ISO 27001 Risk Assessment. Statement of Applicability and Annex A Controls. Industrial Information Security.

Clause 6.1.2 requires the organisation to define and apply an information security risk assessment process. This process must establish and maintain risk criteria (including acceptance criteria and criteria for evaluating risks), identify risks associated with the loss of confidentiality, integrity and availability, analyse risks (likelihood and impact) and compare the results with the defined risk criteria. The standard does not prescribe any specific methodology (MAGERIT, OCTAVE, FAIR, ISO 31010 or any other can be used), but the process must be repeatable: different people must obtain comparable results when applying the same methodology. The entire assessment must be documented as retained documented information.

ISO 27001 does not define any set of Annex A controls as mandatory for all organisations. The controls that apply depend on the risks identified in the risk assessment and the decisions taken in the risk treatment plan (clause 6.1.3). The Statement of Applicability (SoA) must mention all 93 Annex A controls — including those that are excluded — with the corresponding justification. A control can be excluded if it does not apply by nature of the business, is outside the scope of the ISMS, or an equivalent compensatory control exists. The 11 new controls in the 2022 version (threat intelligence, cloud security, DLP, etc.) receive special attention from auditors and exclusions must be well-argued.

An information security incident is one or more unwanted or unexpected information security events that have a significant probability of compromising business operations and threatening information security. Annex A controls A.5.24 to A.5.28 cover incident management: planning and preparation (A.5.24), detection and reporting (A.5.25), assessment and decision (A.5.26), response (A.5.27) and learning (A.5.28). The procedure must define how incidents are classified and prioritised, who is responsible for response, what records are maintained and how escalation works. If the incident involves personal data, it may trigger the obligation to notify the supervisory authority within 72 hours (GDPR Art.33).

A DPIA (Data Protection Impact Assessment) is a GDPR requirement (Art.35), not directly an ISO 27001 requirement. However, Annex A control A.5.34 of ISO 27001:2022 (Privacy and protection of personally identifiable information) requires the organisation to identify privacy and data protection requirements and integrate them into its security controls. In practice, organisations with ISO 27001 that process personal data must carry out DPIAs for high-risk processing activities: large-scale video surveillance, profiling, large-scale processing of special categories of data, etc. The DPIA complements the ISO 27001 risk assessment and must be included in the ISMS documentation when applicable.

Clause 9.2 requires the organisation to plan, establish, implement and maintain an internal audit programme that covers the complete ISMS within the certification cycle (3 years). The programme must define frequency, methods, responsibilities and planning requirements. Internal auditors must be independent of the areas they audit (one must not audit their own work). Each audit must have an audit plan with scope, criteria and dates, and produce a report recording findings and non-conformities detected. Internal audit records are documented information that the organisation must retain and that the certification auditor may request at any surveillance audit.

The typical time for a first ISO 27001 certification in a company of 50-200 employees is 9 to 18 months, depending on the maturity of the existing security system. The main phases are: diagnosis and gap analysis (1-2 months), ISMS design and documentation including risk assessment and SoA (3-6 months), control implementation and training (3-6 months), prior internal audit (1 month) and certification (phase 1 + phase 2 audit, 1-2 months). IgeraIndustria significantly reduces the time spent in the documentation phase because the team can query what each clause and control requires without needing external consultancy for every question.