Step-by-Step Guide for Creating an ISO® 27001 Statement of Applicability

How to Create a Statement of Applicability for ISO® 27001

Step 1: Understand the Requirements

Before diving into the creation of your SoA, it's imperative to understand the requirements of ISO® 27001. The SoA is essentially a comprehensive document that contains all the information security controls relevant to your organization. 

These controls are derived from Annex A of ISO® 27001, which encompasses a list of 93 controls. We have an in-depth guide to ISO® 27001 controls on the blog, so be sure to check that out before moving forward.

Step 2: Conduct a Risk Assessment

The next critical step is conducting a comprehensive risk assessment. This process involves identifying, evaluating, and managing risks that could impact your organization's information security. Key elements of this step include:

a) Determining the Appropriate Methodology

Choose the risk assessment methodology that aligns with your organization's specific needs and objectives. 

Options include:

• OCTAVE (Operationally Critical Threat, Asset, and Vulnerability Evaluation): Developed by the Software Engineering Institute (SEI), OCTAVE addresses challenges related to information security compliance. Its primary goal is to align an organization's objectives with its information security efforts. OCTAVE is particularly aimed at individuals responsible for managing an organization's operational risks. It helps organizations establish qualitative criteria for evaluating operational risk tolerance, pinpoint crucial assets, identify vulnerabilities and threats to those assets, assess potential consequences of realized threats, and initiate continuous improvement actions to mitigate risks.

• NIST SP 800-30: Provided by the National Institute of Standards and Technology (NIST), this guide offers comprehensive instructions for conducting risk assessments. It covers three key phases: preparation for the assessment, conducting the assessment, and maintaining it. Additionally, it emphasizes how risk assessments fit into the broader organizational risk management process, highlighting their role in informing and complementing other risk management activities.

• ISO® 27005: This standard provides guidelines for managing information security risks. It complements the principles outlined in ISO® 27001 and supports the effective implementation of information security through a risk management approach. ISO® 27001's Risk Assessment & Treatment guide underscores that risk management comprises two main elements—risk assessment (often referred to as risk analysis) and risk treatment. The risk assessment process involves identifying information security risks, assessing their likelihood and impact, and laying the foundation for subsequent risk mitigation strategies.

b) Seek Guidance

When conducting a risk assessment, it is often advantageous to seek guidance from reputable external sources. These sources have been developed by experts in the field and offer a wealth of knowledge and best practices that can enhance your own risk assessment process.

Here's a brief overview of a few resources:

• ISO® 27001: This international standard provides guidelines for the selection and implementation of information security controls, as well as the adoption of information security standards and practices. It is intended for use by organizations within the framework of an ISMS based on ISO® 27001. ISO® 27001 helps organizations implement information security controls based on globally recognized best practices and develop their own information security management guidelines.

• NIST SP 800-53: This set of standards from NIST assists federal agencies and contractors in meeting the requirements outlined by the Federal Information Security Management Act (FISMA). It presents a comprehensive catalog of security and privacy controls for safeguarding information systems and organizations, protecting operational assets, individuals, other entities, and the nation from a wide range of threats and risks.

• CIS Controls: The CIS Critical Security Controls (CIS Controls) are a clear, prioritized, and simplified set of best practices designed to bolster your cybersecurity posture. They are aligned with and referenced by various legal, regulatory, and policy frameworks. These controls consist of specific safeguards, each focused on a single cybersecurity task. This streamlined approach to cybersecurity has proven to be effective in defending against contemporary threats.

Step 3: Choose Controls to Treat Risks

ISO® 27001 outlines four risk treatment options:

• Retain or Tolerate: This choice is made when the identified risk is within the organization's acceptable threshold. The organization recognizes the risk but chooses not to implement additional controls. This decision is often based on a cost-benefit analysis, where the expense of mitigating the risk is deemed higher than the potential harm it may cause.

• Avoid or Terminate: This strategy eliminates the risk by discontinuing the associated activity or process. For instance, an organization may discontinue using a software application that poses a high-security risk to remove the risk.

• Share or Transfer: The organization transfers risk to a third party through outsourcing, insurance coverage, or partnerships. For example, data loss risk can be transferred by outsourcing data backup and recovery to a third-party provider responsible for mitigating it.

• Modify or Treat: This method entails reducing the risk by implementing suitable security controls. These controls are typically selected from the list of 93 controls specified in Annex A of ISO® 27001. The implementation of these controls is a fundamental part of the risk treatment process and is documented in a risk treatment plan.

The choice of which risk treatment option to pursue should align closely with your organization's risk management strategy and information security objectives. These controls play a pivotal role in fortifying your organization's security posture and ensuring compliance with ISO® 27001 standards.