Streamline your ISO 27001 certification

ISO 27001: The Nitty Gritty

ISO 27001 is one of many standards published by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) shares ownership of the ISO 27000 family of standards.

What is an ISMS?

An Information Security Management System (ISMS) is a management framework of policies and procedures to keep confidential and sensitive information secure. It establishes a systematic approach to security through technologies, policies, procedures, systems, and processes. This approach is designed to manage information risks such as data leaks, cyberattacks, hacks, insider threats, or theft. An ISMS enables organizations to secure information in all its forms and increase their resilience to attacks.

An effective ISMS also helps businesses respond to evolving security threats to the confidentiality, integrity, and availability of the data it handles. Businesses can improve cybersecurity culture through ISMS’s integrated approach that covers people, processes, and technology. ISMS enables employees and partners to readily understand risks and embrace security controls in their working practices.

The ISMS' focus on information security risk management and continuous improvement makes it the most widely recognized IT Security certification internationally.

Becoming and Staying ISO 27001 Certified

Organizations that have adopted the ISO 27001 framework may choose to become certified or simply maintain their ISMS in a compliant state.

For companies that desire the certification or that are in industries where the certification is required, achieving certification should not be treated as a one-off initiative.

Attaining and maintaining the certification requires organizations to treat information security as a critical business process and to invest resources, effort, and time into ISO 27001 compliance on a year-round basis.

Companies can maximize their ISO 27001 certification journey by investing in training programs for employees that can develop and maintain the company’s ISMS internally. Employees can also become certified as an ISO 27001 Lead Implementer to help their organizations document and implement information security-related requirements for the certification.

ISO 27001 certification is conducted by an independent third-party assessor. A successful certification audit results in an ISMS certified against ISO 27001.

Organizations stay ISO 27001 certified by ensuring their ISMSs meet all procedures and ISO 27001 Controls in the standard. Apart from operating and updating the ISMS, businesses should update documentation and policies to accommodate new products and requirements. Organizations should also conduct periodic risk assessment reviews as risks and threats evolve. ISO 27001 certification is valid for three years, after which a company needs a surveillance audit and recertification.

Apart from documentation, ISO 27001 requires organizations to perform internal audit management reviews and take corrective actions on nonconformities.

The cost of an ISO 27001 certification depends on various factors like training, technologies to be implemented and updated, external expertise, and the certification audit.

The Framework: ISO 27001 Annex A Controls

There are 114 ISO 27001 Annex A controls divided into 14 categories:

• Annex A.5 – Information security policies (2 controls): These describe how to handle information security policies.
• Annex A.6 – Organization of information security (7 controls): These provide a framework for information security by defining the internal organization and other information security aspects.
• Annex A.7 – Human resource security (6 controls): These outline the information security aspects of HR.
• Annex A.8 – Asset management (6 controls): These ensure information security assets are identified and responsibilities for their security are designated.
• Annex A.9 – Access control (14 controls): These limit access to information assets based on real business needs.
• Annex A.10 – Cryptography (2 controls): These provide the basis for proper use of encryption solutions to protect the authenticity, confidentiality, and integrity of information.
• Annex A.11 – Physical and environmental security (15 controls): These prevent unauthorized access to physical areas, equipment, and facilities from human or natural intervention.
• Annex A.12 – Operations security (14 controls): These ensure the organization’s IT systems are secure and protected against data loss.
• Annex A.13 – Communications security (7 controls): These protect the network (infrastructure and services) and the information that travels through it.
• Annex A.14 – Systems acquisition, development, and maintenance (13 controls): These ensure that information security is prioritized when purchasing new information systems or upgrading existing ones.
• Annex A.15 – Supplier relationships (5 controls): These ensure that activities outsourced  to suppliers/partners use the appropriate Information Security controls and describe how to monitor third-party security performance.
• Annex A.16 – Information security incident management (7 controls): These provide a framework to ensure the proper management and communication of security incidents.
• Annex A.17 – Information security aspects of business continuity management (4 controls): These ensure the continuity of information security management during disruptions as well as information system availability.
• Annex A.18 - Compliance (8 controls): These provide a framework to prevent legal, regulatory, statutory, and contractual breaches and audit whether your implemented information security meets the requirements of the ISO 27001 standard.