaluate options to reduce these risks, selecting control objectives and controls to be implemented

• Summarise your control choices and reasons for selection in a statement of applicability showing your compliance with the standard.

Once established, you can implement your ISMS by:

• Planning the implementation of your chosen controls including technical controls, documentation, process and procedures – your risk treatment plan

• Implementing your risk treatment plan and planned controls

• Supporting implementation through an active training and awareness programme

• Managing your operation in line with the ISMS

• Implementing procedures that enable prompt detection of and response to security incidents