The PDCA cycle in ISO 27001

With so many security attacks around, organizations increasingly need effective cybersecurity measures, and ISO standards have become a normal part of how companies work. ISO standards are developed and published by the International Organization for Standardization (ISO). Their main purpose is to standardize specific processes in areas such as information security.

Among them, the ISO 27000 family stands out. It is a series of standards that sets out the guidelines and requirements for implementing an Information Security Management System (ISMS).

Within this family, the main standard, and the one you can certify against, is ISO 27001. It sets out the requirements for establishing, implementing, maintaining and continually improving an ISMS.

Looking at the standard itself, clauses 4 to 10 can be read as a Deming or PDCA cycle. They are:

• Context of the organization
• Leadership
• Planning
• Support
• Operation
• Performance evaluation
• Improvement

PDCA stands for Plan-Do-Check-Act. The method is built on continual improvement, since no process is ever implemented with 100% effectiveness and accuracy. The four words in the name are the four phases of the cycle.

One nuance: the 2005 edition of ISO 27001 explicitly described PDCA as the model for implementing the ISMS. Since the 2013 edition, which adopted the structure shared by all ISO management system standards, it no longer requires it. The clauses still fit the cycle, which is why it is still used to organize implementation.

The main goal of this phase is to establish the Information Security Management System. This is where you set the information security objectives, procedures and policies, with a view to improving security over time.

You also need to define the scope of the management system and the roles, duties and responsibilities in the project.

Four clauses of ISO 27001 belong to this first planning phase:

• Context of the organization
• Leadership
• Planning
• Support

The context clause covers the first building blocks of the management system: the context itself, meaning everything around the organization that affects it, the interested parties, and the scope of the system to be implemented.

The leadership clause requires top management to show leadership and commitment to implementing and maintaining the management system. To do so, it defines an information security policy that everyone involved must know and apply, along with their roles and responsibilities.

Planning, the next clause, is where you define how information security risks are assessed and treated (6.1), including the risk treatment plan and the Statement of Applicability. It is also where you set the information security objectives (6.2), which, as the standard says, must be consistent with the security policy, measurable, communicated and kept up to date. The 2022 edition adds planning of changes to the ISMS (6.3).

Finally, this phase also covers support, which includes several tasks. On one hand, you determine the resources needed to implement the management system and commit to making them available. On the other, you make sure people are competent and aware, through security training. You also need procedures for proper communication within the company. Last, the organization has to manage the system’s documentation.

This is where the ISMS you designed is put into practice. The procedures set in the previous phase are carried out and the necessary controls and operations are implemented so that the organization’s information is managed securely and effectively.

In ISO 27001, this phase corresponds to clause 8, Operation. As mentioned above, this is where the management system you defined is launched and implemented.

The main tasks here are carrying out risk assessments at planned intervals (8.2) and implementing the risk treatment plan (8.3). The asset inventory, which is usually the starting point of the analysis, is one of the Annex A controls (5.9).

In this phase, the “C” in PDCA, you evaluate and review how effective the Information Security Management System planned and implemented in the earlier phases is. That means checking that the security policy, the objectives and the procedures in place are being met.

These evaluations and reviews should be carried out regularly, to make sure the procedures and actions used to establish and implement the ISMS are in place and working.

This phase of the Deming cycle is roughly equivalent to clause 9 of ISO 27001, Performance evaluation. Here you decide what needs to be monitored and measured, and the methods needed to get valid results. For the monitoring, measurement, analysis and evaluation of the ISMS, the organization needs data mature enough to give reliable reference values.

To do this, you set metrics and indicators to measure how effective the ISMS is. You also create procedures for the internal audit and the management review, both of which take place before the external certification audit.

In the last phase of the cycle, the ISMS is maintained and improved. This means taking corrective actions to improve the results and achieve continual improvement of the Information Security Management System.

This phase corresponds to clause 10, Improvement, of the standard. The clause has two parts. The first is managing the nonconformities found in the system, whether through internal or external audits or by employees who spot possible gaps or breaches while doing their work.

Preventive actions have not been a separate requirement since the 2013 edition: risk management in clause 6 now plays that role.

The second is continual improvement: ongoing maintenance of the ISMS, aimed at making the system the organization has implemented more effective and efficient.

At GlobalSuite Solutions our Consulting team can help you implement an ISMS based on ISO 27001. We have been running this kind of project for more than 10 years, for companies in all kinds of sectors and businesses.

We also have the GlobalSuite® software, which automates and manages ISO 27001 to make your ISMS work better. It is flexible enough to handle the most complex requirements in an affordable and intuitive way, helping you achieve ISO 27001 certification and, with it, better cybersecurity for your company.