Client: Construction Company A (business type: construction and manufacturing)
Project Period: Performed over 3 months in 2013; ISO/IEC 27001 certification obtained
Project Background and Topic
The client is a typical company in the Mortar industry, with domestic and overseas civil engineering, building construction, plants, and housing as its main business areas.
Despite the recent global downturn, it is a sound company that has been overcoming the downturn through overseas plant exports. It requested consulting in order to obtain ISO/IEC 27001 certification, strengthen domestic competitiveness, and increase trust in its growing overseas transactions.
IT and Information Security Environment
Business and IT Environment
The client’s main business areas are civil engineering, building construction, plants, and housing. It is a sound company overcoming the recent downturn through plant exports to about 20 countries, and its dependence on IT is not high. It has nationwide network infrastructure to support domestic operations, and basic network infrastructure at plant-export sites in about 20 countries overseas.
Compared with advanced construction companies, however, applications that can use information across many fields are insufficient. It is continuously building an integrated IT system at a Global level through ITSM, and it continues to pursue system development and adoption and the expansion of human resources.
Information Protection Environment
In the typical organizational R&R of a Mortar company, the general affairs team handles access security, physical security, and everyday security; the audit team handles enterprise-wide auditing; the human resources team handles personnel security; and the IT planning and operations team takes on information protection alongside its main work of IT operations and development.
Most information systems, together with the information protection work, are outsourced to an IDC. Staff perform only core work such as security policy management, and internal security was operated with basic solutions in place.
Relative to the ISO/IEC 27001:2005 standard there were shortcomings, but more information protection activities consistent with the certification standard were confirmed than expected. Many of the self-help measures for responding to internal information leakage matched activities required by the ISO/IEC 27001:2005 standard.
Project CSF
- Selecting an appropriate certification scope in light of related internal work
- Building consensus with stakeholders on the need to obtain ISO 27001 certification, a common situation at typical Mortar companies
- Aligning partially existing information protection guidelines and existing information protection activities with the ISO 27001 certification standard
- Presenting an approach for operational management of the certification obtained and for the upgrade to the 2013 version
- Selecting a certification body and maintaining a cooperative arrangement for ongoing certification-audit trends and auditor composition
Key Activities and Deliverables
| Phase | Key Work Performed | Deliverables |
|---|---|---|
| Certification Scope Selection | – Define the certification scope (from the perspectives of business, department, information asset, and physical location) – Prepare the detailed execution plan | – Execution Plan – Certification Scope Definition |
| Biz.&IT Environment and Gap Analysis | – Identify the business environment and domestic and overseas competitive relationships – Identify the IT systems, organization, and ISP – Gap analysis of the current state against the ISO/IEC 27001 standard | – Information Protection Status Gap Analysis Report |
| Information Assets and Vulnerability Analysis | – Identify and organize the current state according to the information-asset classification criteria – Refine the information-asset importance criteria and identify importance (from the C, I, and A perspectives) – Vulnerability assessment and penetration testing of information assets within the certification scope | – Information Asset and Importance Evaluation Report – Vulnerability Analysis Results Report – Penetration Test Results Report |
| Risk Assessment and Treatment Plan Development | – Risk assessment of information assets within the certification scope and selection of the DOA – Based on the vulnerability analysis results and the current-state analysis, develop a treatment plan for the issues found | – Risk Analysis Report – Risk Treatment Plan |
| Information Protection Countermeasure Development | – Enact and revise information protection regulations and guidelines – Establish a business continuity plan – Establish criteria for measuring the effectiveness of information protection – Establish the Statement of Applicability (SOA) | – Information protection regulations and guidelines – Information protection performance measurement report – Statement of Applicability (SOA) report – Business continuity plan |
| Mock Certification Audit | – Establish a mock certification audit plan – Conduct the mock certification audit – Improve the deficiencies found in the mock audit results | – Mock Audit Plan – Mock Audit Results Report |
| Main Certification Audit | – Training for the parties within the certification scope – Stage 1 audit (document audit), Stage 2 audit (main audit), and support for responding to the audit results – Prepare a deficiency treatment plan – Establish a future plan (draft) for operating the ISMS certification | – Training for the parties within the certification scope – Stage 1 audit (document audit) and Stage 2 audit (main audit) and support for responding to the audit results – Prepare a deficiency treatment plan – Establish a future plan (draft) for operating the ISMS certification |
- Sample deliverables: risk analysis report, Statement of Applicability report (SOA)
