When several people work on information security, you need to see which decisions have been made and what supports them. AmpliFlow’s control register lets you keep your assessments, responsible people and descriptions of how you work together.
Annex A of ISO 27001 contains 93 security controls. They help you examine whether your information protection has gaps. A control may concern how people work, how premises are protected or how technology is used. Here we explain how you can record your assessments and follow up implementation in AmpliFlow.
Start with your risks and decisions
Consider the information you handle, what could happen to it and the protection you need. If a colleague sends customer data to the wrong recipient, for example, examine both how the file is shared and how the mistake is handled. The risk assessment helps you choose measures that fit your organization.
ISO 27001 clause 6.1.3 connects the choice of safeguards to risk treatment. Comparing your choices with Annex A helps you spot things you might otherwise have missed. Your own needs may also call for safeguards beyond the annex. Base the selection on your risks and requirements rather than assuming that every control has the same significance for every company.
Read more about working with Annex A.
Work in the control register
Divide the work so that colleagues who know the information, procedures and technology can contribute. The following workflow helps you keep assessments and implementation together:
- Bring the right people together. Ask colleagues who know your operations and IT environment to contribute evidence for the assessments.
- Record your decisions. Set applicability and provide a justification where you assess a control as not applicable. Make your own assessment rather than assuming the answer is always yes.
- Describe the current situation. Set the status and explain how you actually work. Distinguish completed work from plans.
- Assign responsibility. Link responsible people to the control so you know who can answer questions and take outstanding work forward.
- Link supporting records. Link relevant risks, processes and documents to the control. Choose records that let someone check your statements.
- Follow up with those responsible. Check whether the working method is being used and update the description and status when something changes.
What should you fill in?
Applicability and justification: Decide whether the control is needed within the scope of your management system. If you exclude it, explain why and what evidence you used. Another person should be able to follow the reasoning when the business changes.
Status: Show how far you have progressed. Agreeing on a working method does not mean that people are already using it. Update the status as implementation progresses and check the result with those who perform the tasks.
Responsible people and contributors: Identify who coordinates the work and who needs to contribute. In a smaller company, one person may have several tasks. The person responsible needs to know what remains and which questions need a decision.
Explanation and internal description: Use the explanation field to help colleagues understand the issue. Then describe how you handle it in the internal description. A statement such as “we manage access rights” says less than explaining who requests access, who approves it and how staff departures are followed up.
In-depth information, tools and evidence: Keep the details needed to perform and check the work. Link relevant risks, processes and documents so you can find the evidence without writing the same instruction in several places.
Separate the internal description from the SoA text
Your Statement of Applicability (SoA) explains which safeguards you have chosen and why. It also shows what has been implemented and your reasons for excluding anything from Annex A. This makes the decisions open to review and reassessment.
The control register has separate fields for an internal description and text for your SoA.
The internal description can help colleagues find the right procedure and understand how a task is performed. In the SoA text, describe your working method for the reader of the statement. Choose the level of detail for the audience and purpose; avoid sharing sensitive information unnecessarily.
What appears in the SoA export?
AmpliFlow’s PDF export shows the control reference and name, applicability, status and your SoA description. For a control marked as not applicable, the justification appears in the description column. Controls are grouped by category.
The internal description, explanation, in-depth information, tool field and linked evidence are not included in the PDF’s control table. The SoA text therefore needs to make sense to someone who cannot see your internal notes.
Review the export before sharing. Do the descriptions match what you do? Is there evidence for the assessments? May the recipient access the content? Also decide when to review the decisions again, for example after replacing a system or changing which customer data you handle.
Read more about control management in AmpliFlow or contact support if you need help with the tool.
