In a previous article, ARES Vietnam outlined several areas that businesses should proactively review when the 2025 Cybersecurity Law takes effect. These include information systems, data classification, access rights, data backup, and incident response plans. Cybersecurity Law No. 116/2025/QH15 was issued on December 10, 2025, and officially took effect on July 1, 2026.

However, identifying the necessary actions is only the first step. To maintain the long-term effectiveness of information protection measures, organizations need a consistent management framework. They should also assign responsibilities clearly, maintain appropriate records, and conduct regular reviews whenever their technology, workforce, or business model changes.

For this reason, many businesses choose to establish an Information Security Management System based on ISO/IEC 27001. In this article, ARES Vietnam explains how the standard supports businesses in managing cybersecurity requirements.

See also: The 2025 Cybersecurity Law Officially Takes Effect on July 1, 2026: What Should Businesses Do?

ISO/IEC 27001 Hỗ Trợ Doanh Nghiệp Quản Lý Yêu Cầu An Ninh Mạng Như Thế Nào?

Businesses may already apply various measures, such as controlling access rights, backing up data, using security software, or providing employee training. However, when these activities are implemented separately, maintaining their effectiveness becomes more difficult as systems, people, and risks continue to change.

Through an Information Security Management System, ISO/IEC 27001 helps businesses connect these activities within a clear management framework. It also assigns specific responsibilities and supports regular reviews. This role is reflected in the following seven key areas.

1. Clearly Identify What the Business Needs to Protect

Before selecting protection measures, a business needs to define the scope of its Information Security Management System. This step clarifies which information, systems, processes, and interested parties should be included within the management scope.

The scope may cover:

• Business departments and operational processes;
• Customer data, employee records, financial information, and trade secrets;
• Information technology systems, software, and databases;
• Servers, storage devices, and cloud platforms;
• Relevant locations or branches.

The business should also identify users, suppliers, and third parties that have access to information or participate in information processing.

Once the scope has been clearly defined, the business can focus its resources on the assets that matter most. At the same time, this helps reduce the risk of overlooking systems, data, or connections that may create security risks.

2. Identify the Risks That Require Priority Treatment

Risks vary in both their likelihood and level of impact. Therefore, businesses need to identify which issues require priority treatment instead of applying security measures too broadly

Under ISO/IEC 27001, an organization needs to establish a risk assessment method that reflects its operational context. Through this process, the organization can evaluate the likelihood of each risk, its possible consequences, and its potential impact on information and business operations.

For example, the assessment may identify the following issues:

• Accounts belonging to former employees remain active;
• A user account has more access rights than necessary;
• Data is backed up, but the recovery process has never been tested;
• Important information is stored on personal devices;
• Suppliers lack a clear coordination process for incident response;
• Critical systems have no backup solution in the event of disruption.

Based on the assessment results, the business can select an appropriate risk treatment option. Depending on the defined criteria, it may reduce, avoid, transfer, or accept the risk.

This approach allows the business to focus its resources on issues that may cause significant impact. It also supports earlier action before incidents affect operations.

3. Assign Responsibilities Clearly

Information security is a shared responsibility across the organization rather than the sole responsibility of the IT department. Many security incidents originate from the way employees handle data, how user accounts are managed, supplier activities, or insufficient coordination between departments.

ISO/IEC 27001 requires organizations to define and communicate the roles, responsibilities, and authorities related to the Information Security Management System.

Depending on the organizational structure, responsibilities may include:

• Top management approves the organization’s direction, objectives, and resources.
• The IT department manages the infrastructure and technical security controls.
• The Human Resources department coordinates user account creation, modification, and removal.
• Individual departments are responsible for the information they create or use.
• The Procurement or Legal department manages security requirements for suppliers.
• Employees follow information security policies and report any unusual activities or suspected incidents.

Clearly assigning responsibilities helps prevent overlapping duties, overlooked tasks, and accountability gaps. In addition, it enables the organization to monitor progress and evaluate the effectiveness of each activity more efficiently.

4. Turn Requirements into Practical Processes

Requirements such as “protect data,” “control access,” or “respond to incidents” become much easier to implement when they are translated into practical procedures rather than remaining as general principles.

ISO/IEC 27001 helps businesses convert these requirements into documented policies, procedures, and work instructions. Typical questions that should be clearly defined include:

• Under what circumstances should a user account be created?
• Who has the authority to approve access rights?
• When should user permissions be reviewed?
• How should accounts be removed when employees leave the company or transfer to another department?
• Which data requires backup, and how often should backups be performed?
• Who is responsible for verifying data recovery?
• Who should employees notify after identifying a suspicious email?
• Which types of incidents should be escalated to top management?
• Which information security requirements should be included in supplier contracts?

When procedures are clearly documented, employees can understand and follow them more consistently. At the same time, the organization gains a solid basis for training, monitoring, and ensuring consistent implementation across all departments.

5. Maintain Documented Evidence of Implementation

Information security activities should be supported by documented evidence to demonstrate that they have been carried out effectively.

Such records may include:

• User account and access rights lists;
• Access rights review records;
• Data backup logs;
• Data recovery test results;
• Training and internal awareness records;
• Incident reports and investigation results;
• Supplier evaluation records;
• Internal audit results;
• Management review records;
• Corrective action plans and implementation records.

Maintaining these records allows the organization to verify whether required activities have been completed, identify the responsible personnel, and promptly detect any missing tasks.

These records also provide valuable evidence during internal audits, customer assessments, and ISO/IEC 27001 certification audits.

6. Evaluate the Effectiveness of Security Controls

Having documented procedures does not automatically mean they are being implemented correctly or delivering the expected results.

In practice, businesses may encounter situations such as:

• Data backup procedures are in place, but data recovery has never been tested.
• User access revocation procedures exist, yet former employees’ accounts remain active.
• Information security training has been conducted, but employees are still unsure how to report security incidents.
• Supplier security requirements have been established, but periodic supplier assessments have not been carried out.
• Information security policies have been issued, but compliance has not been monitored.

ISO/IEC 27001 requires organizations to monitor, measure, evaluate, and review whether the Information Security Management System and its controls are implemented effectively and achieve their intended outcomes.

Activities such as performance monitoring, periodic inspections, internal audits, and management reviews help organizations identify areas that require improvement. Based on these findings, the organization can determine the root causes and implement corrective actions before the issues have a greater impact on business operations.

7. Maintain and Update the System as Changes Occur

Information security risks continue to evolve alongside business operations.

New risks may arise when the organization experiences changes such as:

• Deploying new software or information systems;
• Migrating data to cloud platforms;
• Adopting AI, IoT, or other emerging technologies;
• Opening new branches or manufacturing facilities;
• Recruiting, transferring, or restructuring personnel;
• Changing suppliers;
• Integrating systems with customers or business partners;
• Expanding into new markets or introducing new business models.

ISO/IEC 27001 requires organizations to maintain and continually improve their Information Security Management System. Whenever business activities, technologies, or stakeholder requirements change, the organization should review the system scope, reassess information security risks, and evaluate the effectiveness of existing controls.

Regular updates help keep the system relevant and effective while strengthening the organization’s ability to respond to changes in technology, personnel, and the business environment.

ISO/IEC 27001 Certification Services at ARES Vietnam

Managing cybersecurity requirements involves much more than investing in security software or hardware. Businesses need a structured management system that helps identify critical information assets, prioritize risks, assign responsibilities, standardize operational practices, and continuously evaluate performance.

Through an Information Security Management System, ISO/IEC 27001 brings these activities together into a unified framework that can be adapted to the organization’s size, business activities, and operational context.

ARES Vietnam provides ISO/IEC 27001 certification services to help organizations demonstrate the conformity and effectiveness of their Information Security Management System in accordance with the requirements of the international standard.

Learn more: ISO/IEC 27001 Certification Services by ARES Vietnam

Related article: 8 Benefits of Achieving ISO/IEC 27001 Certification

Frequently Asked Questions (FAQ)