Make security
understandable.

ISO/IEC 27001:2022 — What an ISMS Actually Does

ISO/IEC 27001 specifies requirements for establishing, implementing, maintaining and continually improving an Information Security Management System (ISMS). It helps an organisation manage information-security risks in a structured way; it is not simply a list of technical controls.

What an ISMS should connect

• Context and scope: understand business activities, interested parties, dependencies and the boundaries of the ISMS.
• Leadership: establish policy, responsibilities and management commitment.
• Risk assessment and treatment: identify risks, evaluate them using defined criteria, select treatment and document decisions.
• Operational controls: implement appropriate people, process and technology safeguards.
• Performance evaluation: monitor objectives, conduct internal audits and perform management reviews.
• Improvement: address nonconformities and improve the system over time.

Practical implementation sequence

1. Agree the scope and accountable sponsor.
2. Understand obligations, assets, processes and risk criteria.
3. Perform a risk assessment and create a treatment plan.
4. Determine applicable controls and document the Statement of Applicability as required by the standard.
5. Implement controls and retain operational evidence.
6. Conduct internal audit, management review and corrective action.
7. If certification is desired, select a competent certification body and prepare for an independent audit.

Primary source: ISO — ISO/IEC 27001:2022. The full standard is copyrighted; consult the official publication for exact requirements and wording.

How to Build a Useful Information Security Risk Register

A risk register is a decision and tracking tool. It should make the risk understandable to a business owner and show what action will reduce it or why the organisation accepts it.

Recommended fields

• Risk ID, date raised, business unit and risk owner.
• Asset/process and business objective affected.
• Threat event, vulnerability or weakness, and plausible consequence.
• Existing controls and evidence that they operate.
• Inherent likelihood and impact, scoring method and rationale.
• Current risk rating and risk acceptance criteria.
• Treatment decision: mitigate, avoid, transfer/share, or accept where appropriate.
• Actions, accountable owner, due date, budget/dependency and status.
• Residual risk after treatment, approval and next review date.

Example risk statement

Because administrator accounts do not consistently use phishing-resistant multifactor authentication, a compromised credential could enable unauthorised privileged access and disruption to critical services.

This is an illustrative scenario, not a claim about any real organisation. Validate it against actual architecture, evidence and threat context before adding it to a live register.

Good practices

• Use defined likelihood and impact scales; do not rely on unexplained numbers.
• Separate risk from the control gap and from the remediation task.
• Assign one accountable risk owner, even when multiple teams implement actions.
• Record formal acceptance, authority, rationale and expiry/review conditions.
• Reassess after significant changes, incidents or new threat intelligence.

Reference: ISO 31000:2018 — Risk management guidelines and the ISO/IEC 27001 standard page.

From Audit Checklist to Defensible Audit Evidence

An audit conclusion should be supported by objective evidence and a defined test. A policy document can show that a process is designed, but may not prove that the process is operating effectively.

A practical control-testing method

1. Define the criterion: identify the applicable requirement, policy or approved control.
2. Identify the population: determine which users, systems, records or events should be covered.
3. Select a sample: document the sample method, period and limitations.
4. Inspect and test: examine records, configurations, approvals or logs; use interviews as supporting evidence rather than the sole basis where possible.
5. Record results: note evidence identifier, date, source, test performed, outcome and any limitations.
6. Conclude carefully: distinguish compliant, partially compliant, noncompliant and not applicable using documented criteria.
7. Follow up: assign corrective actions, owners, target dates and retesting requirements.

Example evidence log

Never fabricate evidence, backdate records, or convert missing evidence into a positive conclusion. If a requirement does not apply, document the rationale and obtain the appropriate approval.

Reference: ISO/IEC 27001:2022. Use the official standard and your organisation's audit methodology for normative requirements.

India’s DPDP Framework: Act, Rules and Implementation Planning

India's Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 are primary sources for understanding the country's digital personal-data protection framework. Organisations should verify the official commencement notifications, phased enforcement timeline, applicability and any subsequent amendments before treating a provision as currently enforceable.

Start with a practical readiness assessment

1. Map personal data: identify data categories, purposes, individuals, systems, locations, recipients and retention practices.
2. Establish accountability: identify responsible functions, escalation paths and decision-makers.
3. Review notices and consent where applicable: ensure the actual processing practice aligns with the applicable legal basis and notice obligations.
4. Manage processors: inventory vendors, review contracts and document security/privacy responsibilities.
5. Support individual requests: establish intake, identity verification, routing, response tracking and closure evidence for applicable rights.
6. Manage retention and deletion: document retention criteria, legal holds, deletion workflows and evidence.
7. Prepare for incidents: coordinate security, legal, privacy and communications teams; determine applicable notification duties and timelines.
8. Train and monitor: maintain awareness records, control tests, issue logs and periodic management reporting.

Primary sources: Ministry of Electronics and Information Technology (MeitY), DPDP Rules, 2025 and enforcement timeline, and the Press Information Bureau explainer.

CVE, CVSS and CISA KEV: Three Different Signals

These terms are related, but they answer different questions.

• CVE: a standard identifier for a publicly disclosed cybersecurity vulnerability.
• CVSS: a framework for expressing vulnerability severity using defined metrics. A score is not, by itself, a complete business risk assessment.
• CISA KEV: a catalog of vulnerabilities known to have been exploited in the wild, useful for remediation prioritisation.

How to use them together

1. Match the vulnerability to your exact product and version.
2. Review the vendor advisory and applicable patch or mitigation.
3. Check severity and whether reliable sources report exploitation.
4. Check whether it appears in CISA's KEV catalog.
5. Prioritise based on exploitation, external exposure, asset criticality, impact and compensating controls.
6. Track remediation and verify closure.

Sources: CVE Program, FIRST CVSS, and CISA KEV Catalog.

Incident Readiness in India: CERT-In Directions

Organisations should maintain an incident response process that can identify events, determine severity, preserve evidence, coordinate decisions and assess external reporting duties without unnecessary delay.

Build a usable workflow

1. Provide a clear reporting channel for employees and service providers.
2. Record detection time, discovery method, affected systems, data, and initial indicators.
3. Preserve relevant logs and evidence with appropriate access controls.
4. Engage security, IT operations, legal/privacy, business owners and leadership as appropriate.
5. Assess applicable regulatory, contractual and customer notification requirements.
6. Record decisions, submissions, timelines, updates and lessons learned.
7. Test the process with tabletop exercises and remediate identified gaps.

Primary sources: CERT-In Directions under section 70B, official FAQ, and Press Information Bureau summary.