ISO 27001 is the standard generic in nature applicable to all business sectors which globally recognized standard for information security management systems. Information security management system certification may be combined with certification to other management system standards, e.g. ISO 9001, ISO 14001 and OHSAS 18001.

The standard provides a comprehensive approach to security of information needing protection, ranging from digital information, paper documents, and physical assets (computers and networks) to the knowledge of individual employees. Subjects to address include competence development of staff, technical protection against computer fraud, information security metrics and incident management as well as requirements common to all management system standards such as internal audit, management review and continuous improvement.

GENERAL REQUIREMENTS

Documentation shall include records of management decisions, ensure that actions are traceable to management decisions and policies, and the recorded results are reproducible.

It is important to be able to demonstrate the relationship from the selected controls back to the results of the risk assessment and risk treatment process, and subsequently back to the ISMS policy and objectives.

DOCUMENTATION REQUIREMENTS

The ISMS documentation shall include:

• Documented statements of the ISMS policy and objectives
• The scope of the ISMS
• Procedures and controls in support of the ISMS
• A description of the risk assessment methodology
• The risk assessment report
• The risk treatment plan

Benifites: 

ISO/IEC 20000 certification demonstrates that an organization has adequate controls and procedures in place to consistently deliver a cost effective, quality IT service. ISO 27001 implementation improves / leads to

• Management Understanding of the Value of Organisational Information
• Customer Confidence, Satisfaction and TRUST
• Business Partner Confidence, Satisfaction and TRUST
  e.g. Handling Sensitive Information of Customers & Business Partners
• Level of Assurance in Organisational Security & QUALITY
• Conformance to Legal and Regulatory Requirements
• Organisational Effectiveness of Communicating Security Requirements
• Organisational Effectiveness of Communicating Security Requirements

• Employee Motivation and Participation in Security (Best Practices)
• Organisational Profitability
• Management and Handling of Security Incidents
• Ability to Differentiate Organisation for Competitive Advantage
• Organisational Credibility & Reputation
• Ability to Differentiate Organisation for Competitive Advantage
• Organisational Credibility & Reputation