08/30133461 DC : 0

Foreword
1 Scope
2 Normative References
3 Terms and Definitions
4 Structure of this Standard
  4.1 General structure of clauses
  4.2 Diagrams
      4.2.1 Diagram legend
  4.3 The Overall Diagram for ISMS Implementation Planning
5 Obtaining Management Approval for Initiating the Project to
  Implement an ISMS
  5.1 Overview of Management Approval for Project Implementation
  5.2 Define Objectives, Information Security Needs and
      Organization Requirements for the ISMS
  5.3 Define the Initial ISMS Scope
      5.3.1 Overview of the ISMS Scope
      5.3.2 Define Roles & Responsibilities
  5.4 Create the Business Case & Initial Project Plan
  5.5 Obtain Management Approval and Commitment to Initiate the
      Project Implement an ISMS
6 Defining ISMS Scope and ISMS Policy
  6.1 Overview on defining ISMS Scope and ISMS Policy
  6.2 Define Organizational Boundaries
  6.3 Define Information Communication Technology Boundaries
  6.4 Define Physical Boundaries
  6.5 Finalize Boundaries for ISMS Scope
  6.6 Develop the ISMS Policy
7 Conducting Organization Analysis
  7.1 Overview of Conducting Organization Analysis
  7.2 Define Information Security Requirements Supporting the ISMS
  7.3 Create Information Assets Inventory
  7.4 Generate an Information Security Assessment
8 Conducting Risk Assessment and Risk Treatment Planning
  8.1 Overview of Conducting a Risk Assessment and Risk Treatment
      Planning
  8.2 Conduct Risk Assessment
  8.3 Select the Control Objectives and Controls
  8.4 Obtain Management Approval for Implementing the ISMS
9 Designing the ISMS
  9.1 Overview of designing an ISMS
  9.2 Design Organizational Security
      9.2.1 Design the Information Security Policy
      9.2.2 Develop Operational Plans and Procedures
      9.2.3 Plan for Management Reviews
      9.2.4 Information Security Training, Awareness, and
            Competence Program
  9.3 Design ICT and Physical Security
  9.4 Design Requirements for ISMS Records & Documentation Control
  9.5 Produce the ISMS Implementation Plan
Annex A - Checklist Description
Annex B - Roles & Responsibilities for Information Security
Annex C - Information on Internal Auditing
Annex D - Policies structure
Annex E - Information on Setting Up Monitoring and Measuring
Bibliography