When you start your ISMS with business processes and information, you get clear priorities from day one: you know which systems are truly critical, and you can justify every classification in an audit. Here you'll see which typical problems you avoid and what this looks like in practice.
Three problems you avoid
Many ISMS projects stall at the same points. Ariadne ISMS is designed so that you avoid these pitfalls from the start.
Two languages in one company
Processes here, assets and protection goals there
Quality management talks about processes, the ISMS about assets, risks and protection goals. As a result, business departments often don't feel addressed.
Starting with IT assets creates review effort
A never-ending matrix
If you review every asset individually, the math quickly looks like this: 100 assets times 47 BSI elementary threats times three protection goals times the Annex A controls. The result is a huge matrix that prioritizes nothing.
No real prioritization
Criticality based on gut feeling
Without the business perspective, IT estimates how critical a system is. That is hard to justify in an audit.
Justifiable in an audit
Instead of "What do we secure?", you first ask: "What must we not lose?" This order has two concrete benefits:
- Traceable required protection: For every system you can show which information and processes determine its required protection.
- Responsibility stays with the business: ISO 27001 requires that the ISMS is not fully delegated to IT. Working with business processes and information automatically involves business departments and management.
Who contributes what
Each role contributes the knowledge it already has. This spreads the work sensibly:
| Functional role | Contribution |
|---|---|
| Process owner | Names the information used in the process and performs the business impact analysis. |
| ISO (information security officer) | Ensures consistent assessments and keeps the big picture in view. |
| IT | Maintains assets and dependencies and works on risks together with the information security officer. |
| Management | Owns thresholds and prioritization and accepts residual risks. |
What this looks like in practice
An example from manufacturing shows how quickly solid priorities emerge. First you assess the information for confidentiality and integrity:
| Information | Required protection confidentiality / integrity |
|---|---|
| Production drawings, CNC programs | Catastrophic |
| Customer and contract data | Severe |
| Employee data | Severe |
| Cost calculations | Severe |
| Internal administrative documents | Low |
Then you ask for each process: how long can it be down before intolerable damage occurs? The person responsible for the process knows the answer.
| Process | Tolerable outage | Who knows? |
|---|---|---|
| Production | max. 4 hours | Head of production |
| Order processing | max. 1 day | Head of sales |
| Quality assurance | max. 1 day | Head of quality |
| Drafting contracts | 2 to 3 days | Head of finance and administration |
| Creating quotes | max. 1 day | Head of sales |
With these two tables, your priorities are set before you assess a single IT system. Every system that stores production drawings or supports production later inherits the high required protection automatically.
Putting the approach into practice in the ISMS module
| Step | What you do | Guide |
|---|---|---|
| 1 | Create business processes and link information | Read article |
| 2 | Classify information and perform the BIA | Information · BIA |
| 3 | Create assets and connect them through dependencies | Read article |
| 4 | Assess and treat risks on critical assets | Read article |
Related articles
Was this article helpful?
That’s Great!
Thank you for your feedback
Sorry! We couldn't be helpful
Thank you for your feedback
Feedback sent
We appreciate your effort and will try to fix the article