ISO 27001

WHAT IS ISO 27001?

ISO 27001 is a specification for the management of Information Security. It is applicable to all sectors of industry and commerce and not confined to information held on computers. It addresses the security of information in whatever form it is held. The information may be printed or written on paper, stored electronically, transmitted by post or email. Shown on films, or spoken in conversation. Whatever form the information takes or means, by which it is shared or stored,  ISO 27001 helps an organization ensure it is always appropriately protected. 

Information security can be characterized as the preservation of:

Confidentiality - ensuring that access to information is appropriately authorized. Integrity - safeguarding the accuracy and completeness of information and processing methods. Availability - ensuring that authorized users have access to information when they need it. 

 ISO 27001 contains a number of control objectives and controls.

These Include:

Security Policy, Organisational Security, Asset classification and control, Personnel Security, Physical and environmental security, Communications and operations management, Access control, System development and maintenance, Business continuity management, Compliance. 

WHY IS INFORMATION SECURITY NEEDED?

Information is now globally accepted as being a vital asset for most organizations and business. As such, the confidentiality, integrity and availability of vital corporate and customer information may be essential to maintain competitive edge, cash flow, profitability legal compliance and commercial image.  ISO 27001 is intended to assist with this task. It is easy to imagine the consequences for an organization if its information was lost, destroyed, corrupted, burnt, flooded, sabotaged or misused. In many cases it can (and has led to the collapse of companies. 

HOW DO YOU START TO IMPLEMENT ISO 27001? WHAT IS INVOLVED?

Developing an Information Security Management System (ISMS) that satisfies the requirement of  ISO 27001 involves three steps: 

1. Creation of a management framework for information. This sets the direction, aims, and objectives of information security and defines a policy which has management commitment. 
2. Identification & assessment of security risks. Security requirements are identified by a methodical assessment of security risks. The results of the assessment will help guide and determine the appropriate management action and priorities for managing information security risks. 
3. Selection and implementation of controls. Once security requirement have been identified, controls should be selected and implemented. The controls need to ensure that risks are reduced and acceptable level and meet organization’s specific security objectives. Controls can be in the form of policies, practices, procedures, organizational structures and software functions. They will vary from organization to organization. Expenditure on controls needs to be balanced against the business harm likely to result from security failures 

One section of the actual standard provides guidance on its use.

Adopting ISO 27001 cannot make you organization immune from security breaches. But it will make them less likely and reduce and consequential cost and disruption if they to occur. 

BEING AUDITED TO ISO 27001

Once all the requirement of ISO 27001 have been met, you can apply for and external audit. This should be carried out by a third party, accredited certification body. The chosen certification body will firstly review relevant documentation. This should include the declared policy, scope of the ISMS, documents covering the risk assessment, risk treatment plan, Statement of Applicability and documented security procedures, The auditors will also be checking that you have identified and implemented and controls that are appropriate to you size and type of business. This process is normally carried out at your premises, being more beneficial to both parties. This is followed at a later date by a full on-site audit to ensure that working practices observe these procedures and stated objectives, and that appropriate records are kept. After a successful audit, a certificate of registration to ISO 27001 will be issued. There will then be surveillance visits (usually once or twice a year) to ensure that the system continues to work. 

WHAT ARE THE BENEFITS OF CERTIFICATION TO ISO 27001?

Obtaining a certificate from a third party demonstrates that you have addressed, implemented and controlled the security of your information. 

But the benefits don’t stop there. Certification also:

Comforts customers, employees, trading partners and stakeholders – in the knowledge that your management information and systems are secure. Demonstrates credibility and trust Can lead to cost savings. Even a single information security breach can involve significant costs. Established that relevant laws and regulations are being met. Ensures that a commitment to Information Security exists at all levels throughout and organization. 

WHY CHOOSE ISONIKE FOR YOUR CERTIFICATION AUDIT?

ISONIKE has an enviable record for customer satisfaction for its certification services. A friendly, practical and straightforward approach has led to continual steady growth through referrals from contented clients and management consultants. ISONIKE only employs auditors that have empathy with this approach. They are also carefully allocated by their experience in the industry they are auditing. This results in a practical, meaningful audit, carried out in an air of mutual understanding. ISONIKE firmly believes that its audits should “add value” and benefit the organization being audited. 

The Audit Procedure ISO 27001

Introduction

ISONIKE's assessors are selected to meet the requirements of your particular sector. Your company's activity, location of premises, size and complexity are all taken into account. On receipt of your application form, we will contact you to agree dates for the following: 

A Document Review

The document review aims to establish that your information security management system documentation meets the requirements of the standard. We compile a detailed report and a planned audit schedule. These are discussed with you and provided for your information. If deemed necessary by ISONIKE or requested by the company, this can take place at your premises. This enables you to establish a rapport with your auditor and may help the incidence of non-compliances at the next stage. 

The Audit

A detailed, on-site audit of your company's implemented, documented system against the company's working practices and the appropriate ISO 27001 quality standard. 

Procedure

Findings of the audit are documented. If there are any areas of concern to the assessors, the following may be raised: Major non-compliances - which must be rectified before certification can be recommended by the Lead Assessor. Minor non-compliances - which do not affect the recommendation for approval but must be addressed prior to the issue of your certificate. At the close of the audit, the Lead Assessor will leave his recommendation with you. 

SURVEILLANCE

ISONIKE's certification is valid for a three-year period and monitored by a Registered Assessor at regular intervals. All visits to your company are by appointment, thereby ensuring availability of relevant personnel. At the end of three years your organisation will need to be re-assessed. Fees for this will be kept to a minimum and discussed with you in advance. Please note: All audits are performed on the basis of limited sampling. If discrepancies are not discovered, there is no guarantee that they do not exist. 

EXTENSION TO SCOPE OF CERTIFICATE

Amendments or extensions to the initial certified scope are possible. For example, to include additional offices or new areas of business. Audit for this 'extension' can often be carried out causing minimum disruption to your organization. A common practice is to allocate some extra time during a routine surveillance visit. 

LOGOS

Following certification your company can display the ISONIKE logo.