Annex A.6 – Organisation of Information Security

In ISO/IEC 27001, the organisation of information security refers to the overall structure and management of the information security controls within an organisation. It includes the development of a framework for managing and protecting the organisations information assets, as well as the roles and responsibilities of individuals and groups within the organisation for information security.

The following steps can be taken to meet the control objective for organisational security:

  1. Define the organisational structure for information security: This includes defining the roles and responsibilities of individuals and groups within the organisation for information security. For example, specifying who is responsible for developing and implementing security policies, who is responsible for monitoring security controls, and who is responsible for incident response.
  2. Appoint a senior management representative for information security: This person will be responsible for the overall management of the organisations information security and will act as the main point of contact for information security within the organisation.
  3. Develop a security management system: Develop a comprehensive security management system that includes policies, procedures, and guidelines for managing and protecting the organisations information assets. The system should be based on a risk assessment and should be aligned with relevant laws, regulations and standards.
  4. Define the communications and decision-making processes: Define the processes and channels for communicating security-related information and making security-related decisions. This includes specifying how information security incidents will be reported and who will be responsible for making decisions about how to respond to them.
  5. Establish incident management processes: Establish incident management processes to detect and respond to security incidents. This includes specifying who will be responsible for managing incidents, how incidents will be escalated, and what actions will be taken to resolve them.
  6. Review and monitor the organisational security: Review and monitor the organisational security regularly to ensure it is still effective and appropriate for the level of protection required. Update the policies, procedures, and guidelines as necessary.
  7. Foster a security culture: Promote a culture of security awareness and responsibility throughout the organisation. This can be achieved through regular training and communication on information security topics, and by leading by example at the top management level.

It is important to note that the organisational security is a crucial element of the overall ISMS, as it sets the foundation for the implementation and management of all the other controls. It should be incorporated in the overall management system of the organisation and should be reviewed regularly to ensure that it adapts to the changing risk landscape.

‍

More from our security wiki

Continuous learning for your organisation, our knowledge base to help you grow

Cyber Essentials Self Assessment: Password-Based Authentication
This security wiki provides guidelines for implementing password-based authentication practices within your organisation. Follow these recommendations to enhance the security of user accounts and protect against unauthorised access.
Cyber Essentials Self Assessment: Administrative Accounts
This security wiki provides guidelines for the proper management and control of administrative accounts within your organisation. Follow these recommendations to establish secure administrative account practices.
Cyber Essentials Self Assessment: Malware Protection
This security wiki provides guidelines for implementing malware protection measures across your organisation's devices. Follow these recommendations to safeguard your desktop computers, laptops, tablets, and mobile phones from malware threats.
Cyber Essentials Self Assessment: Security Update Management
This security wiki provides guidelines for effective security update management to ensure that your organisation's devices and software remain protected against known vulnerabilities. Follow the recommendations below to establish a robust security update management process.
Cyber Essentials Self Assessment: Device Locking
This security wiki provides guidelines for implementing device locking mechanisms to enhance the security of your organisation's devices. Follow the recommendations below to protect against unauthorised access to software and services.
Cyber Essentials Self Assessment: Secure Configuration
This security wiki provides guidelines for achieving secure configuration of devices and services within your organisation. Follow the recommendations below to minimise potential vulnerabilities and enhance the overall security posture.
Now we're partners, you have unlocked:
Threat reports
1 Vuln scan
Security Wiki
Templates
Cyber Essentials logoCyber Essentials logo
©Periculo
Your Security Partner