SecureAware Policy And Compliance: Changing To ISO 27001/27002:2013

SecureAware – Policy and Compliance: Changing to ISO 27001/27002:2013 Changing your information security handbook to meet the new ISO standards Document last updated: August 2016. NB! Many of the functions described in this manual are only available for Superuser, Policy Admin or users with similar rights. 1

1. Upgrade to version 4.6.0 (or later) . 3 2. (Only for users of the old policy module) Transfer collection to Policy TNG . 3 3. Copy rules to the ISO 27002:2013 rules set . 4 4. Check that your rules are placed correctly . 4 5. Add rules to your new rules set . 5 6. Create an ISO 27001:2013 rules set (optional) .7 7 Disable the old rules set .7 Contact Information . 8 2

You can now create new rules sets in SecureAware, changing the structure of your rules to match the new ISO standards. Furthermore, you will receive suggestions to what new rules to consider adding to your rules set. Please note! Creating a new rules set will NOT change, delete or add to your existing rules. This means that you can choose to roll back to the old structure at any time. Neither will the new rules set contain new content; your rules will only be repositioned to follow the new standard. Here's how: 1. Upgrade to version 4.6.0 (or later) You have received an e-mail from Neupart with a link to downloading the latest version of SecureAware. Upgrade as described on the download page. 2. (Only for users of the old policy module) Transfer collection to Policy TNG You ONLY have to follow this step if your information security handbook (collection) is located in Policy 3 (the "old" Policy Module). Go to Policy TNG Click Copy collection from Policy 3 Select your information security handbook click OK (it may take up to a minute before your information security handbook is transferred). 3

3. Copy rules to the ISO 27002:2013 rules set Click on your Information Security Handbook (collection) in Policy TNG. Click New Document Select Copy Document Select Copy to new structure In Select requirement set, select ISO 27002:2013 In Select rules set select the rules set to be copied click OK (it may take up to a minute before the rules set is created). You now have a new document with your rules structured as in the new standard. 4. Check that your rules are placed correctly Based on the mapping of rules to the standard as well as the rules' location relative to each other, SecureAware has "guessed" where the rules should be placed in the new rules set. However, not all rules can be placed (eg. rules that you have written yourself). These rules are placed at the bottom of the rules set. Place these "orphan" rules in the appropriate section by clicking on the rule select the tab Placement find the right chapter in the drop-down menu click Save. Now review the rest of the new rules set to make sure that the rest of the rules are placed correctly. 4

5. Add rules to your new rules set As the new standard contain new requirements, Neupart have added new rules to the SecureAware rules database. It's a good idea to check which new rules are relevant to you and then add them to your new rules set: Open your Information Security Handbook (collection) and click New Document Select Gap analysis ISO 27002:2013. 5

You will now see a list of ISO 27002:2013 chapters on the left side of the screen. In the right side of the screen you can see the rules, procedures, etc. that you have in your rules set that refer to the chapter. If the box is green, it means that you have one or more rules etc. that refer to the chapter. If it is red you have none. Whether the box is red or green, you will, in some of the chapters, have a link saying Add rules, (X) suggestions found. This means that there are new rules in the rules database that might be relevant to you. Click on the text Add rules, (X) suggestions found Click next to a rule that you want to add Select where in the rules set it should be placed from the dropdown menu (please note that you now have two rules set - remember to place them in the new one) Select the options to be included by checking them off click OK Repeat until you have added all relevant rules. Remember that the new rules set must be published before other users can see it. 6

6. Create an ISO 27001:2013 rules set (optional) You can now create an additional rules set based on the standard ISO 27001:2013. This standard describes how to run your ISMS (Information Security Management System). Open your Information Security Handbook (collection) and click New Document New Document from Template Select Information Security Rules for each ISO 27001:2013 requirement Click OK. You now have a set of rules for your ISMS, which can be edited in the same way as other rules sets. 7 Disable the old rules set When you are ready to switch to the new rules set, the old rules set should be disabled and you may need to remove some access rights. When you disable a rules set, all links from tasks to the rules set will be removed (the links now only point to the corresponding rule in the new rules set). Furthermore, the disabled rules set will no longer be included in gap analyzes and SoA documents. Click Edit at the top right of the rules set Select the Settings tab Uncheck the Enabled box Click OK. To hide the old set of rules for other users, click Edit (if the rules are not in edit mode, you must first click on the Edit Content tab) Select the tab Access rights Modify user access rights click OK. 7

Contact Information - Further information is available by contacting KMD KMD – GRC Neupart Lautrupparken 40-42 2750 Ballerup Denmark support@neupart.com Tel 45 7025 8030 Copyright 2016 KMD A/S. All rights reserved. The author of this documentation is KMD A/S. All information herein including text and graphics belongs to KMD A/S unless stated otherwise and is protected by copyright laws in Denmark and international agreements. Permission to quote this documentation in its entire form or partly is given under the premises that no changes are made and that information about this copyright is clearly stated on all copies. No material may be copied or distributed without explicit approval of KMD A/S. KMD A/S preserves the right to - at any time and without warning – make changes and/or improvements in the products mentioned. Names of other companies and their products are or can be registered trademarks or trademarks that belong to their owners. KMD and SecureAware logo and the name “SecureAware” are trademarks belonging to KMD A/S. The documentation is provided "as is", without warranty of any kind, express or implied, including but not limited to the warranties of merchantability, fitness for a particular purpose and non-infringement. In no event shall the authors or copyright holders be liable for any claim, damages or other liability, whether in an action of contract, tort or otherwise, arising from, out of or in connection with the documentation or the use or other dealings in the documentation. The documentation including graphics could contain inaccuracies or typographic errors. Furthermore there are no guarantees regarding results achieved by using this information. All rights not explicitly mentioned herein are preserved. 8

4 3. Copy rules to the ISO 27002:2013 rules set Click on your Information Security Handbook (collection) in Policy TNG. Click New Document Select Copy Document Select Copy to new structure In Select requirement set, select ISO 27002:2013 In Select rules set select the rules set to be copied click OK (it may take up to a minute before the rules set is created).