nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Information Security Management System - ISMS (ISO 27001)

Phil Mauger

We have used Wrike to implement an entire ISMS. The diagram below shows all the elements of security that we've captured in Wrike, and the arrows show how we've related them to each.

Our external auditors for ISO 27001 have been very pleased with the result and it's made securing and maintaining our certification very easy.

I'm curious if anyone else has tried to do this in Wrike. I would love to swap ideas!

Find more posts tagged with

security

Comments

John_Egleston

Wow, @Phil Mauger - even the summary diagram is impressive! (Every IT project I do as a business analyst comes with a free scary diagram.) I've not yet been part of such a process, but am very interested in seeing how it was captured in Wrike. Sounds like potential material for a Wrike Solution template to share?

Sherrie Besecker

I haven't done anything like this in Wrike - but really curious to see if you have Klaxxoon - because there could really be a lot of potential to open this up to your team to collaboratively connect on this and action items where needed between both tools!

Naleen Kumar

This is a fantastic example of extending Wrike beyond traditional project management. As a Wrike administrator, I can see tremendous value in using custom item types, workflows, request forms, and cross-tagging to create a fully connected ISO 27001 ecosystem. Having risks, controls, audits, suppliers, training, and corrective actions managed in a single platform can significantly improve visibility, accountability, and compliance readiness. Thanks for sharing this innovative approach!

Janelle Tyler

This is really impressive, @Phil Mauger! I love seeing Wrike used beyond traditional project management to connect so many different parts of a larger operational process. The relationship between risks, controls, responsibilities, training, auditing, and the other elements is especially interesting.

I’d be curious to learn more about how you structured this inside Wrike. Did you build most of the system using Custom Item Types and custom fields, or are you also using automations and request forms to help maintain it? I’d love to see more of the actual Wrike setup behind this diagram!

Shelly Erickson

This is amazing. I just passed a link to the article to my Director of IT Operations/Cybersecurity. We have been focused on our SOC2 as we stood up a new system a few years back and our hospital partners want to see that. Sounds like this is another direction our team can go to add additional security measures and comfort to our hospital partners.

Phil Mauger

Thank you all for your nice comments!😊

@John_Egleston: I have often thought about creating a template from our security framework. Unfortunately it would be quite a lot of work but I would love to try and do this sometime!

@Sherrie Besecker: We did look at Klaxoon, but unfortunately, being a small company, we're not able to afford the additional subscription at this time 🙁 One problem with the system is being able to show many to many connections across multiple item types. For example if a vulnerability is exploited, what systems does it affect, who should be notified, what controls have we got in place to recover from it, what documentation have we got, etc. We have all of that in there, but it's not quite as straightforward as I would like to see it. Wrike is great when going down a hierarchy, but not so easy when going upwards. Showing it all in Klaxoon would greatly enhance this.

@Naleen Kumar: You're welcome!!

@jtyler81: I have indeed made extensive use of custom item types, custom fields, taylored views, request forms, and blueprints. However I've not had much luck with automations, though there have been instances when they would be useful. I've tried using agents as well but not successfully, and as mentioned above, we can't afford much capacity for agent use anyway.

I would love to demo what I have, though I'm not sure how I'd do it, plus a lot of it is of course very sensitive. Perhaps if I do create a template I can demo it that way.

@Shelly Erickson: As above I would welcome the chance to demo it, if I can find a way to do so without revealing confidential material. I'd be very happy to have a chat with your Director of IT Operations/Cybersecurity, if you would like to put us in contact.

John_Egleston

Any demo sounds like an opportunity to rebuild it in a demo org rather than all the blurring and obfuscation necessary to protect security.