CY9: Standards, law and compliance
ISO/IEC 27001
🎯You'll be able to
Explain what ISO 27001 certification means, its main parts, and how certification audits work.
🏠The everyday picture
A restaurant's kitchen certificate doesn't promise every meal will be perfect. It shows the kitchen runs a system of checks, cleaning and training, and that an inspector found it working.
📘What it really is
-
ISO/IEC 27001 sets requirements for an information security management system (ISMS): a managed way of finding risks, choosing controls, running them and improving them.
-
Core requirements: the scope (which parts of the organisation), leadership commitment, a risk assessment and treatment plan, objectives, internal audits, management reviews and continual improvement.
-
Annex A in the 2022 version lists 93 controls in four themes: organisational, people, physical and technological. The Statement of Applicability says which apply, which don't, and why.
-
Certification: an accredited certification body audits in two stages (documents, then the system in operation). Certificates last three years, with surveillance audits each year in between.
-
Scope matters: a certificate covers only its stated scope. "Certified" for one office says nothing about another.
- ISO 27002 gives guidance on implementing the controls; it isn't certified against by itself.
📝A worked example
Input: AarogyaDesk wants to prepare for ISO 27001 one day.
Steps:
- Define a scope: the AarogyaDesk app, its servers and the staff who run it.
- Reuse the CY1 risk register as the start of the risk assessment, and pick controls from Annex A for each risk.
- Draft a Statement of Applicability with five rows: the control, applies or not, why, and where it's implemented.
Expected output: a scope statement and a five-row draft Statement of Applicability.
🌍Where it's used
- IT service companies in India commonly hold ISO 27001 for client contracts.
- Tenders from large organisations often require it.
- Cloud providers publish their certificates and scopes.
📝Case scenario
A company announced it was "ISO 27001 certified" on its whole website, but the certificate covered only its payroll service. A customer's auditor noticed and asked for the scope. The company had to correct its claim on every page.
🖱️Try it
Find a published ISO 27001 certificate from a cloud or software company and read its scope. Success: you can say which services or locations it covers and which it doesn't.
⚠️Common mistakes
- Ignoring scope. Sign: "certified" with no scope stated. Fix: state the scope with the claim.
- Controls without risks. Sign: Annex A copied wholesale. Fix: choose controls from the risk assessment.
- Audit-time effort only. Sign: activity peaks before audits. Fix: run the system all year.
🛠️For your project
The capstone notes include a short scope statement and a draft Statement of Applicability for AarogyaDesk.
✅Quick check
What does the Statement of Applicability record?
Show the answer
Which Annex A controls apply, which don't, and why.
How long does an ISO 27001 certificate last, and what happens in between?
Show the answer
Three years, with surveillance audits each year.