How to deal with non-compliant company after take over of them

I am looking for the correct steps to implement 27001 into a non compliant company we have recently taken over. We are 27k compliant but they are now part of us. The CTO has asked for us to explain our plan, risks and key parts. The CTO wants me to give the new board a 15 minute overview in ppt, yes 15 minutes can anyone help please?

Thanks

Paul

Can someone help Paul?

Thank you very much!!

Stijloor.

Another quick "Bump". My Thanks in advance to anyone who can help with this one.

shawofit said:

.................. The CTO has asked for us to explain our plan, risks and key parts. ...............................

Click to expand...

Gap Analysis!

It will reveal 2 important sets of information. Where they are now and what is deficient or needs to be done in order to reach a stage where they can be compliant - from which you can formulate your action plans.

Your presentation can be in this form:
1. Current status - 5 minutes
2. What needs to be done to attain compliant status - 10 minutes

I agree with Harry, you're at the gap analysis stage.

The obvious starting point is gaps related to 27001 standard requirements, which of course relates to both main standard body requirements--some a bit general--and the 133 control requirements. Those are more specific in one sense but still not completely clear about how you need to address them, and of course limited exemptions are possible when they don't apply.

You should also be clear early on to what degree you want to integrate the prior system with the new company's system; to use one system to cover both, to just share some common practices, control implementations, formal process implementation, etc. It would be early for looking too closely at the final end-point but some of the demand should already be clear. 27001 standard "compliant" versus "certified" is also a substantial difference relating to possible goals, so it matters which you are and plan for them to be.

If you already have implemented a complete, certified ISO 27001 system you already know all this but these are some primary concerns:

-management system framework: common to most, document control, audit requirements, defining roles, etc.

-security controls: defines a lot of 27001; your statement of applicability will help map what will translate easily or not at all

-risk assessment: major part of 27k, of course 27005 is the reference standard for the security risk assessment, and there is overlap with other standard requirements

-formal policies, procedures, records, training, skills development, etc: relates back to your past development and present goals


A good reference site for 27001 implementation that is worth a look is:

http://www.iso27001security.com/html/iso27k_toolkit.html

shawofit said:

I am looking for the correct steps to implement 27001 into a non compliant company we have recently taken over. We are 27k compliant but they are now part of us. The CTO has asked for us to explain our plan, risks and key parts. The CTO wants me to give the new board a 15 minute overview in ppt, yes 15 minutes can anyone help please?

Thanks

Paul

Click to expand...

The CTO is asking for:

1. your plan in getting the other company to be compliant (see attached generic project plan)
2. risks of what? (risks of the other company or risks of your plan?)
3. key parts (see attached project plan)

15 minutes is a long time.

Let me know your responses to the questions above and I can point you to the right direction.

Cheers!

I'll take the liberty of guessing ahead about what is meant by "risks" here. It seems to confuse two separate types of risks, although again that's a guess.

Whenever you implement anything in IT part of the plan is to address risks, to assess them beforehand, use fall-back plans and whatever else you can to minimize them, and then get the residual risk accepted prior to moving on.

A separate meaning of risk is what a risk assessment assesses; a broad category of risks based on whatever type of assessment you are doing. For a general company assessment this might be business risks (related to changes in market, major events, staffing related disruptions, etc.). For 27001 it's information security related, of course, viruses, confidentiality breaches, etc.

It sounds like you're being asked about risks in general because it's habitual to do so, related to the first context, but there shouldn't be many risks to implementing security measures, and during a gap assessment it's too early to be worried about that anyway. What I mean is that if you implement a new anti-virus application there could be some risks but early on you need to first assess the need to do so, not worry about difficulties in so doing.

So you are back to the second kind of risk, and the question becomes what risks do the current gaps pose to your company or the company scope acquired. Banging out a comprehensive risk assessment is no small feat, as anyone with an active 27001 system already knows, so you could just do a "preliminary" gap assessment and a preliminary resolution project plan and let them know roughly where things stand, and 15 minutes is about right for that. Look at your own risk assessment and statement of applicability for inspiration, and for hints on presentation format.