What it does. Guides implementation of an ISO/IEC 27001:2022 Information Security Management System (ISMS) end to end: gap analysis and scoping, risk assessment methodology, Annex A control selection, Statement of Applicability (SoA) creation, and continuous improvement. Use when scoping a new ISMS, preparing for ISO 27001 certification or audit, or selecting and documenting Annex A controls for a compliance program. Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).

Upstream	mukul975/Anthropic-Cybersecurity-Skills
Skill file	skills/implementing-iso-27001-information-security-management/SKILL.md
License	Apache-2.0 (skill folder LICENSE)
Author	mukul975
Fetched	2026-09-10

Install

• npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill implementing-iso-27001-information-security-management, or copy the skill folder into ~/.claude/skills/implementing-iso-27001-information-security-management/.
• Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-iso-27001-information-security-management/SKILL.md

SKILL.md (verbatim)

name: implementing-iso-27001-information-security-management
description: >-
  Guides implementation of an ISO/IEC 27001:2022 Information Security Management
  System (ISMS) end to end: gap analysis and scoping, risk assessment methodology,
  Annex A control selection, Statement of Applicability (SoA) creation, and
  continuous improvement. Use when scoping a new ISMS, preparing for ISO 27001
  certification or audit, or selecting and documenting Annex A controls for a
  compliance program.
domain: cybersecurity
subdomain: compliance-governance
tags:
- compliance
- governance
- iso27001
- isms
- risk-management
- certification
nist_csf:
- GV.OC-01
- GV.RM-01
- GV.PO-01
- ID.RA-01
- PR.DS-01
version: '1.0'
author: mahipal
license: Apache-2.0
mitre_attack:
- T1078
- T1530
- T1685.002

Implementing ISO 27001 Information Security Management

Overview

ISO/IEC 27001:2022 is the international standard for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS). This skill covers the complete lifecycle from scoping through certification, including Annex A control selection, risk assessment methodology, Statement of Applicability (SoA) creation, and continuous improvement processes.

When to Use

• When deploying or configuring implementing iso 27001 information security management capabilities in your environment
• When establishing security controls aligned to compliance requirements
• When building or improving security architecture for this domain
• When conducting security assessments that require this implementation

Prerequisites

• Understanding of information security principles and risk management concepts
• Familiarity with organizational governance structures and business processes
• Knowledge of IT infrastructure, network architecture, and data flows
• Access to ISO/IEC 27001:2022 and ISO/IEC 27002:2022 standards documents

Core Concepts

ISMS Clauses (4-10)

The management system requirements define what must be done:

• Clause 4 - Context of the Organization: Define scope, interested parties, and internal/external issues
• Clause 5 - Leadership: Top management commitment, information security policy, roles and responsibilities
• Clause 6 - Planning: Risk assessment process, risk treatment plan, information security objectives
• Clause 7 - Support: Resources, competence, awareness, communication, documented information
• Clause 8 - Operation: Operational planning, risk assessment execution, risk treatment implementation
• Clause 9 - Performance Evaluation: Monitoring, measurement, internal audit, management review
• Clause 10 - Improvement: Nonconformities, corrective actions, continual improvement

Annex A Controls (2022 Edition)

The 2022 revision restructured 93 controls into four categories:

Category	Controls	Examples
Organizational (A.5)	37 controls	Policies, roles, threat intelligence, cloud security
People (A.6)	8 controls	Screening, awareness, remote working, reporting
Physical (A.7)	14 controls	Perimeters, entry controls, equipment security
Technological (A.8)	34 controls	Access control, cryptography, logging, secure development

New Controls in 2022 Edition

11 new controls were added:

1. A.5.7 - Threat Intelligence
2. A.5.23 - Information Security for Cloud Services
3. A.5.30 - ICT Readiness for Business Continuity
4. A.7.4 - Physical Security Monitoring
5. A.8.9 - Configuration Management
6. A.8.10 - Information Deletion
7. A.8.11 - Data Masking
8. A.8.12 - Data Leakage Prevention
9. A.8.16 - Monitoring Activities
10. A.8.23 - Web Filtering
11. A.8.28 - Secure Coding

Workflow

Phase 1: Gap Analysis and Scoping (Weeks 1-4)

1. Define ISMS scope boundaries (locations, business units, systems)
2. Identify interested parties and their requirements
3. Perform gap analysis against ISO 27001:2022 requirements
4. Document internal and external context (PESTLE, SWOT)
5. Obtain top management commitment and allocate budget

Phase 2: Risk Assessment (Weeks 5-10)

1. Define risk assessment methodology (asset-based, scenario-based, or hybrid)
2. Create asset inventory covering information, people, processes, technology
3. Identify threats and vulnerabilities for each asset
4. Assess risk likelihood and impact using defined criteria
5. Calculate risk levels and determine risk treatment options (mitigate, accept, transfer, avoid)
6. Develop Risk Treatment Plan (RTP)

Phase 3: Control Selection and SoA (Weeks 11-14)

1. Map risk treatments to Annex A controls
2. Create Statement of Applicability (SoA) documenting:
   • Which controls are applicable and justification
   • Which controls are excluded and justification
   • Implementation status of each control
3. Design control implementation plans with owners and timelines

Phase 4: Implementation (Weeks 15-30)

1. Develop and approve information security policy
2. Implement selected Annex A controls
3. Create mandatory documented procedures:
   • Information Security Policy (A.5.1)
   • Risk Assessment Process (Clause 6.1.2)
   • Risk Treatment Process (Clause 6.1.3)
   • Internal Audit Programme (Clause 9.2)
   • Management Review Process (Clause 9.3)
   • Corrective Action Procedure (Clause 10.1)
4. Deploy technical controls and security tooling
5. Conduct security awareness training for all personnel

Phase 5: Internal Audit and Management Review (Weeks 31-36)

1. Plan and execute internal audit programme covering all clauses and applicable controls
2. Document audit findings and nonconformities
3. Implement corrective actions with root cause analysis
4. Conduct management review covering:
   • Status of previous actions
   • Changes in internal/external issues
   • Information security performance metrics
   • Audit results and risk assessment outcomes
   • Opportunities for improvement

Phase 6: Certification Audit (Weeks 37-42)

1. Stage 1 Audit: Documentation review, readiness assessment
2. Address Stage 1 findings
3. Stage 2 Audit: On-site assessment of ISMS effectiveness
4. Resolve any nonconformities (major NCRs require re-audit)
5. Receive ISO 27001 certification (valid for 3 years)

Phase 7: Continual Improvement (Ongoing)

1. Annual surveillance audits (Years 1 and 2)
2. Recertification audit (Year 3)
3. Regular risk reassessment and control effectiveness reviews
4. Incident-driven improvements and lessons learned integration

Key Artifacts

• ISMS Scope Document
• Information Security Policy
• Risk Assessment Methodology
• Risk Register and Risk Treatment Plan
• Statement of Applicability (SoA)
• Internal Audit Reports
• Management Review Minutes
• Corrective Action Register
• Metrics and KPI Dashboard

Common Pitfalls

• Scope too broad or too narrow, leading to audit complications
• Treating ISO 27001 as a checkbox exercise rather than embedding into business processes
• Insufficient top management involvement and commitment
• Failing to maintain documented evidence of control operation
• Not performing regular risk reassessments as the threat landscape changes
• Ignoring the 11 new controls in the 2022 edition during transition

Integration Points

• ISO 27002:2022: Detailed implementation guidance for Annex A controls
• ISO 27005: Information security risk management methodology
• ISO 27017: Cloud security controls
• ISO 27018: Protection of PII in cloud services
• ISO 27701: Privacy Information Management System (PIMS) extension
• NIST CSF 2.0: Cross-mapping for dual compliance
• SOC 2: Overlapping trust service criteria

References

• ISO/IEC 27001:2022 Information Security Management Systems
• ISO/IEC 27002:2022 Information Security Controls
• ISO/IEC 27005:2022 Information Security Risk Management
• ISMS.online ISO 27001 Annex A Guide: https://www.isms.online/iso-27001/annex-a-2022/
• IT Governance ISO 27001 Controls Guide: https://www.itgovernance.co.uk/blog/iso-27001-the-14-control-sets-of-annex-a-explained

Other files in this skill

• LICENSE
• assets/template.md
• references/api-reference.md
• references/standards.md
• references/workflows.md
• scripts/agent.py
• scripts/process.py

assets/template.md (verbatim)

ISO 27001:2022 Implementation Audit Checklist

Organization Information

Field	Value
Organization Name
ISMS Scope
Assessment Date
Assessor Name
Assessment Type	Gap Analysis / Internal Audit / Stage 1 / Stage 2

---

Clause 4: Context of the Organization

4.1 Understanding the Organization and its Context

• Internal issues identified and documented
• External issues identified and documented
• PESTLE analysis completed
• Issues regularly reviewed and updated
• Evidence: _______________
• Status: Conforming / Minor NC / Major NC / Not Assessed
• Notes: _______________

4.2 Understanding the Needs and Expectations of Interested Parties

• Interested parties identified
• Requirements of interested parties documented
• Legal, regulatory, and contractual requirements identified
• Requirements reviewed periodically
• Evidence: _______________
• Status: Conforming / Minor NC / Major NC / Not Assessed

4.3 Determining the Scope of the ISMS

• ISMS scope defined and documented
• Scope considers internal and external issues (4.1)
• Scope considers interested party requirements (4.2)
• Scope considers interfaces and dependencies
• Scope available as documented information
• Evidence: _______________
• Status: Conforming / Minor NC / Major NC / Not Assessed

4.4 Information Security Management System

• ISMS processes established
• ISMS implemented and maintained
• Continual improvement processes in place
• Evidence: _______________
• Status: Conforming / Minor NC / Major NC / Not Assessed

---

Clause 5: Leadership

5.1 Leadership and Commitment

• Top management demonstrates commitment to the ISMS
• Information security policy and objectives aligned with strategic direction
• ISMS requirements integrated into business processes
• Adequate resources provided
• Importance of information security communicated
• ISMS achieves its intended outcomes
• Persons directed and supported to contribute to ISMS effectiveness
• Continual improvement promoted
• Evidence: _______________
• Status: Conforming / Minor NC / Major NC / Not Assessed

5.2 Information Security Policy

• Policy appropriate to the purpose of the organization
• Policy includes information security objectives or framework for setting objectives
• Policy includes commitment to satisfy applicable requirements
• Policy includes commitment to continual improvement
• Policy available as documented information
• Policy communicated within the organization
• Policy available to interested parties as appropriate
• Evidence: _______________
• Status: Conforming / Minor NC / Major NC / Not Assessed

5.3 Organizational Roles, Responsibilities and Authorities

• Information security roles and responsibilities assigned and communicated
• Responsibility for ISMS conformance assigned
• Responsibility for reporting ISMS performance assigned
• Evidence: _______________
• Status: Conforming / Minor NC / Major NC / Not Assessed

---

Clause 6: Planning

6.1.1 General (Actions to Address Risks and Opportunities)

• Risks and opportunities considered (referencing 4.1 and 4.2)
• Actions planned to address risks and opportunities
• Plans for integrating actions into ISMS processes
• Plans for evaluating effectiveness of actions
• Evidence: _______________
• Status: Conforming / Minor NC / Major NC / Not Assessed

6.1.2 Information Security Risk Assessment

• Risk assessment process defined and documented
• Risk acceptance criteria established
• Criteria for performing risk assessments defined
• Risk assessment process produces consistent, valid, and comparable results
• Information security risks identified
• Risk owners identified
• Risk likelihood and impact assessed
• Risk levels determined
• Risk assessment results documented
• Evidence: _______________
• Status: Conforming / Minor NC / Major NC / Not Assessed

6.1.3 Information Security Risk Treatment

• Risk treatment options selected (mitigate, accept, avoid, transfer)
• Controls determined for risk treatment
• Controls compared with Annex A
• Statement of Applicability produced
• Risk treatment plan formulated
• Risk owners approve risk treatment plan and residual risks
• Evidence: _______________
• Status: Conforming / Minor NC / Major NC / Not Assessed

6.2 Information Security Objectives and Planning to Achieve Them

• Objectives established at relevant functions and levels
• Objectives consistent with information security policy
• Objectives measurable (where practicable)
• Objectives consider applicable requirements and risk assessment results
• Objectives communicated
• Objectives updated as appropriate
• Plans: what will be done, resources, responsibilities, timelines, evaluation
• Evidence: _______________
• Status: Conforming / Minor NC / Major NC / Not Assessed

6.3 Planning of Changes

• Changes to ISMS carried out in a planned manner
• Evidence: _______________
• Status: Conforming / Minor NC / Major NC / Not Assessed

---

Clause 7: Support

7.1 Resources

• Resources needed for ISMS determined and provided
• Evidence: _______________
• Status: Conforming / Minor NC / Major NC / Not Assessed

7.2 Competence

• Competence requirements determined for ISMS roles
• Competence ensured through education, training, or experience
• Actions taken to acquire competence where needed
• Evidence of competence retained
• Evidence: _______________
• Status: Conforming / Minor NC / Major NC / Not Assessed

7.3 Awareness

• Persons aware of information security policy
• Persons aware of their contribution to ISMS effectiveness
• Persons aware of implications of not conforming to ISMS requirements
• Evidence: _______________
• Status: Conforming / Minor NC / Major NC / Not Assessed

7.4 Communication

• Internal and external communication needs determined
• What to communicate defined
• When to communicate defined
• With whom to communicate defined
• How to communicate defined
• Evidence: _______________
• Status: Conforming / Minor NC / Major NC / Not Assessed

7.5 Documented Information

• Documented information required by ISO 27001 maintained
• Additional documented information determined by organization maintained
• Appropriate identification and description
• Appropriate format (language, software version, graphics)
• Appropriate review and approval
• Documented information available and suitable for use
• Adequate protection (loss of confidentiality, improper use, integrity loss)
• Distribution, access, retrieval, and use controlled
• Storage and preservation controlled
• Control of changes maintained
• Retention and disposition determined
• Evidence: _______________
• Status: Conforming / Minor NC / Major NC / Not Assessed

---

Clause 8: Operation

8.1 Operational Planning and Control

• Processes needed to meet ISMS requirements planned, implemented, and controlled
• Criteria for processes established
• Control of processes in accordance with criteria implemented
• Documented information retained to demonstrate processes carried out as planned
• Planned changes controlled
• Unintended changes reviewed and actions taken to mitigate adverse effects
• Outsourced processes controlled
• Evidence: _______________
• Status: Conforming / Minor NC / Major NC / Not Assessed

8.2 Information Security Risk Assessment

• Risk assessments performed at planned intervals
• Risk assessments performed when significant changes occur
• Results of risk assessments documented
• Evidence: _______________
• Status: Conforming / Minor NC / Major NC / Not Assessed

8.3 Information Security Risk Treatment

• Risk treatment plan implemented
• Results of risk treatment documented
• Evidence: _______________
• Status: Conforming / Minor NC / Major NC / Not Assessed

---

Clause 9: Performance Evaluation

9.1 Monitoring, Measurement, Analysis and Evaluation

• What needs to be monitored and measured determined
• Monitoring and measurement methods determined
• When monitoring and measuring shall be performed determined
• Who shall monitor and measure determined
• When results shall be analysed and evaluated determined
• Who shall analyse and evaluate results determined
• Results of monitoring and measurement documented
• Evidence: _______________
• Status: Conforming / Minor NC / Major NC / Not Assessed

9.2 Internal Audit

• Internal audit programme planned (frequency, methods, responsibilities)
• Audit programme considers importance of processes and previous audit results
• Audit criteria and scope defined for each audit
• Auditors selected to ensure objectivity and impartiality
• Audit results reported to relevant management
• Documented information retained as evidence of audit programme and results
• Evidence: _______________
• Status: Conforming / Minor NC / Major NC / Not Assessed

9.3 Management Review

• Management review conducted at planned intervals
• Review considers status of actions from previous reviews
• Review considers changes in external and internal issues
• Review considers feedback on information security performance
• Review considers feedback from interested parties
• Review considers risk assessment results and treatment plan status
• Review considers opportunities for continual improvement
• Decisions on improvement opportunities documented
• Decisions on changes needed to ISMS documented
• Evidence: _______________
• Status: Conforming / Minor NC / Major NC / Not Assessed

---

Clause 10: Improvement

10.1 Continual Improvement

• Suitability, adequacy, and effectiveness of ISMS continually improved
• Evidence: _______________
• Status: Conforming / Minor NC / Major NC / Not Assessed

10.2 Nonconformity and Corrective Action

• Nonconformities identified and reacted to
• Actions taken to control and correct nonconformities
• Consequences dealt with
• Need for action to eliminate root cause evaluated
• Corrective actions implemented
• Effectiveness of corrective actions reviewed
• Changes to ISMS made if necessary
• Documented information retained on nature of nonconformities, actions taken, and results
• Evidence: _______________
• Status: Conforming / Minor NC / Major NC / Not Assessed

---

Summary

Category	Total Items	Conforming	Minor NC	Major NC	Not Assessed
Clause 4
Clause 5
Clause 6
Clause 7
Clause 8
Clause 9
Clause 10
Total

Annex A Control Assessment (attach separately)

• Total Applicable Controls: _____ / 93
• Fully Implemented: _____
• Partially Implemented: _____
• Not Implemented: _____
• Not Applicable: _____

Recommendations

1. ---

2. ---

3. ---

Sign-off

Role	Name	Signature	Date
Assessor
ISMS Manager
Top Management

references/api-reference.md (verbatim)

API Reference: Implementing ISO 27001 Information Security Management

ISO 27001:2022 Clause Structure

Clause	Title	Key Deliverable
4	Context of the Organization	ISMS Scope Document
5	Leadership	Information Security Policy
6	Planning	SoA, Risk Treatment Plan
7	Support	Competence records, Awareness
8	Operation	Risk assessment/treatment results
9	Performance Evaluation	Audit reports, Management review
10	Improvement	Corrective action records

Annex A Control Categories (2022)

Category	Name	Controls
A.5	Organizational	37 controls
A.6	People	8 controls
A.7	Physical	14 controls
A.8	Technological	34 controls

Required Documented Information

Document	Clause
ISMS Scope	4.3
Information Security Policy	5.2
Risk Assessment Methodology	6.1.2
Statement of Applicability	6.1.3d
Risk Treatment Plan	6.1.3
Security Objectives	6.2
Internal Audit Program	9.2
Management Review Minutes	9.3

Risk Assessment Formula

Risk Level = Likelihood x Impact
- Likelihood: 1 (Rare) to 5 (Almost Certain)
- Impact: 1 (Negligible) to 5 (Catastrophic)
- Risk Rating: Low (1-6), Medium (7-12), High (13-19), Critical (20-25)

References

• ISO 27001:2022: https://www.iso.org/standard/27001
• ISO 27002:2022: https://www.iso.org/standard/75652.html
• ISO 27005 Risk Management: https://www.iso.org/standard/80585.html

references/standards.md (verbatim)

ISO 27001 Standards Reference

Primary Standards

ISO/IEC 27001:2022

• Title: Information Security, Cybersecurity and Privacy Protection - Information Security Management Systems - Requirements
• Published: October 2022
• Scope: Specifies requirements for establishing, implementing, maintaining, and continually improving an ISMS
• Certification: Organizations can be certified against this standard by accredited certification bodies
• Key Changes from 2013:
  • Annex A restructured from 14 domains to 4 themes (Organizational, People, Physical, Technological)
  • 93 controls (down from 114)
  • 11 new controls added
  • Title expanded to include "Cybersecurity and Privacy Protection"
  • Clause 6.3 added for planning changes to the ISMS

ISO/IEC 27002:2022

• Title: Information Security, Cybersecurity and Privacy Protection - Information Security Controls
• Role: Implementation guidance for Annex A controls
• Key Addition: Each control now includes attribute taxonomy:
  • Control type: Preventive, Detective, Corrective
  • Information security properties: Confidentiality, Integrity, Availability
  • Cybersecurity concepts: Identify, Protect, Detect, Respond, Recover
  • Operational capabilities: 15 categories (Governance, Asset Management, etc.)
  • Security domains: Governance and Ecosystem, Protection, Defence, Resilience

Supporting Standards in the ISO 27000 Family

ISO/IEC 27000:2018

• Overview and vocabulary for ISMS

ISO/IEC 27003:2017

• Guidance on ISMS implementation

ISO/IEC 27004:2016

• Information security management monitoring, measurement, analysis, and evaluation

ISO/IEC 27005:2022

• Guidance on managing information security risks
• Aligns with ISO 31000 risk management framework
• Provides asset-based and event-based risk assessment approaches

ISO/IEC 27006-1:2024

• Requirements for bodies providing audit and certification of ISMS

ISO/IEC 27007:2020

• Guidelines for ISMS auditing

ISO/IEC 27017:2015

• Code of practice for cloud services information security controls

ISO/IEC 27018:2019

• Code of practice for protection of PII in public clouds

ISO/IEC 27701:2019

• Extension to ISO 27001 for Privacy Information Management System (PIMS)
• Supports GDPR compliance

Annex A Control Categories Detail

A.5 Organizational Controls (37 controls)

Control	Title
A.5.1	Policies for information security
A.5.2	Information security roles and responsibilities
A.5.3	Segregation of duties
A.5.4	Management responsibilities
A.5.5	Contact with authorities
A.5.6	Contact with special interest groups
A.5.7	Threat intelligence (NEW)
A.5.8	Information security in project management
A.5.9	Inventory of information and other associated assets
A.5.10	Acceptable use of information and other associated assets
A.5.11	Return of assets
A.5.12	Classification of information
A.5.13	Labelling of information
A.5.14	Information transfer
A.5.15	Access control
A.5.16	Identity management
A.5.17	Authentication information
A.5.18	Access rights
A.5.19	Information security in supplier relationships
A.5.20	Addressing information security within supplier agreements
A.5.21	Managing information security in the ICT supply chain
A.5.22	Monitoring, review and change management of supplier services
A.5.23	Information security for use of cloud services (NEW)
A.5.24	Information security incident management planning and preparation
A.5.25	Assessment and decision on information security events
A.5.26	Response to information security incidents
A.5.27	Learning from information security incidents
A.5.28	Collection of evidence
A.5.29	Information security during disruption
A.5.30	ICT readiness for business continuity (NEW)
A.5.31	Legal, statutory, regulatory and contractual requirements
A.5.32	Intellectual property rights
A.5.33	Protection of records
A.5.34	Privacy and protection of PII
A.5.35	Independent review of information security
A.5.36	Compliance with policies, rules and standards for information security
A.5.37	Documented operating procedures

A.6 People Controls (8 controls)

Control	Title
A.6.1	Screening
A.6.2	Terms and conditions of employment
A.6.3	Information security awareness, education and training
A.6.4	Disciplinary process
A.6.5	Responsibilities after termination or change of employment
A.6.6	Confidentiality or non-disclosure agreements
A.6.7	Remote working
A.6.8	Information security event reporting

A.7 Physical Controls (14 controls)

Control	Title
A.7.1	Physical security perimeters
A.7.2	Physical entry
A.7.3	Securing offices, rooms and facilities
A.7.4	Physical security monitoring (NEW)
A.7.5	Protecting against physical and environmental threats
A.7.6	Working in secure areas
A.7.7	Clear desk and clear screen
A.7.8	Equipment siting and protection
A.7.9	Security of assets off-premises
A.7.10	Storage media
A.7.11	Supporting utilities
A.7.12	Cabling security
A.7.13	Equipment maintenance
A.7.14	Secure disposal or re-use of equipment

A.8 Technological Controls (34 controls)

Control	Title
A.8.1	User endpoint devices
A.8.2	Privileged access rights
A.8.3	Information access restriction
A.8.4	Access to source code
A.8.5	Secure authentication
A.8.6	Capacity management
A.8.7	Protection against malware
A.8.8	Management of technical vulnerabilities
A.8.9	Configuration management (NEW)
A.8.10	Information deletion (NEW)
A.8.11	Data masking (NEW)
A.8.12	Data leakage prevention (NEW)
A.8.13	Information backup
A.8.14	Redundancy of information processing facilities
A.8.15	Logging
A.8.16	Monitoring activities (NEW)
A.8.17	Clock synchronization
A.8.18	Use of privileged utility programs
A.8.19	Installation of software on operational systems
A.8.20	Networks security
A.8.21	Security of network services
A.8.22	Segregation of networks
A.8.23	Web filtering (NEW)
A.8.24	Use of cryptography
A.8.25	Secure development life cycle
A.8.26	Application security requirements
A.8.27	Secure system architecture and engineering principles
A.8.28	Secure coding (NEW)
A.8.29	Security testing in development and acceptance
A.8.30	Outsourced development
A.8.31	Separation of development, test and production environments
A.8.32	Change management
A.8.33	Test information
A.8.34	Protection of information systems during audit testing

Certification Process

1. Stage 1 Audit (Document Review): Auditor reviews ISMS documentation, scope, SoA, risk assessment methodology
2. Stage 2 Audit (Certification Audit): On-site assessment of ISMS implementation and effectiveness
3. Surveillance Audits: Annual audits in Years 1 and 2 to verify continued compliance
4. Recertification Audit: Full re-assessment in Year 3 before certificate expiry

Accreditation Bodies

• UKAS (United Kingdom)
• ANAB (United States)
• DAkkS (Germany)
• JAS-ANZ (Australia/New Zealand)
• COFRAC (France)

references/workflows.md (verbatim)

ISO 27001 Implementation Workflows

Workflow 1: ISMS Scoping and Context Analysis

Start
  |
  v
[Identify Internal Context]
  - Organization structure
  - Existing policies and processes
  - IT infrastructure and systems
  - Culture and capabilities
  |
  v
[Identify External Context]
  - Legal and regulatory requirements
  - Industry standards and obligations
  - Customer and partner requirements
  - Threat landscape and geopolitical factors
  |
  v
[Identify Interested Parties]
  - Customers and clients
  - Regulators and authorities
  - Employees and contractors
  - Shareholders and board members
  - Suppliers and partners
  |
  v
[Define ISMS Scope]
  - Business units in scope
  - Physical locations
  - Information systems and networks
  - Third-party services
  - Exclusions with justification
  |
  v
[Document ISMS Scope Statement]
  |
  v
[Obtain Top Management Approval]
  |
  v
End

Workflow 2: Risk Assessment Process

Start
  |
  v
[Define Risk Criteria]
  - Risk acceptance criteria
  - Likelihood scale (1-5)
  - Impact scale (1-5)
  - Risk matrix thresholds
  |
  v
[Create Asset Inventory]
  - Information assets
  - Software assets
  - Hardware assets
  - People (roles)
  - Services (cloud, third-party)
  - Physical locations
  |
  v
[Identify Threats]
  - Natural threats (fire, flood)
  - Human threats (insider, external attacker)
  - Technical threats (malware, system failure)
  - Supply chain threats
  |
  v
[Identify Vulnerabilities]
  - Technical vulnerabilities
  - Process weaknesses
  - People-related gaps
  - Physical security gaps
  |
  v
[Assess Existing Controls]
  - Document current controls
  - Evaluate control effectiveness
  |
  v
[Calculate Risk Level]
  Risk = Likelihood x Impact
  - Consider existing controls
  - Use defined risk criteria
  |
  v
[Compare Against Risk Acceptance]
  |
  +--> [Risk Acceptable] --> Document and Monitor
  |
  +--> [Risk Not Acceptable]
        |
        v
      [Select Risk Treatment]
        - Mitigate (apply controls)
        - Transfer (insurance, outsource)
        - Avoid (stop activity)
        - Accept (with justification)
        |
        v
      [Map to Annex A Controls]
        |
        v
      [Document in Risk Treatment Plan]
        |
        v
      [Update Statement of Applicability]
        |
        v
      End

Workflow 3: Statement of Applicability (SoA) Creation

Start
  |
  v
[List All 93 Annex A Controls]
  |
  v
[For Each Control]
  |
  v
[Is Control Required by Risk Treatment?]
  |
  +--> Yes --> Mark as Applicable
  |             - Link to risk(s)
  |             - Document implementation status
  |             - Assign control owner
  |
  +--> No --> [Is Control Required by Law/Contract?]
               |
               +--> Yes --> Mark as Applicable
               |             - Document legal/contractual basis
               |
               +--> No --> [Is Control Best Practice?]
                            |
                            +--> Yes --> Mark as Applicable
                            |             - Document business justification
                            |
                            +--> No --> Mark as Not Applicable
                                        - Document exclusion justification
  |
  v
[Review SoA Completeness]
  - All 93 controls addressed
  - Every exclusion justified
  - Implementation status documented
  |
  v
[Approve SoA]
  |
  v
End

Workflow 4: Internal Audit Programme

Start
  |
  v
[Plan Audit Programme]
  - Define audit scope (clauses and controls)
  - Schedule audits across the year
  - Assign qualified auditors (independent of audited area)
  - Prepare audit criteria and checklists
  |
  v
[Conduct Audit]
  - Opening meeting with auditees
  - Review documented information
  - Interview key personnel
  - Observe processes in action
  - Collect objective evidence
  - Closing meeting with preliminary findings
  |
  v
[Document Findings]
  - Major Nonconformities (systemic failure, absence of control)
  - Minor Nonconformities (isolated failure, partial implementation)
  - Observations (potential for improvement)
  - Opportunities for Improvement (OFIs)
  |
  v
[Issue Audit Report]
  |
  v
[Corrective Action Process]
  - Containment: immediate action to limit impact
  - Root Cause Analysis: identify underlying cause
  - Corrective Action: implement fix to prevent recurrence
  - Verification: confirm effectiveness of correction
  |
  v
[Track to Closure]
  |
  v
[Feed into Management Review]
  |
  v
End

Workflow 5: Management Review

Start
  |
  v
[Prepare Review Inputs]
  - Status of actions from previous reviews
  - Changes in external/internal issues
  - Changes in interested party needs
  - Information security performance:
    * Nonconformities and corrective actions
    * Monitoring and measurement results
    * Audit results
    * Fulfilment of objectives
  - Feedback from interested parties
  - Results of risk assessment and treatment plan
  - Opportunities for continual improvement
  |
  v
[Conduct Management Review Meeting]
  - Present ISMS performance data
  - Discuss risk landscape changes
  - Review incident trends
  - Evaluate resource adequacy
  |
  v
[Document Review Outputs]
  - Decisions on continual improvement opportunities
  - Changes needed to the ISMS
  - Resource allocation decisions
  - Updated risk acceptance criteria (if needed)
  |
  v
[Assign Actions with Owners and Deadlines]
  |
  v
[Track Implementation]
  |
  v
End

Workflow 6: Certification Audit Preparation

Start
  |
  v
[Pre-Audit Readiness Check]
  - All mandatory documents in place
  - SoA current and approved
  - Risk assessment completed
  - Internal audit completed
  - Management review conducted
  - Corrective actions closed
  |
  v
[Select Certification Body]
  - Verify UKAS/ANAB accreditation
  - Compare audit team experience
  - Review commercial terms
  |
  v
[Stage 1 Audit (Documentation Review)]
  - Auditor reviews ISMS documentation
  - Assesses readiness for Stage 2
  - Identifies any significant gaps
  |
  v
[Address Stage 1 Findings]
  - Resolve documentation gaps
  - Complete any missing processes
  |
  v
[Stage 2 Audit (Certification Audit)]
  - On-site assessment (typically 3-5 days)
  - Evidence-based verification
  - Interviews across the organization
  - Technical control testing
  |
  v
[Audit Outcome]
  |
  +--> [No Major NCRs] --> Certificate Issued
  |
  +--> [Major NCRs Found]
        |
        v
      [Resolve NCRs within 90 days]
        |
        v
      [Follow-up Audit]
        |
        v
      [Certificate Issued]
  |
  v
End

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.