Facilitating GRC Best Practice
Supported Standards:
ISO 31000
BS 10500
ISO 19600
ISO/IEC 38500
ISO/IEC 27001
ISO/IEC 22301
ISO/IEC 20000
Balanced Scorecard
Consultancy Topics:
IT Governance
IT Risk
IT Compliance
Information Security
Business Continuity

ISO 27001 ISMS Implementation

Information Security

Analytix information security consulting services will assist you to establish or improve your information security programme with experienced and certified consultants.

Alignment with ISO 27001

These services are aimed to assist organisations to effectively develop and implement the requirements of the ISO/IEC 27001 international information security standard.

Information Security Management System

Our consultants provide the technical expertise and experience to assist you to establish and document an Information Security Management System (ISMS) which is implemented, maintained and continuously improved for effectiveness. 

The scope and structure of an information security programme can vary, and our effort expended will be tailored to the needs of your organisation, while we will ensure that the essential elements of an ISMS lifecycle is established to :

  • Plan - Establish information security management strategy, policy, objectives, targets, processes and procedures to manage risk and improve cyber security in accordance with business needs, strategy, polices and objectives
  • Do - Identify and classify information assets, conduct risk assessment, and implement and operate controls to manage cyber security risks in a manner consistent with overall business risks
  • Check - Monitor and review the performance and effectiveness of the ISMS, using objective measurement
  • Act - Review outcomes and performance indicators or benchmarking findings, and act accordingly to continually improve the ISMS

Analytix’s approach to Information Security Programme implementation is based on assisting organisations to adopt and embed a information security amagement lifecycle that comprises of the required elements for establishinbg an Information Security Management System (ISMS), in alignment with the best practice guidelines of  international informations security standard, ISO/IEC 27001.

This approach and methodology can be implemented by organisations of all sizes, in all sectors:  public, private, non-profit, educational, manufacturing, etc.  

Our ISMS implementation service could involve consulting assistance with one or more of the following aspects:​

  • Providing a conceptual framework, structures, processes, resources and information that defines the essential Information Security Management activities and responsibilities
  • Describing the Information Security Management system that has to be adopted and followed
  • Obtaining IT-wide consistency regarding the structure and application of the Information Security Management process and procedures
  • Establish mechanisms to report and provide assurance to the executive and business management about the delivery of value and management of Information Security related risks consistently across the organisation
  • Embedding a common Information Security Management language across the organization in alignment with the corporate GRC systems
  • Operationalising Information Security Management to become part of the organisation's operations
  • Establishing accountability and responsibility for Information Security Management

Analytix's approach to ISMS implementation support is based on the ISO/IEC 27001 Information Security Standard. The ISO/IEC 27001 Standard effectively comes in the following parts:

  • ISO/IEC 27001:2013 - is a standard specification for Information Security Management Systems (ISMS). An ISMS is the means by which Senior Management monitor and control their security, minimising the residual business risk and ensuring that security continues to fulfil corporate, customer and legal requirements.
  • ISO/IEC 27002:2013  - is the standard code of practice and can be regarded as a comprehensive catalogue of good security actions.ISO/IEC 27003:2010  - Information technology -- Security techniques -- Information security management system implementation guidance
  • ISO/IEC 27003:2010 - provides practical implementation guidance and provides further information for establishing, implementing, operating, monitoring, reviewing, maintaining and improving an ISMS in accordance with ISO/IEC 27001. . Provides a process oriented approach to the successful implementation of the ISMS in accordance with ISO/IEC 27001.
  • ISO/IEC 27004:2009  - provides guidance and advice on the development and use of measurements in order to assess the effectiveness of ISMS, control objectives, and controls used to implement and manage information security, as specified in ISO/IEC 27001. Provides a measurement framework allowing an assessment of ISMS effectiveness to be measured in accordance with ISO/IEC 27001
  • ISO/IEC 27001:2005 - provides guidance on implementing a process oriented risk management approach to assist in satisfactorily implementing and fulfilling the information security risk management requirements of ISO/IEC 27001.

Depending on the Terms of Reference and Scope of Work, typical deliverables of an ISO/IEC 27001 Information Security Management programme implementation project may include:

  • ISO 27001 Assessment and assessment report
  • ISMS scope
  • Information security policy
  • Information Security polcies for the following ISO 27002 domains:
    • Organization of Information Security
    • Human Resource Security
    • Asset Management
    • Access Control
    • Cryptography
    • Physical and environmental security
    • Operation Security- procedures and responsibilities, Protection from malware, Backup, Logging and monitoring, Control of operational software, Technical vulnerability management and Information systems audit coordination
    • Communication security - Network security management and Information transfer
    • System acquisition, development and maintenance - Security requirements of information systems, Security in development and support processes and Test data
    • Supplier relationships - Information security in supplier relationships and Supplier service delivery management
    • Information security incident management - Management of information security incidents and improvements
    • Information security aspects of business continuity management - Information security continuity and Redundancies
    • Compliance - Compliance with legal and contractual requirements and Information security reviews
  • Information security risk assessment process and methodology
  • Information security risk treatment process
  • Information security objectives
  • Information security roles and responsibilities
  • Other ISMS-related documents deemed necessary by the organization
  • Operational planning and control documents
  • Risk assessment and reporting templates
  • The decisions regarding risk treatment
  • Monitoring and measurement framework for information security


By implementing ISO/IEC 27001 an organisation will be working to a globally recognised standard that is considered an exemplar of information security best practice in 150 countries. ISO 27001 offers an excellent framework for developing or enhancing your organisation’s security and effective security management practice to provide greater confidence in dealings with other organisations.

A full implementation and / or certification provides many tangible benefits:

  • Is often a deciding differentiator between competing organisations
  • Enhances your clients’ and business partners’ confidence and perception of your organisation
  • Focuses your organisation on financial gains through cost savings and business growth
  • Strengthens management controls on information critical to business processes
  • Provides confidence that you have professionally managed risk in your own security procedures
  • Enhances security awareness within your organisation
  • Assists in the development of best practice
  • Prevents commercial loss through theft, denial of service or espionage
  • Enables your organisation to conduct sensitive transactions securely
  • Strengthens your organisation’s business continuity planning