Suggested Template for the ISMS

​

There are a large number of sites where you can download for a fee a template (see IT Governance for a good one).  I have included here what I think a useful ISMS would contain rather than just a compliant ISMS.

 

ISMS Scope

            Physical Boundaries

            System(s)/Network Description with boundaries

            Information Description and Business reason

ISMS

            Purpose

            Executive Summary

            Scope (see above) detail

            Objectives (describe how)

• Identifying assets and risks to those assets.

• Reducing or eliminating incidents.

• Minimising the impact of incidents.

• Continuous improvement

• Maintaining and enhancing esteem and reputation.

• Reducing down-time.

• Protecting privacy.

Principles

• Top Management are responsible for the ISMS.

• All employees will be educated in the ISMS.

• Risks will be assessed and controls will be proportionate.

• Risks will be managed (Transferred, Treated, Terminated, Tolerated).

• Discipline (compliance with policy) will be enforced.

Responsibilities

• For Governance – CISO.

• For Management – Security Working Group.

• For Training & awareness – Corporate.

• Cross Reference with Roles & responsibilities.

Key Outcomes

• Lower financial loss.

• Confidence and assurance of privacy.

• Satisfied customer / supplier base.

• Enhanced employee satisfaction.

• Shareholder values increase.

• Society stakeholder (regulatory) confidence.

Related Policies and Procedures.

 List with hyper link to all relevant (appropriate as compliant with Annex A / Statement of Applicability) including local interpretation as required.

Reference to other Mandatory documents (hyperlink when complete).m

Risk Assessment Methodology statement.

            Qualitative or Quantitative.

            Compliance with ISO 31000 / ISO 27001

            Risk Attitude (Appetite / Tolerance) Statement.

Brief Outline of Audit Programme

Conclusion – Senior Management Commitment / Sign Off.