Ngokusekelwe embhalweni wenkomba, nikeza uhlu olunezinhlamvu lwezigaba ezintathu ze-ISO 27001 Certification kanye nemisebenzi yesigaba ngasinye.
Context:I-SO/IEC 27001 iyizinga lamazwe omhlaba lokuphatha ukuphepha kolwazi. Le ndinganiso yashicilelwa ngokuhlanganyela yi-International Organization for Standardization (ISO) kanye ne-International Electrotechnical Commission (IEC) ngo-2005, yahlelwa kabusha ngo-2013, futhi muva nje ngo-2022. Kunezinhlobo eziningi ezihlonishwayo zezinga lamazwe. Ichaza izidingo zokusungula, ukusebenzisa, ukugcina nokuthuthukisa ngokuqhubekayo uhlelo lokuphathwa kokuphepha kolwazi (ISMS) <unk> inhloso yalo ukusiza izinhlangano zenze izimpahla zolwazi eziziphethe ziphephe ngokwengeziwe. Izinhlangano ezihlangabezana nezidingo zale nqubo zingakhetha ukuqinisekiswa yinhlangano egunyaziwe yokuqinisekisa ngemuva kokuphothulwa ngempumelelo kokucwaningwa kwamabhuku. Ukusebenza kahle kwenqubo yokufaka izitifiketi ye-ISO/IEC 27001 kanye nezinga eliphelele kuhlolwe ocwaningweni olukhulu olwenziwe ngo-2020.  Isebenza kanjani indinganiso Izinhlangano eziningi zinezinqubo zokulawula eziningana zokuphepha kolwazi. Kodwa-ke, ngaphandle kohlelo lokuphathwa kokuphepha kolwazi (ISMS), ukulawula kuvame ukungahleleki futhi kungahlangani, kusetshenziswe kaningi njengezixazululo zamaphuzu ezimweni ezithile noma nje njengendaba yesivumelwano. Ukulawulwa kokuphepha okusebenzayo kuvame ukubhekana nezici ezithile zobuchwepheshe bolwazi (i-IT) noma ukuphepha kwedatha ngokuqondile; kushiya izimpahla zolwazi ezingezona ze-IT (njengamaphepha nolwazi lobunikazi) zivikelekile kancane. Ngaphezu kwalokho, ukuhlelwa kokuqhubeka kwebhizinisi nokuvikeleka ngokomzimba kungalawulwa ngokuzimela kwe-IT noma ukuphepha kolwazi ngenkathi imikhuba ye-Human Resources ingenza ukubhekiswa okuncane kwesidingo sokuchaza nokunikeza izindima nemithwalo yemfanelo yokuphepha kolwazi kuyo yonke inhlangano.  I-ISO/IEC 27001 idinga ukuthi ukuphathwa:  Ukuhlola ngokuhlelekile ubungozi bokuphepha kolwazi lwenhlangano, kucatshangelwa izinsongo, ubuthakathaka, kanye nemithelela; Ukwakha nokusebenzisa uhlelo oluhambisanayo noluphelele lokulawula ukuphepha kolwazi kanye/noma ezinye izindlela zokwelashwa kwengozi (njengokugwema ubungozi noma ukudlulisa ubungozi) ukuze kubhekwane nalezo zingcuphe ezibhekwa njengezingamukeleki; futhi Ukwamukela inqubo ebanzi yokuphatha ukuze kuqinisekiswe ukuthi izilawuli zokuphepha kolwazi ziyaqhubeka nokuhlangabezana nezidingo zokuphepha kolwazi zenhlangano ngokuqhubekayo. Yiziphi izilawuli ezizohlolwa njengengxenye yokuqinisekiswa kwe-ISO/IEC 27001 kuncike kumcwaningi mabhuku wokuqinisekisa. Lokhu kungahlanganisa noma yiziphi izilawuli inhlangano eye yazibheka njengokungena emkhakheni we-ISMS futhi lokhu kuhlolwa kungaba kunoma yikuphi ukujula noma ubukhulu njengoba kuhlolwe ngumcwaningi mabhuku njengoba kudingekile ukuze kuhlolwe ukuthi izilawuli zisetshenzisiwe futhi zisebenza ngempumelelo.  Ukuphathwa kunquma ububanzi be-ISMS ngezinhloso zokuqinisekisa futhi kungakhawulela, ngokwesibonelo, kuyunithi yebhizinisi elilodwa noma indawo. Isitifiketi se-ISO/IEC 27001 asisho ukuthi yonke inhlangano, ngaphandle kwendawo ehlanganisiwe, inendlela efanele yokuphatha ukuphepha kolwazi.  Amanye amazinga emkhayeni wamazinga we-ISO/IEC 27000 anikeza isiqondiso esengeziwe ngezici ezithile zokwakhiwa, ukuqaliswa nokusebenza kwe-ISMS, isibonelo ekuphatheni ubungozi bokuphepha kolwazi (i-ISO/IEC 27005).  Umlando we-ISO/IEC 27001 I-BS 7799 kwakuyindinganiso eyanyatheliswa ekuqaleni yi-BSI Group ngo-1995. Yabhalwa uMnyango Wezohwebo Nezimboni (DTI) kahulumeni wase-UK futhi yayinezingxenye eziningana.  Ingxenye yokuqala, equkethe imikhuba emihle yokuphathwa kokuphepha kolwazi, yabuyekezwa ngo-1998; ngemuva kwengxoxo ende ezinhlanganweni zamazinga omhlaba wonke, ekugcineni yamukelwa yi-ISO njenge-ISO / IEC 17799, "Information Technology - Code of practice for information security management. " ngo-2000. I-ISO/IEC 17799 yabe isibuyekezwa ngoJuni 2005 futhi ekugcineni yafakwa ochungechungeni lwamazinga e-ISO 27000 njenge-ISO/IEC 27002 ngoJulayi 2007.  Ingxenye yesibili ye-BS7799 yashicilelwa okokuqala yi-BSI ngo-1999, eyaziwa ngokuthi i-BS 7799 Ingxenye 2, enesihloko esithi "Information Security Management Systems - Ukucaciswa okunesiqondiso sokusetshenziswa". I-BS 7799-2 igxile ekutheni ungayisebenzisa kanjani i-Information Security Management System (ISMS), ebhekise esakhiweni sokuphatha ukuphepha kolwazi kanye nokulawula okuchazwe ku-BS 7799-2. Lokhu kamuva kwaba yi-ISO/IEC 27001:2005. I-BS 7799 Ingxenye 2 yamukelwa yi-ISO njenge-ISO/IEC 27001 ngoNovemba 2005.  I-BS 7799 Ingxenye 3 yashicilelwa ngo-2005, ihlanganisa ukuhlaziywa kwengozi nokuphathwa kwayo. Ivumelana ne-ISO/IEC 27001:2005.  Kuncane kakhulu okubhekiswe noma okusetshenziswe kunoma yiliphi izinga le-BS elihlobene ne-ISO/IEC 27001.  Isitifiketi I-ISMS ingase iqinisekiswe ukuthi ihambisana ne-ISO/IEC 27001 yi-Registrars eminingi egunyaziwe emhlabeni wonke. Isitifiketi esivela kunoma yiziphi izinhlobo ze-ISO/IEC 27001 ezihlonishwayo (isibonelo, i-JIS Q 27001, inguqulo yesiJapane) esikhishwe yinhlangano egunyaziwe yokuqinisekisa isebenza ngokulingana nesitifiketi esivela ku-ISO/IEC 27001 uqobo.  Kwamanye amazwe, izikhungo eziqinisekisa ukuhambisana kwezinhlelo zokuphatha namazinga athile zibizwa ngokuthi "izikhungo zokuqinisekisa", kanti kwamanye zivame ukubizwa ngokuthi "izikhungo zokubhalisa", "izikhungo zokuhlola nokubhalisa", "izikhungo zokuqinisekisa/zokubhalisa", futhi ngezinye izikhathi "ababhalisi".  Isitifiketi se-ISO/IEC 27001, njengezinye izitifiketi zesistimu yokuphatha ye-ISO, ngokuvamile sihilela inqubo yokuhlola yangaphandle enezigaba ezintathu echazwe yizindinganiso ze-ISO/IEC 17021 ne-ISO/IEC 27006:  Isigaba 1 ukubuyekeza kokuqala, okungekho emthethweni kwe-ISMS. Isibonelo, kukhona ukuhlolwa kokubakhona nokugcwala kwemibhalo esemqoka, njengenqubomgomo yokuphepha kolwazi yenhlangano, Isitatimende Sokusebenza (SoA), kanye noHlelo Lokwelashwa Kobungozi (RTP). Lesi sigaba sisetshenziselwa ukujwayela abacwaningi-mabhuku inhlangano futhi okuphambene nalokho. Isigaba 2 siwucwaningo lokuhambisana olunemininingwane futhi olusemthethweni, ukuhlola ngokuzimela i-ISMS ngokuhambisana nezidingo ezichazwe ku-ISO/IEC 27001. Abacwaningi-mabhuku bazofuna ubufakazi bokuqinisekisa ukuthi uhlelo lokuphatha lwaklanywa futhi lwasetshenziswa ngendlela efanele, futhi luyasebenza ngempela (ngokwesibonelo ngokuqinisekisa ukuthi ikomidi lezokuphepha noma inhlangano efanayo yokuphatha ihlangana njalo ukuqapha i-ISMS). Ukuhlolwa kwesitifiketi kuvame ukuqhutshwa abahloli abaholayo be-ISO/IEC 27001. Ukuphumelela kulesi sigaba kuholela ekutheni i-ISMS iqinisekiswe ukuthi ihambisana ne-ISO/IEC 27001. Ukuqhubeka kuhilela ukubuyekeza okulandelayo noma ukuhlola ukuze kuqinisekiswe ukuthi inhlangano ihlala ihambisana nezindinganiso. Ukugcinwa kwesitifiketi kudinga ukuhlolwa kokuphinda kuhlolwe ngezikhathi ezithile ukuze kuqinisekiswe ukuthi i-ISMS iyaqhubeka nokusebenza njengoba kuchaziwe futhi kuhlosiwe. Lokhu kufanele kwenzeke okungenani njalo ngonyaka kodwa (ngokuvumelana nabaphathi) kuvame ukuqhutshwa kaningi, ikakhulukazi ngenkathi i-ISMS isakhula.
Lokhu okulandelayo yizigaba ezintathu zesitifiketi se-ISO 27001: 1. Izinkomo Isigaba 1: Ukubuyekezwa kokuqala, okungekho emthethweni kohlelo lokuphathwa kokuphepha kolwazi. Imisebenzi ihlanganisa ukuhlola ukuba khona nokugcwala kwemibhalo eyinhloko. 2. Izingelosi Isigaba 2: Ukucwaningwa kwamabhuku okuningiliziwe nokungokomthetho okwenziwa umuntu wesithathu ukuze kuqinisekiswe ukuthi izidingo ezichazwe ku-ISO 27001 zifezwe ngendlela efanele 3. Izindaba Ezinhle Okuqhubekayo: Ukubuyekezwa nokuhlolwa okulandelwayo ukuze kuqinisekiswe ukuhambisana okuqhubekayo nezidingo ze-ISO 27001.