mirror of
https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git
synced 2026-07-29 15:40:58 +03:00
Initial commit - 611 cybersecurity skills across all subdomains
This commit is contained in:
mukul975
+313
@@ -0,0 +1,313 @@
|
||||
# ISO 27001 Implementation Workflows
|
||||
|
||||
## Workflow 1: ISMS Scoping and Context Analysis
|
||||
|
||||
```
|
||||
Start
|
||||
|
|
||||
v
|
||||
[Identify Internal Context]
|
||||
- Organization structure
|
||||
- Existing policies and processes
|
||||
- IT infrastructure and systems
|
||||
- Culture and capabilities
|
||||
|
|
||||
v
|
||||
[Identify External Context]
|
||||
- Legal and regulatory requirements
|
||||
- Industry standards and obligations
|
||||
- Customer and partner requirements
|
||||
- Threat landscape and geopolitical factors
|
||||
|
|
||||
v
|
||||
[Identify Interested Parties]
|
||||
- Customers and clients
|
||||
- Regulators and authorities
|
||||
- Employees and contractors
|
||||
- Shareholders and board members
|
||||
- Suppliers and partners
|
||||
|
|
||||
v
|
||||
[Define ISMS Scope]
|
||||
- Business units in scope
|
||||
- Physical locations
|
||||
- Information systems and networks
|
||||
- Third-party services
|
||||
- Exclusions with justification
|
||||
|
|
||||
v
|
||||
[Document ISMS Scope Statement]
|
||||
|
|
||||
v
|
||||
[Obtain Top Management Approval]
|
||||
|
|
||||
v
|
||||
End
|
||||
```
|
||||
|
||||
## Workflow 2: Risk Assessment Process
|
||||
|
||||
```
|
||||
Start
|
||||
|
|
||||
v
|
||||
[Define Risk Criteria]
|
||||
- Risk acceptance criteria
|
||||
- Likelihood scale (1-5)
|
||||
- Impact scale (1-5)
|
||||
- Risk matrix thresholds
|
||||
|
|
||||
v
|
||||
[Create Asset Inventory]
|
||||
- Information assets
|
||||
- Software assets
|
||||
- Hardware assets
|
||||
- People (roles)
|
||||
- Services (cloud, third-party)
|
||||
- Physical locations
|
||||
|
|
||||
v
|
||||
[Identify Threats]
|
||||
- Natural threats (fire, flood)
|
||||
- Human threats (insider, external attacker)
|
||||
- Technical threats (malware, system failure)
|
||||
- Supply chain threats
|
||||
|
|
||||
v
|
||||
[Identify Vulnerabilities]
|
||||
- Technical vulnerabilities
|
||||
- Process weaknesses
|
||||
- People-related gaps
|
||||
- Physical security gaps
|
||||
|
|
||||
v
|
||||
[Assess Existing Controls]
|
||||
- Document current controls
|
||||
- Evaluate control effectiveness
|
||||
|
|
||||
v
|
||||
[Calculate Risk Level]
|
||||
Risk = Likelihood x Impact
|
||||
- Consider existing controls
|
||||
- Use defined risk criteria
|
||||
|
|
||||
v
|
||||
[Compare Against Risk Acceptance]
|
||||
|
|
||||
+--> [Risk Acceptable] --> Document and Monitor
|
||||
|
|
||||
+--> [Risk Not Acceptable]
|
||||
|
|
||||
v
|
||||
[Select Risk Treatment]
|
||||
- Mitigate (apply controls)
|
||||
- Transfer (insurance, outsource)
|
||||
- Avoid (stop activity)
|
||||
- Accept (with justification)
|
||||
|
|
||||
v
|
||||
[Map to Annex A Controls]
|
||||
|
|
||||
v
|
||||
[Document in Risk Treatment Plan]
|
||||
|
|
||||
v
|
||||
[Update Statement of Applicability]
|
||||
|
|
||||
v
|
||||
End
|
||||
```
|
||||
|
||||
## Workflow 3: Statement of Applicability (SoA) Creation
|
||||
|
||||
```
|
||||
Start
|
||||
|
|
||||
v
|
||||
[List All 93 Annex A Controls]
|
||||
|
|
||||
v
|
||||
[For Each Control]
|
||||
|
|
||||
v
|
||||
[Is Control Required by Risk Treatment?]
|
||||
|
|
||||
+--> Yes --> Mark as Applicable
|
||||
| - Link to risk(s)
|
||||
| - Document implementation status
|
||||
| - Assign control owner
|
||||
|
|
||||
+--> No --> [Is Control Required by Law/Contract?]
|
||||
|
|
||||
+--> Yes --> Mark as Applicable
|
||||
| - Document legal/contractual basis
|
||||
|
|
||||
+--> No --> [Is Control Best Practice?]
|
||||
|
|
||||
+--> Yes --> Mark as Applicable
|
||||
| - Document business justification
|
||||
|
|
||||
+--> No --> Mark as Not Applicable
|
||||
- Document exclusion justification
|
||||
|
|
||||
v
|
||||
[Review SoA Completeness]
|
||||
- All 93 controls addressed
|
||||
- Every exclusion justified
|
||||
- Implementation status documented
|
||||
|
|
||||
v
|
||||
[Approve SoA]
|
||||
|
|
||||
v
|
||||
End
|
||||
```
|
||||
|
||||
## Workflow 4: Internal Audit Programme
|
||||
|
||||
```
|
||||
Start
|
||||
|
|
||||
v
|
||||
[Plan Audit Programme]
|
||||
- Define audit scope (clauses and controls)
|
||||
- Schedule audits across the year
|
||||
- Assign qualified auditors (independent of audited area)
|
||||
- Prepare audit criteria and checklists
|
||||
|
|
||||
v
|
||||
[Conduct Audit]
|
||||
- Opening meeting with auditees
|
||||
- Review documented information
|
||||
- Interview key personnel
|
||||
- Observe processes in action
|
||||
- Collect objective evidence
|
||||
- Closing meeting with preliminary findings
|
||||
|
|
||||
v
|
||||
[Document Findings]
|
||||
- Major Nonconformities (systemic failure, absence of control)
|
||||
- Minor Nonconformities (isolated failure, partial implementation)
|
||||
- Observations (potential for improvement)
|
||||
- Opportunities for Improvement (OFIs)
|
||||
|
|
||||
v
|
||||
[Issue Audit Report]
|
||||
|
|
||||
v
|
||||
[Corrective Action Process]
|
||||
- Containment: immediate action to limit impact
|
||||
- Root Cause Analysis: identify underlying cause
|
||||
- Corrective Action: implement fix to prevent recurrence
|
||||
- Verification: confirm effectiveness of correction
|
||||
|
|
||||
v
|
||||
[Track to Closure]
|
||||
|
|
||||
v
|
||||
[Feed into Management Review]
|
||||
|
|
||||
v
|
||||
End
|
||||
```
|
||||
|
||||
## Workflow 5: Management Review
|
||||
|
||||
```
|
||||
Start
|
||||
|
|
||||
v
|
||||
[Prepare Review Inputs]
|
||||
- Status of actions from previous reviews
|
||||
- Changes in external/internal issues
|
||||
- Changes in interested party needs
|
||||
- Information security performance:
|
||||
* Nonconformities and corrective actions
|
||||
* Monitoring and measurement results
|
||||
* Audit results
|
||||
* Fulfilment of objectives
|
||||
- Feedback from interested parties
|
||||
- Results of risk assessment and treatment plan
|
||||
- Opportunities for continual improvement
|
||||
|
|
||||
v
|
||||
[Conduct Management Review Meeting]
|
||||
- Present ISMS performance data
|
||||
- Discuss risk landscape changes
|
||||
- Review incident trends
|
||||
- Evaluate resource adequacy
|
||||
|
|
||||
v
|
||||
[Document Review Outputs]
|
||||
- Decisions on continual improvement opportunities
|
||||
- Changes needed to the ISMS
|
||||
- Resource allocation decisions
|
||||
- Updated risk acceptance criteria (if needed)
|
||||
|
|
||||
v
|
||||
[Assign Actions with Owners and Deadlines]
|
||||
|
|
||||
v
|
||||
[Track Implementation]
|
||||
|
|
||||
v
|
||||
End
|
||||
```
|
||||
|
||||
## Workflow 6: Certification Audit Preparation
|
||||
|
||||
```
|
||||
Start
|
||||
|
|
||||
v
|
||||
[Pre-Audit Readiness Check]
|
||||
- All mandatory documents in place
|
||||
- SoA current and approved
|
||||
- Risk assessment completed
|
||||
- Internal audit completed
|
||||
- Management review conducted
|
||||
- Corrective actions closed
|
||||
|
|
||||
v
|
||||
[Select Certification Body]
|
||||
- Verify UKAS/ANAB accreditation
|
||||
- Compare audit team experience
|
||||
- Review commercial terms
|
||||
|
|
||||
v
|
||||
[Stage 1 Audit (Documentation Review)]
|
||||
- Auditor reviews ISMS documentation
|
||||
- Assesses readiness for Stage 2
|
||||
- Identifies any significant gaps
|
||||
|
|
||||
v
|
||||
[Address Stage 1 Findings]
|
||||
- Resolve documentation gaps
|
||||
- Complete any missing processes
|
||||
|
|
||||
v
|
||||
[Stage 2 Audit (Certification Audit)]
|
||||
- On-site assessment (typically 3-5 days)
|
||||
- Evidence-based verification
|
||||
- Interviews across the organization
|
||||
- Technical control testing
|
||||
|
|
||||
v
|
||||
[Audit Outcome]
|
||||
|
|
||||
+--> [No Major NCRs] --> Certificate Issued
|
||||
|
|
||||
+--> [Major NCRs Found]
|
||||
|
|
||||
v
|
||||
[Resolve NCRs within 90 days]
|
||||
|
|
||||
v
|
||||
[Follow-up Audit]
|
||||
|
|
||||
v
|
||||
[Certificate Issued]
|
||||
|
|
||||
v
|
||||
End
|
||||
```
|
||||
Reference in New Issue
Block a user