{"id":91242,"date":"2020-08-10T13:42:09","date_gmt":"2020-08-10T11:42:09","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/5-stadij-neizbezhnosti-prinyatiya-iso-iec-27001-sertifikaczii-depressiya"},"modified":"2020-08-10T13:42:09","modified_gmt":"2020-08-10T11:42:09","slug":"5-stadij-neizbezhnosti-prinyatiya-iso-iec-27001-sertifikaczii-depressiya","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/5-stadij-neizbezhnosti-prinyatiya-iso-iec-27001-sertifikaczii-depressiya","title":{"rendered":"5 Stages of Inevitability in Accepting ISO\/IEC 27001 Certification: Depression","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

The fourth stage of emotional response to changes is depression. In this article, we will share our experience of going through the longest and most unpleasant stage\u2014changes in the company's business processes aimed at achieving compliance with the ISO 27001 standard.<\/p>\n

\"5
\n<\/p>\n

Anticipation<\/b><\/h2>\n

\nThe first question we asked after selecting the certification body and consultant was\u2014how much time will we realistically need for all the necessary changes?<\/p>\n

The original work plan was drawn up so that we were expected to complete everything within 3 months.<\/p>\n

\"5
\n
\n<\/a><\/noindex>Everything seemed simple: we needed to write a couple of dozen policies and slightly adjust our internal processes; then train our colleagues on the changes and wait another 3 months (for 'records' to appear, meaning evidence of policy functioning). It seemed that was it\u2014we would have the certificate in our pocket.<\/p>\n

Moreover, we weren't planning to write the policies from scratch\u2014after all, we had a consultant who we thought would provide us with all the 'right' templates.<\/p><\/blockquote>\n

As a result of these assumptions, we allocated 3 days for the preparation of each policy. <\/p>\n

The technical changes didn\u2019t seem daunting either: we needed to set up event collection and storage, check if the backups complied with the policy we had written, enhance the information security management systems where necessary, and a bit of various other minor adjustments.
\nThe team responsible for preparing everything necessary for certification consisted of two people. We planned for them to work on implementation alongside their main duties, taking up to 1.5-2 hours a day each.
\nIn summary, we can say that our view on the upcoming workload was quite optimistic. <\/p>\n

Reality<\/b><\/h2>\n

\nIn reality, everything was, of course, different: the policy templates provided by the consultant turned out to be mostly inapplicable to our company; there was almost no clear information online about what needed to be done. As you can imagine, the plan to 'write one policy in 3 days' fell apart spectacularly. Thus, we began to fall behind schedule almost from the start of the project, and the mood began to slowly decline. <\/p>\n

\"5
\n
\nThe team's expertise was catastrophically insufficient\u2014so much so that it was even lacking to ask the right questions to the consultant (who, by the way, wasn't very proactive). Progress slowed even further as, three months after the implementation started (at which point everything should already have been ready), one of the two key participants left the team. A new head of the IT department took over, tasked with quickly completing the implementation process and equipping the information security management system with all the necessary technical aspects. The task seemed challenging\u2026 The responsible parties began to fall into depression.<\/p>\n

Furthermore, the technical side of the issue also had its \"nuances.\" We faced the task of global software modernization both on workstations and on server equipment. During the system setup for event (log) collection, it became clear that we lacked the hardware resources for the system to function properly. The backup software also needed upgrading.<\/p>\n

Spoiler: In the end, the ISMS was heroically implemented in 6 months. And no one even died! <\/p><\/blockquote>\n

<\/p>\n

What has changed the most?<\/b><\/h2>\n

\nCertainly, during the implementation of the standard in the company's processes, a large number of minor changes occurred. We've highlighted the most significant changes for you:<\/p>\n