What kind of shape are we in? Info-Sec and ISO-wise?

Welcome to StrollingRock's "How much work to get ISO 27001" survey. We won't ask you to enter your email before you take the quiz, nor afterwards, because we're not like that. Spend a few minutes (<10) clicking on some Multiple-Guess questions and we'll let you know directly (and only very roughly!) where you stand. Of course we would love to talk to you about your Information Security needs but we assume you'll be happy to get in touch when you are ready. Or now?

Do you have a Risk Management process?

If we know about a risk we do something but we don't necessarily have a formal "process" for it.

Yes, we have a Risk Management Process and we document each risk and how we treat them.

Not only do we have a process, but it has been designed to meet the ISO 27001 requirements.

None

Have you performed a risk analysis covering your full scope?

i.e. a Risk Analysis of anything that could bear on any Information that you wish to control? All this with reference to the ISO 27001 standard and the parts of your business you have decided to cover?

Nope.

We have done some Risk Analysis but not to this extent.

Yup.

None

Are you on top of your Risk Treatment Plans?

If you just "deal" with Risks when you see them, how happy are you that this is covering all the Risks you know about? If you have a process for managing risk, then how up-to-date are the actions that have been assigned to the various risks you have identified?

Looking guiltily at my toes now...

We're on top of our plans like NASA before a launch

Managing Risk is important.

Regardless whether you choose the ISO 27001 route or not, managing Risk in your business can be a key success factor. Whether you have a formal process for it today or not, you do manage risk all the time. Finding a way to do so more deliberately and measurably can help prioritise activities and resources. The key is to have a process that makes it easier to manage Risk and not just create a bunch of admin!

None

Do you have an Incident Reporting Process

Yes

None

Do you have a Non-Conformance Reporting Process?

Err - non-conformance?

Yes, but I'm not sure it gets used much or even at all.

Yes and we capture and fix a bunch of stuff with it.

None

A way to capture Improvement Suggestions?

People can always email any suggestion they have.

Yes - we have a process for this. It's not really achieving what we intended though...

We have a process and we create huge business value by implementing many of the suggestions we get.

None

Incidents, non-conformances & improvements

Don't worry if your current processes are not really delivering what you hoped for, very few companies manage to build something that actually works IRL. We at StrollingRock often ask ourselves: Why? It really isn't that difficult to build real value here.

PS, if you didn't know, a non-conformance is when a process isn't followed but nothing bad happened; like leaving the office unlocked overnight but you didn't get robbed. If you did, then it would be an Incident!

None

Who is responsible for Information Security at your company?

The IT department, the CISO (or equiv.)

All of us

Are you comfortable with what the ISO 27001 standard is?

How it differs from ISO 9001 and other ISOs? What it actually does cover and does NOT cover?

I don't know much about it.

I'm quite familiar with it - lots of policies, forms and documents to create and manage.

I know it too well. Eugh.

None

Do you have have a scope in mind?

I'm not sure what "a scope" is in the context of ISO 27001.

Yes. We are aware that we can choose not to certify everything but have not yet worked out the benefits of the different options.

Yes, we have a scope.

None

Do you have resources to implement and maintain the management system?

We don't have one so we don't need resources to maintain and manage it.

Yeah, well, we assigned it to someone. They're pretty busy with other stuff that's urgent.

It's owned by the CISO (or equiv.) and they escalate resources when needed. Mostly we think they are doing what needs to be done.

We have an elite team of dedicated trained professionals on top of every detail.

None

Important vs Urgent

We understand that your business is not (likely) security and that you need to focus on your real business. A well-conceived and implemented Information Security Management System might actually deliver everyday efficiencies to your underlying business. We're not lying. And you get the added benefit of sleeping better every night.

None

Do you have a Contract Handling System?

Does the email inbox of the Sales Team count?

Yes - a shared folder.

Sort of, but not everything is in there.

Yes - a dedicated contract content management system (or similar). Completely up-to-date and all contracts covered.

None

How on top of your contracts are you?

Do you know where all your contracts are? Do you know when they expire, who the contracting party is? Do you know whether they contain any Information Security requirements? Do you know this for Customer/Client contracts as well as Supplier contracts? For each and every contract?

I don't even want to think about this.

All lickety-spit and perfect

Don't worry! (if you were worrying)

Contract management can seem impossible and few companies manage it well. If you are already on top of this, well done! If there's some way to go, can you imagine how awesome it's going to feel when you are on top of it?

None

Do you have a law list of all applicable laws you are required to follow?

No.

No but we know which ones we need to follow, even if we don't have a list.

Yes, we have a list.

None

Would it surprise you to know that for most companies that list will have at least 5 laws concerning Information Security?

Yes!

No, but I'm not 100% sure we know exactly what our 5 or so laws are.

No, our list already has at least that many laws listed and more.

None

Never fear, help is near!

There's a huge overlap of applicable laws for most companies and we can help you find the ones that are specific for your industry. You are almost certainly compliant with them in any case. Best to be sure though? Of course, if you are already on top of this, give yourself a big pat on the back.

None

Do you have a good understanding of all your interested parties and their requirements which are placed upon you?

What's an "interested party" in this context?

Pretty sure we know who our interested parties are, but we don't have a special list for them.

Yessiree. Got them all in a list, and we didn't forget our own employees, our owners or the community where we are based.

None

Do you need to be GDPR compliant?

Yes - we're going to get into this bag of snakes for a while.

No - we never ever see or touch any data that requires it. (Really!?!?!)

Yes - duh, everyone needs to be.

None

Are you GDPR compliant?

No, we hate that stuff.

We try to be, but we may fall short here and there.

We are all over that stuff. We dominate.

None

Do you have an Article 30 register, ROPA register?

What's Article 30? A ROPA-what?

We know we should but we haven't got round to it yet.

Of course, duh!

None

Do you know whether you have all the DPAs you need in place?

Not again, sheesh - what's a DPA?

We know we need them, but there's a few missing and they're not all in one place.

We're so on top of this that I can't even see you from all the way up here.

None

You are done with Legal Compliance and GDPR questions.

We just thought you may like to know that we're leaving those snakes behind.

None

Do you have a list of all your consultants and employees? Do you keep track of their contracts? When they exipre? Have you ensured that you have secured the correct IPR protections?

Just when you thought it was going to get easier!

I think so.

Yes, we do, not sure if it is 100% up-to-date.

Absolutely.

None

Do you have an onboarding process?

Yes

None

Everyone says that!

Now we're going to dig a bit deeper...

None

Does your onboarding process include tracking exactly which systems each of them has been given access to, and making sure that these match the role(s) they have? And ONLY these roles?

What do Roles mean here when you talk about Access to Systems? In fact, what is a System?

We have a process but it's not perfect.

Yup -all of that good stuff.

None

Do you track and document that any security training is completed? And it includes Phishing training?

We do have some security training but we don't necessarily document and track it.

Yes we do, but we could absolutely be better.

Everyone loves our security training and it covers all bases.

None

Do you have an offboarding process?

Nope.

I would have said yes, but after the previous Onboarding question I'm not a as sure as I was.

Oh hell yes.

None

Think about everyone who has ever worked, consulted, temp-jobbed, done work-experience or been given access to a storage cupboard. Are sure sure that every single one of them no longer with the company has had all access to systems, online tools, laptops, Wifi and the Coffee Machine revoked? They don't still have physical access to facilities do they?

Erm. Feeling nervous now.

We have an offboarding process for the mice if they ever leave.

Who has access to what?

This is one of those things that should keep you up at night. If you don't like scary movies then maybe don't look up "Shadow IT".

None

Have you listed all your assets?

What is an Asset in this context?

We know where our company laptops and mobile phones are. Mostly...

We know where ALL our company laptops and mobile phones are.

We have an Asset Register that is used to manage all our Assets, including paper notepads, post-it notes and Whiteboards.

None

Control of "Stuff" that could have Information

We're not serious about the Post-It notes but it would be good to know where anything with important data is? Right? And that you can ensure it doesn't get lost or fall into the wrong hands?

Pro-tip: Post-It notes do become a huge liability when people start using them to make note of their passwords - often a side-effect of a password policy that is so strict it is unmanageable. Time to review that policy!

None

Do you know the hosting, criticality, access levels etc of all your systems in use? Has each system been assigned an owner? Contracts in place?

I'm still not sure what a "System" is in this context.

We have control of our 5-15 systems.

We have control of our 50+ systems.

None

Do you have a central place for storage of information (intranet, MS, Wikis, Confluence)?

People and teams figure out their own way of working and save their information wherever makes sense for them.

Lots of those, yes. Mostly centrally managed.

Of course we do, and they are all listed in the appropriate registers.

None

What policies do you have currently?

We have some. Somewhere.

We have 3-7 policies and I think I can even locate them if you give me a couple of minutes.

Let me just check our up-to-date Policy Register, which is easy to find on our Intranet, and I'll get back to you. I'd guess over 10.

None

What processes do you currently have documented and implemented?

A checklist is an example of a documented process. If it's used when and how it is intended to be used, then it's also implemented!

The person who takes the last cup of coffee makes a new batch. There's a Post-It on the machine.

We have some checklists, and even some flow-diagrams covering certain processes. Coverage is patchy though and I'm sure they're not adhered to as much as we'd like.

We have a process for a making a process. Not kidding!

None

Just checking that you are not a robot

This is the last step - you will get your results as soon as you submit this.

Comment

Time's up