The ISO 27001:2013 standard adopts a process approach for establishing, implementing, operating, monitoring, reviewing, maintaining, and improving an organization’s information security management system. ISO 27001 was established by the International Organization for Standardization (ISO). It was first launched in 2005, as a replacement of BS 7799.
Protecting your assets
The standard takes a comprehensive approach to information security. Assets that need protection range from digital information, paper documents, and physical assets (computers and networks) to the knowledge of individual employees. Issues you have to address range from competence development of staff to technical protection against computer fraud.
ISO 27001 will help you protect your information in terms of the following principles:
- Confidentiality ensures that information is accessible only to those authorized to have access.
- Integrity safeguards the accuracy and completeness of information and processing methods.
- Availability ensures that authorized users have access to information and associated assets when required.
ISO/IEC 27001 requires that management:
- Systematically examine the organization’s information security risks, taking account of the threats, vulnerabilities, and impacts;
- Design and implement a coherent and comprehensive suite of information security controls and/or other forms of risk treatment (such as risk avoidance or risk transfer) to address those risks that are deemed unacceptable; and
- Adopt an overarching management process to ensure that the information security controls continue to meet the organization’s information security needs on an ongoing basis.
ISO/IEC 27001:2013 is intended to be suitable for several different types of use, including the following:
- Use within organizations to formulate security requirements and objectives;
- use within organizations as a way to ensure that security risks are cost effectively managed;
- use within organizations to ensure compliance with laws and regulations;
- use within an organization as a process framework for the implementation and management of controls to ensure that the specific security objectives of an organization are met;
- definition of new information security management processes;
- identification and clarification of existing information security management processes;
- use by the management of organizations to determine the status of information security management activities;
- use by the internal and external auditors of organizations to determine the degree of compliance with the policies, directives, and standards adopted by an organization;
- use by organizations to provide relevant information about information security policies, directives, standards and procedures to trading partners and other organizations with whom they interact for operational or commercial reasons;
- implementation of business-enabling information security;
- use by organizations to provide relevant information about information security to customers.
Benefits of ISO 27001:2013
The benefits of standardization, and of implementation of one or more of the ISO 27000 series are wide and varied. Although they tend to differ from organization to organization, many are common.
The following is a list of potential benefits. As with many items on this website, this is an ongoing project. Please feel free to add further points via the comments option below.
-
Interoperability
This is a general benefit of standardization. The idea is that systems from diverse parties are more likely to fit together if they follow a common guideline.
-
Assurance
Management can be assured of the quality of a system, business unit, or other entity if a recognized framework or approach is followed.
-
Due Diligence
Compliance with, or certification against, and international standard is often used by management to demonstrate due diligence.
-
Bench Marking
Organizations often use a standard as a measure of their status within their peer community. It can be used as a benchmark for current position and progress.
-
Awareness
Implementation of a standard such as ISO 27001 can often result in greater security awareness within an organization.
-
Alignment
Because implementation of ISO 27001 (and the other ISO 27000 standards) tends to involve both business management and technical staff, greater IT and Business alignment often result.
-
Compliance
It might seem odd to list this as the first benefit, but it often shows the quickest “return on investment” – if an organization must comply to various regulations regarding data protection, privacy and IT governance (particularly if it is a financial, health or government organization), then ISO 27001 can bring in the methodology which enables to do it in the most efficient way.
-
Marketing edge
In a market which is more and more competitive, it is sometimes very difficult to find something that will differentiate you in the eyes of your customers. ISO 27001 could be indeed a unique selling point, especially if you handle clients’ sensitive information.
-
Lowering the expenses
Information security is usually considered as a cost with no obvious financial gain. However, there is a financial gain if you lower your expenses caused by incidents. You probably do have an interruption in service, or occasional data leakage, or disgruntled employees. Or disgruntled former employees.
The truth is, there is still no methodology and/or technology to calculate how much money you could save if you prevented such incidents. But it always sounds good if you bring such cases to management’s attention.
-
Putting your business in order
This one is probably the most underrated – if you are a company which has been growing sharply for the last few years, you might experience problems like – who has to decide what, who is responsible for certain information assets, who has to authorize access to information systems, etc.
How to achieve ISO 27001 certification – ISO 27001 implementation / Certification steps
what I offer is a well defined and globally proven implementation methodology for ISO 27001-2013 certification.
- Gap Analysis
- Awareness Training
- Risk analysis
- Documentation Design and finalization
- Implementation
- Internal Auditor Training and conduct of the internal audit
- Management Review Meeting
- Review of Implementation
- Pre-assessment audit
- Stage 1 – certification audit
- Stage 2 – certification audit
- Award of ISO 27001 certification
- Continual improvement of the system through value-added consulting and training services
Domains of ISO/IEC – 27001
- Security policy
- Organization of information security
- Asset management
- Human resources security
- Physical and environmental security
- Communications and operations management
- Access control
- Information systems acquisition, development, and maintenance
- Information security incident management
- Business continuity management
- Compliance
What I offer in the field of ISO 27001 standard implementation and certification
I can provide unmatched expertise and technical competence to ensure that your ISO 27001 ISMS certification project adds value to your organization.
I provide consulting, training, internal audits, pre-assessment audits and facilitation during ISO 27001 certification audit.
I can offer the global knowledge moulded locally to bring in the best results for the clients and partner their journey of standardization, compliance, growth, success and continual improvements.
Contact now, to get your organization ISO 27001 certified in the most effective and efficient manner while realizing the true benefits of the certification using our specialized ISMS implementation methodology that is less time consuming, fast, easy to understand and implement, result-oriented, time-bound and cost-effective. Get ISO 27001 certified now …
Mail us at: