Our ISO 27001 position

The scope of the management system is defined, and leadership demonstrates commitment through an approved policy and assigned roles.

Evidence an assessor would request. The scope statement, the information security policy, and the record of assigned responsibilities.

Open gap. The scope statement and policy exist. They need formal versioning and an approval record with dates.

Risks and opportunities are assessed against a defined method, with a treatment plan and a statement of applicability.

Evidence an assessor would request. The risk method, the risk register, the treatment plan, and the statement of applicability.

Open gap. The statement of applicability covering all Annex A controls with a justification for each has not been written yet.

Resources, competence, awareness, communication, and documented information are managed.

Evidence an assessor would request. Competence records, the training plan, awareness activity, and document version control.

The organization plans, implements, and controls the processes needed to meet its requirements.

Evidence an assessor would request. Operating procedures, records that they ran, and the results.

Monitoring, measurement, internal audit, and management review are performed.

Evidence an assessor would request. The internal audit program covering the whole system over a cycle, and management review outputs.

Open gap. A documented internal audit program with a schedule across the full cycle is the main outstanding item.

Nonconformities are corrected, and the management system is continually improved.

Evidence an assessor would request. The nonconformity log, root cause analysis, and evidence that corrections held.

Open gap. Corrections are recorded against incidents. A single nonconformity log covering control failures as well is being built.

Policies, roles, supplier relationships, and continuity of information security are governed.

Evidence an assessor would request. The policy set, supplier agreements with security terms, and the incident and continuity procedures.

Screening, terms of employment, awareness, discipline, and exit are managed for security.

Evidence an assessor would request. Screening records, signed terms, awareness evidence, and dated exit records.

Physical areas, equipment, and media are protected.

Evidence an assessor would request. Clear desk and clear screen rules, device encryption evidence, and secure disposal records.

Open gap. We work remotely, so the physical controls apply to home working and devices. The home working standard needs writing down rather than assuming.

Endpoints, access, cryptography, logging, monitoring, vulnerability management, and secure development are controlled.

Evidence an assessor would request. Configuration baselines, encryption settings, log retention, alerting, and scan and remediation records.

Open gap. Logging and alerting on our own estate is the open item, and it is already phase two work.