HOW DO YOU START TO IMPLEMENT ISO 27001 (ISMS) WHAT IS INVOLVED?

  ->  Identify the requirements of ISO 27001 (ISMS) and how they apply to the business involved.

  ->  Establish quality objectives and how they fit in to the operation of the business.

  ->  Produce a documented quality policy indicating how these requirements are satisfied.

  ->  Communicate them throughout the organisation.

  ->  Evaluate the quality policy, its stated objectives and then prioritise requirements to ensure they are met.

  ->  Identify the boundaries of the management system and produce documented procedures as required.

Once developed, internal audits are needed to ensure the system carries on working. The setting of targets for the environmental policy and continual measuring against it ensures the system is maintained.

ASSESSMENT TO ISO 27001 (ISMS)

Once all the requirements of ISO 27001 (ISMS) have been met, it is time for an external audit. This should be carried out by a third party, accredited certification body. In the UK, the body should be accredited by UKAS (look for the 'crown and tick' logo). The chosen certification body will review the quality manuals and procedures.

This process involves looking at the company's evaluation of quality and ascertains if targets set for the management programme are measurable and achievable. This is followed at a later date by a full on-site audit to ensure that working practices observe the procedures and stated objectives and that appropriate records are kept.

After a successful audit, a certificate of registration to ISO 27001 (ISMS) will be issued. There will then be surveillance visits (usually once or twice a year) to ensure that the system continues to work. This is covered in more detail in ISOQAR's 'Audit Procedure' information sheet.