ISO 27001 (formerly BS7799) desribes a 6 stage process .

• Define an information security policy
• Define scope of the information security management system
• Perform a security risk assessment
• Manage the identified risk
• Select controls to be implemented applicability"). and applied
• Prepare an So A (a "statement of