SP-018: Information Security Management System (ISMS) Module
Diagram:
Legend: Information Security Management System based on Plan, Do, Check, Act Model with specific reference to Policy controls through catalog, plus Certification and Incident Response.
Description: The Plan, Do, Check, Act model is an accepted lifecycle for information security management. The plan phase focuses on setting policies, a strategy for implementing controls to achieve security objectives, and specific roadmaps to acheive control implementations within systems. Controls are executed in the do phase. Tests are performed in the check phase to ensure that controls are operating as intended and meet objectives. Deficiencies or gaps are remediated in the act phase and the cycle repeats.
Generally control execution lies with system owners and operators and is distributed across the organisation and it's suppliers, especially with increasing us of SaaS and cloud models. Some control execution can lie with the Security organisation, especially controls specifically related to the security of the overall environment such as incident response.
The NIST Risk Management framework defines a more detailed security lifecycle that focuses on the implementation of controls in a specific IT system rather than at the overall ISMS level.
Assumptions: Plan, Do, Check, Act Model is basis for lifecycle.
Typical challenges: Structured planning approach can be difficult to embed into the organisation and requires commitment from senior management over extended periods of time.
Indications: Organisation with computing environment that must be secured in a structured manner to meet Business, Legal, Regulatory or Industry requirements.
Contra-indications: None
Resistance against threats: Not applicable
References:
ISO 27001 ISMS
NIST Risk Management Framework
Related patterns: n/a
Classification: Module
Release: 08.02
Authors: Russell Wing
Reviewer(s): Pending
Control details
AC-01 Access Control Policies and Procedures
AC-13 Supervision And Review -- Access Control
AT-01 Security Awareness And Training Policy And Procedures
AT-05 Contacts With Security Groups And Associations
AU-01 Audit And Accountability Policy And Procedures
CA-02 Security Assessments
CA-04 Security Certification
CA-05 Plan Of Action And Milestones
CA-07 Continuous Monitoring
CA-01 Certification, Accreditation, And Security Assessment Policies And Procedures
CM-01 Configuration Management Policy And Procedures
CP-01 Contingency Planning Policy And Procedures
IA-01 Identification And Authentication Policy And Procedures
IR-01 Incident Response Policy And Procedures
IR-04 Incident Handling
IR-05 Incident Monitoring
IR-06 Incident Reporting
IR-07 Incident Response Assistance
MA-01 System Maintenance Policy And Procedures
MP-01 Media Protection Policy And Procedures
PE-01 Physical And Environmental Protection Policy And Procedures
PL-01 Security Planning Policy And Procedures
PS-01 Personnel Security Policy And Procedures
RA-01 Risk Assessment Policy And Procedures
RA-05 Vulnerability Scanning
SA-01 System And Services Acquisition Policy And Procedures
SC-01 System And Communications Protection Policy And Procedures
SI-01 System And Information Integrity Policy And Procedures
SI-05 Security Alerts And Advisories