ISO/IEC 27001 OPERATIONAL PACKAGE

ISMS Scope · Statement of Applicability · Annex A Mapping · Internal Audit · Management Review

Table of Contents

1. Purpose and Scope
2. ISMS Boundary
3. ISO 27001 Operating Model
4. Statement of Applicability
5. Annex A Mapping
6. Risk Assessment and Treatment Interface
7. Internal Audit Program
8. Management Review Package
9. Certification and External Audit Interface
10. Evidence Library
11. Metrics
12. Roles and Responsibilities
13. Regulatory and Framework Alignment Summary
14. Document Control

1. Purpose and Scope

CERG already aligns many artifacts to ISO/IEC 27001 and ISO/IEC 27002. Alignment is not the same thing as operating an Information Security Management System. An ISO-ready program needs an ISMS scope, a Statement of Applicability, risk treatment linkage, internal audit, management review, corrective actions, and evidence organized for assessors.

This operational package turns the CERG library into an ISO-operable system. It is designed for organizations seeking formal certification, customer-assurance readiness, or disciplined internal operation against ISO/IEC 27001 without immediate certification.

ISO Is a Management System, Not a Control Checklist

Annex A matters, but certification succeeds or fails on the management system: scope, risk treatment, evidence, internal audit, corrective action, and management review. A control may be technically strong and still fail ISO if the organization cannot show why it is in scope, who owns it, how it is reviewed, and what happens when it fails.

2. ISMS Boundary

The ISMS scope statement defines what the ISO program covers. It is approved by the CISO and reviewed at least annually.

Minimum scope fields:

A scope exclusion is valid only when it is truthful, documented, and does not hide a control failure. Exclusions are reviewed during internal audit and management review.

3. ISO 27001 Operating Model

4. Statement of Applicability

The Statement of Applicability (SoA) is the authoritative ISO control decision record. It states which Annex A controls apply, why they apply, which CERG artifacts implement them, and whether any control is excluded.

Minimum SoA fields:

A Bad SoA Is Worse Than No SoA

A copied SoA that says every control applies and everything is implemented tells the auditor the program has not done real scoping. A useful SoA makes decisions visible: what applies, what does not, why, who owns it, and what evidence proves the claim.

5. Annex A Mapping

The mapping below is the starting spine. The maintained SoA provides row-level detail.

Controls owned outside CERG are not ignored. They are listed in the SoA with the external evidence owner and the CERG dependency clearly stated.

6. Risk Assessment and Treatment Interface

ISO risk treatment uses the CERG risk register rather than a parallel ISO-only risk log. ISO-specific risk requirements are met by ensuring each ISMS-scope risk includes:

• risk statement;
• asset or process scope;
• likelihood, impact, and rating;
• selected treatment;
• treatment owner;
• target date;
• linked Annex A controls;
• linked SoA row;
• residual risk decision;
• approver;
• review date.

Risk treatment decisions that leave a control gap use CERG-PRC-RM-001 exception or acceptance workflow.

7. Internal Audit Program

The ISO internal audit program uses CERG-PRC-AUD-001 and adds ISO-specific scope and independence rules.

Minimum audit schedule:

Internal auditors must be independent of the control operation being audited. In small organizations, independence may mean cross-pillar review, external reviewer support, or documented CISO-approved independence constraints.

8. Management Review Package

Management review is held at least annually and before certification or surveillance audits.

Management review package contents:

1. ISMS scope changes.
2. Internal audit results.
3. External audit findings.
4. Risk posture and material risk changes.
5. SoA changes and exclusions.
6. Control performance metrics.
7. Corrective action status.
8. Supplier and third-party security issues.
9. Incident and continuity lessons.
10. Resource constraints and improvement needs.
11. Decisions and assigned actions.

Management review minutes are retained as evidence. Decisions that create work become tracked actions, risk-register entries, or cataloged document updates.

9. Certification and External Audit Interface

For certification readiness, Governance maintains an audit pack:

• ISMS scope statement;
• information security policy;
• SoA;
• risk assessment and treatment records;
• internal audit schedule and results;
• management review records;
• corrective action register;
• evidence index mapped to Annex A;
• document catalog and version record;
• list of exclusions and interfaces owned outside CERG.

External auditor requests are handled through CERG-PRC-AUD-001. Auditor observations that indicate control weakness become findings or risks, not side emails.

10. Evidence Library

Evidence is organized by ISO requirement and by CERG control source.

11. Metrics

12. Roles and Responsibilities

Roles below are canonical role names from CERG-GOV-OM-001 §6.1.

13. Regulatory and Framework Alignment Summary

14. Document Control

Revision History

Review Triggers

• Material ISMS scope change
• ISO certification, surveillance, or recertification audit
• Material SoA change or control exclusion
• Major internal audit finding or external nonconformity
• Management review direction
• Direction from the CISO

Cyber Governance owns this package. The Governance Pillar Leader is responsible for initiating reviews, managing the revision cycle, and obtaining CISO approval for all changes.

Related Documents

Source: plans/CERG-PLN-ISO-001_ISO_IEC_27001_Operational_Package.md · Download .md · View on GitHub