Information_Assurance_Compliance

Information Assurance & Compliance:

Information Assurance & Compliance Delivery Process Model

Why ISO 27001?:

Why ISO 27001? Provides the best method to demonstrate compliance with a multitude of regulatory requirements using ISO/IEC 27001 Using ISO 27001 guarantees consistency and global recognition All major regulatory compliance bodies recognise ISO 27001

Benefits of this Methodology:

Benefits of this Methodology Used by a range of sectors including Government, Finance, Telecommunications, Criminal Justice and the NHS Collaborative method that offers value for money and opportunities for skills transfer Clients ‘tap-into’ the skills & expertise they need to achieve their business compliance needs It is a proven delivery method that leads to compliance success

Overview:

Overview Simple 3 Phased approach Creates a complete set of documentation to fully demonstrate compliance and achieve certification Additional Modules for specifically for SOX compliance & Public Sector systems Can be tailored to meet the requirements of worldwide compliance requirements

Delivery Process:

Delivery Process Preparation Phase Risk Assessment Phase Evidence Phase SOX Module Accreditation Module Other Compliances Module

Preparation Phase:

Preparation Phase Approximately 17 Days Security Project Planning Collect Requirements & confirm compliance drivers Internal Audit Define security organisation structure Produce ISO 27001 Scope statement

Preparation Phase:

Preparation Phase Agree organisation security policy Develop Training needs statement - IA & BCM Create Applicable Legislation Checklist Document Business Continuity Management Methodology Develop & document ISMS Collect Risk Inputs

Risk Assessment Phase:

Risk Assessment Phase Approximately 21 Days Physical Assessment Asset list Interviews Risk & BC/DR workshops Technical Architecture Security Review

Risk Assessment Phase:

Risk Assessment Phase Business Impact Assessment Threat & Vulnerability Assessment (TVCA) Assess report and discuss mitigation Countermeasure evaluation & selection Measure of Effectiveness Map ISO 27001 controls to other control sets

Evidence Phase:

Evidence Phase Approximately 28 Days Embedding security within the organisation Complete Statement of Applicability Create security procedures / manual Business Continuity Planning & Testing Operational Readiness Testing

Evidence Phase:

Evidence Phase Create Audit and security review plan Create incident response plan / capability ISO 27001 Documents Set creation Declaration ISO 27001 compliance

Public Sector Systems:

Public Sector Systems Accreditation Module - 12 Days IS1 Risk Assessment Produce RMADS

Public Sector Systems:

Public Sector Systems Other Compliances Module - 2 Days Each SPF PCI DSS Client Security Policy NHS Toolkit/N3 ISS4P

Sarbanes Oxley:

Sarbanes Oxley SOX Module - 25 Days Agree the SPCA's and develop audit plan Run the SAS70 Audit Deliver SAS70 audit report

Phase 1 Deliverables:

Phase 1 Deliverables Security Project Brief Statement of Works High Level Project Plan ISO Scope Statement Audit Report Legislation Checklist Gap Analysis BCM Methodology ISMS

Phase 2 Deliverables:

Phase 2 Deliverables Risk Assessment/Business Impact Assessment Report Asset List Control Mappings Physical Assessment Measure or Effectiveness

Phase 3 Deliverables:

Phase 3 Deliverables Statement of Applicability Security Policies & Procedures Operational Readiness Testing Report Penetration Testing Report BC / DR Plan BC / DR Test Plan Security Audit Plan Training & Awareness Materials & Plan

Additional Deliverables:

Additional Deliverables HMG IS1 Risk Assessment RMADS (HMG IS2)

Additional Deliverables:

Additional Deliverables Compliance Reports: SPF PCI DSS SOX Client Security Policy NHS Toolkit/N3 ISS4P GSI /GSx CJX

Contacts:

Contacts Nicholas Faulkner Principal Security Consultant 33 Sunmead Walk Cambridge CB1 9YB info@faulkner-associates.com +44 (0) 7811 040 261