CHAPTER 14: IMPLEMENTATION

Implementation of the ISMS involves the following five tasks:

•  Implement the risk treatment plan and the controls identified in the SoA (8.3).

•  Define how to measure and assess the effectiveness of all the controls (9.1.b).

•  Implement training and awareness programmes (7.2 and 7.3), which links to Control A.7.2.2 – information security awareness, education and training.

•  Manage the ISMS (8.1). All the interlocking controls and processes must be kept working, and new threats identified, evaluated and, if necessary, neutralised. People must be recruited and trained, their performance supervised, and their skills developed in line with the changing needs of the business.

•  Implement an incident detection and response procedure (10.1), which links to Clause 16 of Annex A, information security incident management. This clause contains seven controls that differentiate between an event and an incident and define how the response should be managed.