Insert Logo

Information Security
Management System (ISMS)
Manual
ISO 27001:2013
Information Security Management System Insert Logo
ISMS Manual

1. Document Control

All changes made to the Information Security Management System (ISMS) Manual are recorded in
the amendment table below. The version number and date of revision for the current manual are
shown in the footer of the document.

Changes to the manual can be made at the discretion of the CTO, and consultation will allow for
comment from Company Name employees.

Document Information
Information Security Management System Manual
Author

Document Revision
Version Date Modified By Comments

Document Approval
Name Position Date

Issue date: dd/mm/yy Authorised by: Insert Name Version: 1

Classification: Internal Use Page 2 of 16
Information Security Management System Insert Logo
ISMS Manual

2. Contents
1. Document Control 2
2. Contents 3
3. Introduction 5
3.1 General Requirements 5
3.2 Terminology 5
3.3 Scope 5
3.4 Organisation Chart 7
3.5 Management System Process 7
4. Policy 7
5. Organisational Context 7
6. Leadership 8
6.1 Leadership & Commitment 8
6.1.1 Steering Committee 8
6.1.2 Working Group 9
6.2 Roles, Responsibilities & Authorities 10
7. Planning 11
7.1 Risks & Opportunities 11
7.2 Objectives & Targets 11
7.3 ISMS Planning 11
8. Support 11
8.1 Resources 11
8.2 Training & Competency 11
8.3 Awareness 12
8.4 Communication 12
8.5 Documented Information 12
8.5.1 Creating & Updating 12
8.5.2 Document Control 13
9. Operation 14
9.1 Operational Planning & Control 14
9.2 Assessment & Treatment 14
10. Performance Evaluation 14
10.1 Monitoring, Measurement Analysis & Evaluation 14
10.1.1 Analysis & Evaluation 14

Issue date: dd/mm/yy Authorised by: Insert Name Version: 1

Classification: Internal Use Page 3 of 16
Information Security Management System Insert Logo
ISMS Manual

10.2 Internal Audit 14

10.3 Management Review 15
11. Improvement 16
11.1 Non-Conformance & Corrective Action 16
11.2 Continual Improvement 16

Issue date: dd/mm/yy Authorised by: Insert Name Version: 1

Classification: Internal Use Page 4 of 16
Information Security Management System Insert Logo
ISMS Manual

3. Introduction
3.1 General Requirements
This manual, as well as its accompanying documents, outlines Company Name’s Information
Security Management System (ISMS) which have been established in line with ISO 27001:2013 –
International Standard for Information Technology – Security Techniques.

By doing this, we have made a commitment that our company adheres to the requirements of the
standard and takes into account the preservation of confidentiality, integrity and availability of
information by applying a risk management process; giving confidence to interested parties that
risks are adequately managed.

Our aim is to establish, document, implement and maintain an ISMS and continually improve its
effectiveness in accordance with all the above-mentioned standards.

Company Name Senior Management recognises that leading and operating an organisation
successfully requires managing it; in a systematic and visible manner. We understand that business
success results from implementing and maintaining a management system that is designed to not
only preserve the confidentiality, integrity and availability of information, but also continually improve
the effectiveness and efficiency of the organisation’s processes and overall performance.

3.2 Terminology
Characteristics of the information by which it is available only to authorised
Confidentiality
persons or systems.
Characteristics of the information by which it is changed only by authorised
Integrity
persons or systems in any allowed way.
Characteristics of the information by which it can be accessed by authorised
Availability
persons when it is needed.
Information Security Preservation of confidentiality, integrity and availability of information.

3.3 Scope
Company Name’s ISMS has been documented, implemented, maintained and improved to ensure
the security and protection of information. The functions and processes of the ISMS are applicable
to all aspects of our operations, including those conducted by subcontractors on behalf of the
company.

Security of information will need to be protected regardless of whether it is additionally stored,

processed or transferred in or out of the ISMS’s scope. The fact that some information is available
outside of the scope does not mean that security measures do not apply but rather that the
responsibility will be transferred to a trusted third party who will managed that information. Taking
into the account the external issues, internal issues, needs and expectations of interested parties
outlined in the Information Security Risk Register document, the scope is:

Issue date: dd/mm/yy Authorised by: Insert Name Version: 1

Classification: Internal Use Page 5 of 16
Information Security Management System Insert Logo
ISMS Manual

The design, development, maintenance and deployment of content management solutions and
services as well as business support functions outlined in the Statement of Applicability V1.0.

This scope applies to Company Name's head office located at 401, 10 Tilley Lane, Frenchs Forest,
NSW 2086 as well as the products, processes, dependencies and interfaces outlined in the diagram
below:

Interfaces
Company Name
Scope of the ISMS
Products Insert Interface Insert Interface Insert Interface

Insert Product Name

Core Process Support Processes Insert Interface Insert Interface Insert Interface

Insert Process Insert Process Insert Process

Name Name Name

Dependancies

Insert Dependancy Insert Dependancy Insert Dependancy

Insert Dependancy Insert Dependancy Insert Dependancy

In addition to the above-mentioned services the ICT infrastructure that is included in the scope from
an Information Security Management perspective is documented in the Inventory of Assets. The
Statement of Applicability has been prepared to outline which of the 114 controls from Annex A in
ISO 27001 have been implemented within the organisation and justify any controls that haven’t
been implemented.

Issue date: dd/mm/yy Authorised by: Insert Name Version: 1

Classification: Internal Use Page 6 of 16