Criteria for Deciding Which ISO 27001 Policies and Procedures to Write

Posted: January 4, 2018 in ISO 27001 Certification
Tags: , , ,

If you’re just starting to implement ISO 27001 in your business, you’re probably in a dilemma about how many ISO 27001 documents you need to have and whether you should write certain policies and procedures or not.

Criteria for deciding what to ISO 27001 Document

Well, the first step is simple: you have to check if the ISO 27001 Certification requires a document. If the ISO 27001 document is mandatory, you have nothing to think about; you have to write it if you want to compliant this standard.

Here are some criteria that will help you:

Risks: You need to start by assessing the risks to see if such control is needed. If there is no risk, then you certainly will not need a document for this; If there is a risk, this does not mean you have to write a document, but at least you have solved the dilemma if control is needed or not.

Compliance: Sometimes it is possible to have a regulation or a contractual requirement to write a specific document; For example, a regulation could require writing the classification policy.

Size of business: Small businesses will tend to have fewer documents, so you should avoid writing a procedure for each small process; For example, if it is a multinational organization with 10,000 employees, write policies in which each of them has a couple of related procedures, and then for each procedure a couple of work instructions; This approach makes sense.

Importance: The more important a process or activity is, the more likely it is to write a policy or procedure to describe it; this is because you want to be sure that everyone understands how to perform this process or activity in order to avoid interruptions in their operations.

Number of people involved: The more people perform a process or activity, the more likely you are to document it; For example, if there are 100 people involved, it will be very difficult to explain verbally to all these people how to perform a particular process; It is much easier to write a procedure that explains everything in detail. On the other hand, if you are involved in five people, you can probably explain how the whole process works in a single meeting, so you do not need a written procedure. However, there is one exception: if there is only one person working on a trial, you may want to document it because no one else knows how to do it, so if this person is no longer available, you can continue with your operations.

Complexity: The more complex the process, the more likely a written document is needed (at least in the form of a checklist); it is simply impossible to remember from memory

Maturity: If a process or activity is clearly established, if it has been performed for years and everyone knows exactly how to do it, if it has been developed, it is probably not necessary to document it.

Frequency: If you do some activities rarely, you can write them because you can forget how they are done.

Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s