ISO IEC 27001 2005

INFORMATION SECURITY STANDARD

TRANSLATED INTO PLAIN ENGLISH

• Define your organization’s ISMS.

• Implement your organization’s ISMS.

• Operate your organization’s ISMS.

• Monitor your organization’s ISMS.

• Review your organization’s ISMS.

• Maintain your organization’s ISMS.

• Improve your organization’s ISMS.

• Document your organization’s ISMS.

• Define the scope and boundaries of your ISMS.

• Define your organization’s ISMS policy.

• Define your approach to risk assessment.

• Identify your organization’s security risks.

• Analyze and evaluate your organization’s security risks.

• Identify and evaluate risk treatment options and actions.

• Select control objectives and controls to treat risks.

• Make sure that management formally approves all
  residual risks (those that are left over after you’ve
  implemented your risk treatment decisions).

• Get authorization from management before you
  implement and operate your organization’s ISMS.

• Prepare a Statement of Applicability that lists your organization’s specific control objectives and controls.

• Develop a risk treatment plan to manage your
  organization’s information security risks.

• Implement your organization’s risk treatment plan.

• Implement your organization’s security controls.

• Implement your organization’s educational programs.

• Manage and operate your organization’s ISMS.

• Manage your organization’s ISMS resources.

• Implement your organization’s security procedures.

• Use procedures and controls to monitor your ISMS.

• Use procedures and controls to review your ISMS.

• Perform regular reviews of your ISMS.

• Verify that your security requirements are being met.

• Review your risk assessments on a regular basis.

• Review your residual risks on a regular basis.

• Review acceptable levels of risk on a regular basis.

• Perform regular internal audits of your ISMS.

• Perform regular management reviews of your ISMS.

• Update your information security plans.

• Maintain a record of ISMS events and actions.

• Implement your ISMS improvements.

• Take appropriate corrective actions.

• Take appropriate preventive actions.

• Apply the security lessons that you have learned.

• Communicate ISMS changes to all interested parties.

• Make sure that your organization’s ISMS changes
  achieve the intended objectives.

• Establish records that document decisions.

• Document your organization’s ISMS.

• Protect and control your ISMS documents.

• Establish a procedure to control ISMS documents.

• Establish records for your organization’s ISMS.

• Maintain records for your organization’s ISMS.

• Demonstrate that your management
  supports the establishment of an ISMS.

• Demonstrate that your management
  supports the implementation of an ISMS.

• Demonstrate that your management
  supports the operation of your ISMS.

• Demonstrate that your management
  supports the monitoring of your ISMS.

• Demonstrate that your management
  supports the review of your ISMS.

• Demonstrate that your management
  supports the maintenance of your ISMS.

• Demonstrate that your management
  supports the improvement of your ISMS.

• Identify your organization’s ISMS resource needs.

• Provide the resources that your ISMS needs.

• Identify the resources that will be needed in order to
  ensure that your organization’s information security procedures support its business requirements.

• Identify the resources needed to meet your
  organization’s legal security requirements.

• Identify the resources needed to meet your
  organization’s regulatory security requirements.

• Identify the resources needed to meet your
  organization’s contractual security obligations.

• Identify the resources needed to ensure that all
  implemented security controls are correctly applied.

• Identify the resources needed to ensure that ISMS management reviews are routinely carried out.

• Identify the resources needed to ensure that
  you will be able to react appropriately to the
  results of your ISMS management reviews.

• Identify the resources needed to ensure that
  you will be able to improve the effectiveness
  of your ISMS when required to do so.

• Ensure that all ISMS personnel are competent and
  can perform the tasks that are assigned to them.

• Evaluate the effectiveness of your organization’s
  ISMS personnel training and employment activities.

• Maintain records that document the competence
  of personnel performing work that affects your ISMS.

• Make your personnel aware of how important
  their information security activities are.

• Establish an internal ISMS audit procedure.

• Document your internal ISMS audit procedure.

• Plan your internal ISMS audit projects and activities.

  • Figure out how often internal audits should be done.

  • Schedule your internal audits at planned intervals.

  • Clarify the scope of each internal ISMS audit.

  • Specify the audit criteria for each internal audit.

  • Define your internal ISMS audit methods.

  • Select your internal ISMS auditors.

• Carry out regular internal ISMS audits.

  • Audit your organization’s ISMS control objectives.

  • Audit your organization’s ISMS controls.

  • Audit your organization’s ISMS processes.

  • Audit your organization’s ISMS procedures.

• Eliminate nonconformities and their causes.

• Take follow up actions to ensure that nonconformities
  and causes have been eliminated without undue delay.

  • Verify that remedial actions have actually been taken.

  • Report the results of your verification activities.

• Carry out management reviews of your ISMS.

  • Make sure that your organization’s management
    people review your ISMS at planned intervals.

• Examine the performance of your ISMS.

  • Examine the ongoing suitability of your ISMS.

  • Examine the ongoing adequacy of your ISMS.

  • Examine the ongoing effectiveness of your ISMS.

• Assess whether or not your organization’s
  ISMS should be changed or improved.

  • Assess whether or not your information
    security policy should be changed or improved.

  • Assess whether or not your information security objectives should be changed or improved.

• Keep a record of your ISMS management reviews.

  • Record the results of ISMS management reviews.

• Examine information about your ISMS (inputs).

  • Examine the results of prior management reviews.

  • Examine the results of previous ISMS audits.

  • Examine previous ISMS measurement results.

  • Examine the status of previous remedial actions.

  • Examine security issues that were inadequately addressed during the previous risk assessment.

  • Examine opportunities to improve your ISMS.

  • Examine changes that might affect your ISMS.

• Generate decisions and actions (outputs).

  • Generate management review decisions and
    actions to improve your organization’s ISMS.

  • Generate management review decisions and
    actions to update your organization’s ISMS.

  • Generate management review decisions and
    actions to respond to events that affect the ISMS.

  • Generate management review decisions and
    actions to address your ISMS resource needs.

• Improve the effectiveness of your ISMS.

  • Use your security policy to continually
    improve the effectiveness of your ISMS.

  • Use your security objectives to continually
    improve the effectiveness of your ISMS.

  • Use your security audit results to continually
    improve the effectiveness of your ISMS.

  • Use your management reviews to continually
    improve the effectiveness of your ISMS.

  • Use your corrective actions to continually
    improve the effectiveness of your ISMS.

  • Use your preventive actions to continually
    improve the effectiveness of your ISMS.

  • Use your monitoring process to continually
    improve the effectiveness of your ISMS.

• Establish a corrective action procedure to prevent
  the recurrence of actual nonconformities.

  • Make sure that your corrective action procedure
    expects you to identify actual nonconformities.

  • Make sure that your corrective action procedure expects you to identify the causes of your nonconformities.

  • Make sure that your procedure expects you
    to evaluate whether you need to take action.

  • Make sure that your procedure expects you to
    develop corrective actions when they are needed.

  • Make sure that your procedure expects you to
    prevent the recurrence of actual nonconformities.

  • Make sure that your corrective action procedure
    expects you to eliminate the causes of your organization’s nonconformities.

  • Make sure that your procedure expects you to
    record the results of any corrective actions taken.

  • Make sure that your procedure expects you to
    review the results of any corrective actions taken.

• Document your corrective action procedure.

• Implement your corrective action procedure.

  • Use your organization’s corrective action
    procedure to identify nonconformities.

  • Use your organization’s corrective
    action procedure to identify causes.

  • Use your procedure to evaluate whether
    or not you need to take corrective action.

  • Use your procedure to develop corrective actions whenever corrective actions are actually needed.

  • Use your procedure to take corrective actions.

  • Use your procedure to prevent the
    recurrence of actual nonconformities.

  • Use your procedure to eliminate the
    causes of actual nonconformities.

  • Use your procedure to record the
    results of any corrective actions taken.

  • Use your procedure to review the
    corrective actions that have been taken.

• Maintain your corrective action procedure.

• Establish a preventive action procedure to prevent
  the occurrence of potential nonconformities.

  • Make sure that your preventive action procedure
    expects you to identify potential nonconformities.

  • Make sure that your procedure expects you to
    identify the causes of potential nonconformities.

  • Make sure that your procedure expects you to
    evaluate whether or not your organization needs
    to take preventive action.

  • Make sure that your procedure expects you to
    develop preventive actions when they are needed.

  • Make sure that your procedure expects you to
    prevent the occurrence of potential nonconformities.

  • Make sure that your procedure expects you to
    eliminate the causes of potential nonconformities.

  • Make sure that your procedure expects you to
    record the results of any preventive actions taken.

  • Make sure that your procedure expects you to
    review the results of any preventive actions taken.

• Document your preventive action procedure.

• Implement your preventive action procedure.

  • Use your organization’s preventive action
    procedure to identify potential nonconformities.

  • Use your preventive action procedure to identify
    the causes of potential nonconformities.

  • Use your preventive action procedure to evaluate
    whether or not you need to take preventive action.

  • Use your preventive action procedure to develop preventive actions whenever they are needed.

  • Use your procedure to take preventive actions.

  • Use your preventive action procedure to prevent
    the occurrence of potential nonconformities.

  • Use your preventive action procedure to eliminate
    the causes of potential nonconformities.

  • Use your preventive action procedure to record
    the results of any preventive actions taken.

  • Use your preventive action procedure to review
    the preventive actions that have been taken.

• Maintain your preventive action procedure.

ISO IEC 27001 IN PLAIN ENGLISH

This page summarizes the ISO IEC 27001 2005 standard.
It highlights the main points. It does not present detail.

If you need a detailed and complete interpretation of
ISO IEC 27001 2005,  please consider purchasing our Title 35: ISO 27001 2005 Translated into Plain English.
Our plain English ISO 27001 standard is 110 pages long.
It includes all information security requirements,
definitions, control objectives, and controls.
Check out our Title 35 Table of Contents.
Check out a Sample of our Title 35 (pdf).
Check our Prices. Place an Order.
Contact Praxiom Research.

 Our Title 35 provides a detailed, accurate, and complete
interpretation of  ISO IEC 27001 2005. It uses language that
is clear, precise, and easy to understand. We guarantee it! 

Introduction to the ISO IEC 27001 2005 Security Standard

Overview of ISO IEC 27001 2005 Information Security Standard

ISO IEC 27001 Plain English Information Security Definitions

ISO IEC 27001 2005 Information Security Gap Analysis Tool

Our Plain English Approach to ISO IEC 27001 2005

Introduction to ISO 27002 2005 Information Security Standard

Overview of the ISO 27002 2005 Information Security Standard

ISO 27002 2005 Security Standard Translated into Plain English

List of ISO 27002 2005 Information Security Control Objectives

ISO 27002 2005 Information Security Management Audit Tool

ALSO SEE our ISO 90003 Software Quality Management Library

Overview of the ISO 27001 Standard

International  Organization for Standardization

Frequently Asked Questions about Information Security

Home Page