ISO 27002:2021 | Information Security, Cybersecurity & Privacy Protection

ISO 27002:2021 Gap Analysis

Information Security, Cybersecurity & Privacy Protection

General105

This edition of ISO 27002 establishes the criteria for best practice in the management of Information Security, Cybersecurity & Privacy Protection, relevant to both ISO 27001 and EU-GDPR. The controls required to meet the requirements of this Standard correlate comprehensively with the legislative requirements of EU-GDPR, for appropriate technical and organizational measures, organization-wide.

For a brief introduction to this Standard an the Enable ISO Statement of Applicability (SoA), please click on the following link.

Watch the Video

Introduction

Subsequent to our initial Scope Meeting, where we discuss the scope of the gap analysis relevant to the organization, we open our Gap Analysis engagements with 3 sessions.

Where the organization has prepared a Statement of Appicability (SoA), the initial evaluation is required so that the assigned Consultant Lead Auditor can assess the disposition of the organization relevant to the requirements of the Standard and EU-GDPR.
For organizations who are beginning their ISO journey, we amalgamate the time allocated for the initial evaluation with the Opening Session, so that the relevant aspects can be discussed to plan for an effective gap analysis.

Initial Offline Evaluation

This initial engagement includes a high level review of the organizations Statement of Applicability (SoA) along with relevant policies and records to support their compliance obligations toward information security.

This evaluation is carried out by the assigned Consultant Lead Auditor, who will then lead the gap analysis through to completion.

Time allocation: 60-90 minutes, depening on the organization.

Opening Session

A meeting to introduce the audit methodology and prepare for the scheduled sessions.

This meeting also provides an opportunity to discuss relevant Contextual Issues, including those associated with the requirements of Interested Parties.

At this stage of the analysis, stategic interests need to be considered, where they may have a portential impact on the organization's ability to effectively manage information security.

Time allocation: 60-90 minutes, depening on the organization.

Offline Internal Evaluation

Organizational documentation is evaluated by the auditor to determine requirements for evaluation throughout the engagement.

The assigned Consultant Lead Auditor will use the learnings from this evaluation to effectively prepare for the scheduled gap analysis sessions to follow.

Time allocation: 120-240 minutes, depening on the organization.

Each session looks at a number of subclauses of ISO 27002:2021, grouped by topical aspect and function. This element of the gap analysis evaluates the organizations disposition toward organizational controls required for effective information and privacy security management.

There are 6 remote sessions to be arranged of varying durations. Each session may require the participation of different management representatives, dependent on their responsibilities toward information security relevant to the analysis criteria.

Part 1: Management Responsibilities

A meeting with the leadership team to evaluate the organization's position with regard to policy requirements, management responsibilities, and how internal and external contextual issues relevant to information security are identified to inform threat intelligence.

In addition, governance with regard to project management, regardless of the type of project, is considered, where relevant to the organization.

It is expected that the nominated management representatives participating in this session will have a good understanding of how the organization currently manages these aspects.

It may be necessary for an appointed DPO to be present, where applicable.

Time allocation: 60-90 minutes, depending on the organization

Part 2: Information Asset Management & Access Control

A review of how the organization provides for inventories of systems, applications and data assets.

This session looks closely at asset classification relevant to EU-GDPR. Appropriate labelling of information assets to meet organizational requirements is also considered.

Access to information and systems is evaluated against the criteria to determine the effectiveness of current measures.

The minimum expectation is for the principle of least privilege to be the governing rule of thumb.

To achieve the best outcomes from this session, the management representatives for IT systems and Access Control need to participate.

This may require engaging with external providers as applicable to the organization.

Time allocation: 60-90 minutes, depending on the organization

Part 3: Supply Chain Security

This session addresses supplier relationships, where external providers may have an impact on information security.

Contractual arrangements come under review to determine the effectiveness of current controls and identify areas for improvement, where applicable.

The Standard Contractual Clauses or "Model Clauses", as promoted by EU-GDPR, are used as a benchmark relevant to organizational requirements.

Importantly, the management representatives responsible for managing supplier relationships need to be available to participate in this session for effective progress to be made.

Time allocation: 60-90 minutes, depending on the organization

Part 4: Incident Response

How the organization determines its incident response activities, resources and planning requirements comes under evaluation in this session.

The focus is on maintaining the confidentiality, integrity and availability of the data being processed.

This session can benefit from the participation of relevant team leaders and department heads, where they are responsible for significant data processing activities, or where there may be areas of concern relevant to incident response.

Time allocation: 45-60 minutes, depending on the organization

Part 5: Business Continuity

The primary focus of this session is to evaluate how the organization provides for business continuity management during a disruptive event.

How specific categories of events are assessed for business continuity requirements, through to testing the abilities of the organization to deliver to those needs, comes into consideration.

As with incident management, relevant personnel need to participate to achieve the best results.

Time allocation: 45-60 minutes, depending on the organization

Part 6: Compliance

Relevant to EU-GDPR and other applicable data protection legislation, the requirements of the organization are considered to determine the effectiveness of the provisions in this regard.

Where applicable, Intellectual Property management is discussed to determine relevant controls.

Internal audit functions, including technical and code reviews, where applicable, are considered.

The importance of an independent review of technical and organizational measures is discussed. (The gap analysis provides for this requirement relevant to ISO 27001 Certification).

Management representatives for compliance, data governance, IT security, etc., need to participate to achieve best outcomes.

It may be necessary for the appointed DPO to be available, where applicable.

Time allocation: 60-90 minutes, depending on the organization

The importance of appropriate organizational controls relevant to people or personnel management cannot be underestimated. Our analysis of people controls for ISO 27002:2021 considers organizational requirements for contractual arrangements, including non-disclosure, responsibilities toward the reporting of information security issues and concerns, responsibilities for information assets, etc.

People controls are evaluated through 2 remote sessions, with participation from the relevant management representatives.

Part 1: People 1

Employee contractual arrangements, training, and internal reporting and disciplinary procedures are reviewed as part of this session.

Provisions for ongoing awareness of information security policies and controls are evaluated.

Changes to terms of employment, changing roles, etc., are also considered.

Participation is required by management representatives who have authority and access to relevant documents and records, for effective progress to be made.

Time allocation: 45-75 minutes, depending on the organization

Part 2: People 2

The terms of non-disclosure relevant to organizational requirements are assessed to determine the effectiveness of established controls.

Also, the significance of information security relevant to remote working is considered to ensure appropriate controls are in place.

Importantly, formal mechanisms for the reporting of information security issues and concerns are assessed for effectiveness.

Management representatives with a full understanding of the data processing requirements of operations, need to participate in this session for good progress to be made.

Time allocation: 30-45 minutes, depending on the organization

Physical and environmental security controls are critical to the information security requirements of any organizatiion. For ISO 27002:2021, the physical controls are provided for through a number of subclauses, which we address in 3 remote sessions.

Video footage of walk-abouts at relevant locations, demonstrating good practice in areas such as perimeter security and access to premises, protection of controlled processing areas, segregated work areas, common areas, etc., can be used to support the gap analysis. In some circumstances, it may be necessary to arrange a location visit to validate specific requirements.

Part 1: Physical Security Controls

In this session we look closely at the physical security requirements for data processing facilities and workplaces.

Perimeter and internal security, protected work areas, document storage, server and comm's rooms, all come under consideration, where applicable.

Monitoring and inspections to evaluate and maintain the effectiveness of physical security controls are also considered at this stage.

To achieve the best results, management representatives with responsibilities for physical security are required to participate.

This may require some input from those with leadership responsibilities in operations, admin, and other organizational functions, as applicable.

Time allocation: 45-60 minuts, depending on the organization

Part 2: Secure Operations

Resourcing information security in operations and data processing is the main consideration for this session.

At this stage, we evaluate the effectiveness of established controls for continued suitability and effectiveness.

Siting of equipment, clear desk and clear screen controls are considered, where appropriate.

Where the organization processes or stores data at off-site or at secondary locations, information security controls are considered relevant to the needs of the organization.

Management representatives with responsibilities toward physical security, IT security and operations will be required to provide input into this session in order to achieve best outcomes.

Time allocation: 30-60 minutes, depending on the organization

Part 3: Media & Equipment Security

In this session, we evaluate the effectiveness of established information security controls for the management of data storage and repositories, cabling and routing, and the provision of utilities and other critical services necessary for effective operations.

In addition, we evaluate how the organization maintains and disposes of information assets at end-of-life or through planned purges, etc.

To achieve the best results, participation is required from management representatives with responsibilities for maintaining information systems, and the subsequent disposal of information assets, whether data or physical assets.

Time allocation: 45-60 minutes, depending on the organization

A total of 8 remote sessions are required to cover the criteria of this section of the ISO 27002:2021 Standard, which addresses the criteria for the technical measures required for the organization, relevant to both the Standard and EU-GDPR.

For each session, management representatives responsible for IT systems, access and control, are required to participate. External providers with responsibilities toward these aspects may also need to participate to achieve best outcomes.

Part 1: Endpoint Security

Reference: Information Asset Management & Access Control (Above)

In this session we review the established controls over information assets, relevant to the classification scheme adopted by the organization, and other considerations determined when we looked at Organization Controls for asset management and access control.