The ISO 27001 Document Toolkit

Are searches for fast ISO 27001 implementation, and, free ISO 27001 documentation, oxymoronic?

Early searches led us to understand that having ISO 27001 documentation was important. That led to searches for free ISO 27001 documentation templates, free ISO 27001 tools, and ISO 27001 document toolkits along with data protection toolkits. And we checked out the paid stuff too as we all know, free rarely is in practice. The internet and this topic has obviously come along way in 8 years and so has regulation with things like GDPR meaning information security management is even more important to everyone now not just the educated customer. It is easy to laugh about our naiveness now, but as a result of the marketing and our lack of knowledge we were hooked into the initial attraction of ISO 27001 document toolkits as ‘the quick fix’ to get our independent ISO certification.

So we purchased a ‘comprehensive toolkit’ from well known information security management vendor and thought we’d done well only spending around £1,000. Then we bought the ISO 27001 and ISO 27002 standards which were about £100 each. That latter decision was pivotal for us for many reasons, not least understanding the standard structure, the numbering and being much clearer on what all the expectations were.

The toolkits turned out to be a poor scope of basic excel and word documents with old fashioned version control mechanisms and no clarity for what we were supposed to do next. Could we just tweak those ISO 27001 templates, dump that into a google drive or sharepoint site and show the external auditor we were ready for our Stage 1 Audit? Not quite. We wasted lots of time on trying to figure that out. The opportunity cost of our consulting day rate was becoming significant and we were no closer to the goal of a certified ISMS that our customer could trust.

On reflection it is analogous to the purchase of an umbrella for solving an earthquake risk; a possibly helpful asset but nowhere near enough, and you could have spent that money more effectively. Perhaps it is even a liability if you were to also get stabbed in the eye by the pointy umbrella too when you were unsure what to do with it during the earthquake… I’m obviously pushing analogies and mixing my metaphors a touch far. The literal point is that ISO 27001 documentation in itself is not enough and the ISO standards experts have clearly stated that a ‘management system’ is the important thing to achieve.

Are ISO 27001 documentation and guidance ‘toolkits’ comprehensive?

In order to achieve ISO 27001 and get an independent certification, there is a need to describe and demonstrate documentation (content) working in practice for around 140 specific activities. That includes the preparation, meeting ISO 27001 core requirements clauses and addressing the Annex A controls. So having the documentation is one thing, demonstrating that it is relevant to your organisation and you are living the management system in practice is another.

It is therefore important to qualify carefully what exactly is included in a documentation toolkit. You don’t want to get a Bob the Builder partial toolbox with quality fit for a four-year-old user when what you really wanted was the grown-up comprehensive Snap-on tool set. Equally, why buy a comprehensive toolset when you already have the spanner and hammer equivalents. In practice, very few organisations actually start their implementation from zero. We’ve created an ISO 27001 implementation approach called ARM; the Assured Results Method. It helps organisations achieve the standard by building on what they have already and being pragmatic in their approach to ISO 27001 certification.

How easy is it to actually use ISO 27001 documentation toolkits?

It depends on the quality and scope of what you purchased, and what else you have to operate and manage your ISO 27001 management system as well. You’ll want to easily adopt, adapt and add to the documentation and tools in order to make it relevant to your organisation’s desired way of working.

With the power and affordability of technology, you’ll want to have a digital management system to help coordinate and control your documentation, showing that you review it regularly, as well as ‘live and breathe’ all the relevant requirements and controls in the way the standard expects. Whilst there are many different ways of doing that, we’ve identified what we consider to be the key characteristics of ISMS software.

What do we think about off the shelf ISO 27001 documentation toolkits?

ISO 27001 documentation is important, and as noted above, probably the first thing that people search for even today when they are new to the standard. Many enquiries that we receive today for ISMS.online start with the comment “we recently purchased a document toolkit but now realise that wasn’t what we thought it was…” Sadly most of those organisations, like we did, are almost certainly going to have wasted £500-1500 and their time getting to that position.

It is really important that you not only describe the content, but also demonstrate that whatever policy and control documentation you are using, that is evident in its operational use. For example if your policy says you use 2-factor authentication and have systems administrator permission controls, make sure that you can show them in practice to an auditor.

You can’t just have a risk management methodology in a standalone document, you have to identify and manage risks regularly in practice – if following that policy in practice is hard or not going to happen because the policy or tool is clunky, your certification efforts will fail. Therefore documentation toolkits can be an asset or a liability, depending on what you buy, where you get it from and how you go about using it. Caveat emptor!

We have thought long and hard about what level and scope of complementary documentation should be provided with ISMS.online, for those that want a head start. We ended up with the view that we can, ‘hand on heart,’ help organisations with up to 77% progress on all their requirements and controls documentation the minute they log on, with our material being so easy to adopt, adapt and add to versus others. It reduces the time spent significantly and saves a huge amount of money. Feedback from customers suggests it is the most comprehensive suite of materials out there, especially when complemented with our Virtual Coach service and ARM that helps accelerate ISO 27001 implementation.

More significantly we made sure that all the content forms practical and actionable documentation within the ISMS.online management system. After all you have got to have an information security management system for achievement of ISO 27001 and a document toolkit is just not enough no matter how good it is. We found that to our considerable cost many years ago, and it’s a shame others still fall into the fissures (back to that earthquake;), but with ISMS.online now available, you don’t have to be one of them.