An introduction to ISO 27001 change management

Every organization has one constant factor in common: change. An organization always undergoes a transformation, whether it’s slow or fast. People come and go, new technologies are adopted, and processes are updated. It’s the only way to keep up with a changing world. But with change often comes risk.

That’s why the ISO 27001 norm requires organizations to set up an ISO 27001 change management policy.

What is the purpose of the ISO 27001 change management policy?

While undergoing change, the change management policy helps to maintain security. It lays out a foundation for planning and organizing change effectively. The goal is to minimize disruption to business continuity and avoiding chinks in the security armor.

→ ISO 27001: the ultimate guide for dummies

The change management process

Let’s break down the change management process into simple, manageable steps:

1. Identify the change

The first step is recognizing that a change is needed. This could be anything from a software update to a new security policy. Key aspects include:

• Change request: Anyone in the organization can submit a change request.
• Description: Clearly describe what the change involves and why it’s needed.

2. Evaluate the change

Next, evaluate the proposed change to understand its impact. This involves:

• Risk assessment: Identify potential security risks associated with the change.
• Impact analysis: Determine how the change will affect current systems, processes, and security controls.
• Resources: Assess the resources required to implement the change. Think about the time it may take you, employees, technology, and money.

3. Approve the change

Once evaluated, the change needs to be approved by the relevant authority within your organization. This could be:

• Change advisory board (CAB): A group of stakeholders who review and approve changes. Ensure to put together a group of stakeholders that can serve as the CAB for any major change.
• Management: Higher-level approval may be required for significant changes. If not, it’s still essential to keep them in the loop.

4. Plan the change

Planning is crucial to ensure the change is implemented smoothly. This includes:

• Implementation plan: Detailed steps on how the change will be carried out.
• Timeline: Schedule for when the change will occur.
• Roles and responsibilities: Who will be responsible for different parts of the change.

5. Implement the change

With a plan in place, it’s time to implement the change. Key points to consider:

• Communication: Inform all affected parties about the change and its timeline. Don’t forget this could include external parties. Think about customers or organizations in your supply chain.
• Execution: Carry out the change according to the procedures.
• Monitoring: Keep an eye on the process to ensure everything goes as expected.

6. Review and close

After implementation, review the change to ensure it has achieved its objectives without causing issues. This involves:

• Testing: Verify that the change works as intended and hasn’t introduced new vulnerabilities.
• Documentation: Record all details of the change for future reference and compliance.
• Feedback: Gather feedback from stakeholders to learn and improve future change management processes.

Conclusion

Setting up an ISO 27001 change management policy is no easy feat, especially for larger organizations. Auditors place the bar high for this policy, as it’s so essential to business continuity and security.

An ISO 27001 consultant can help you navigate the process of setting up this policy for your organization. Find a consultant in your area.