ISO 27001 ISMS Handbook Implementing and Auditing an Information Security Management System in Small and Medium-sized Businesses

ISO 27001 ISMS Handbook aims to assist small and medium-sized businesses in implementing and maintaining an information security management system (ISMS) in accordance with the requirements of the international standard ISO/IEC 27001:2022.

This handbook assumes that you ultimately want your information security management system to be certified by an accredited certification body. In this book, you will find detailed explanations, more than a hundred examples, and sixty common pitfalls. This book also contains information about the rules of the game and the course of a certification audit.

This handbook is also intended to provide information to auditors who must investigate whether an information security management system meets all requirements and has been effectively implemented.

ISO 27001 ISMS Handbook focuses on the information security management system (ISMS), and to a lesser extent on the Annex A controls. For a detailed explanation of the 93 Annex A controls, you can use the ISO 27001 Controls Handbook – Implementing and auditing 93 controls to reduce information security risks.

Cees van der Wens (1965) studied industrial automation in the Netherlands. In his role as Lead Auditor, the author has carried out dozens of ISO/IEC 27001 certification audits at a wide range of organizations. As a consultant, he has also helped many organizations obtain the ISO/IEC 27001 certificate.