{"id":7167,"date":"2021-01-20T12:33:23","date_gmt":"2021-01-20T12:33:23","guid":{"rendered":"https:\/\/outofsite.biz\/cynance\/?p=7167"},"modified":"2021-03-09T15:27:20","modified_gmt":"2021-03-09T15:27:20","slug":"youre-going-for-iso-27001-certification-now-what","status":"publish","type":"post","link":"https:\/\/outofsite.biz\/cynance\/youre-going-for-iso-27001-certification-now-what\/","title":{"rendered":"You\u2019re going for ISO 27001 certification. Now what?"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-post\" data-elementor-id=\"7167\" class=\"elementor elementor-7167\">\n\t\t\t\t\t\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-45e0897e elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"45e0897e\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-2a13f229\" data-id=\"2a13f229\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-264884f6 elementor-widget elementor-widget-text-editor\" data-id=\"264884f6\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<style>\/*! elementor - v3.11.5 - 14-03-2023 *\/\n.elementor-widget-text-editor.elementor-drop-cap-view-stacked .elementor-drop-cap{background-color:#818a91;color:#fff}.elementor-widget-text-editor.elementor-drop-cap-view-framed .elementor-drop-cap{color:#818a91;border:3px solid;background-color:transparent}.elementor-widget-text-editor:not(.elementor-drop-cap-view-default) .elementor-drop-cap{margin-top:8px}.elementor-widget-text-editor:not(.elementor-drop-cap-view-default) .elementor-drop-cap-letter{width:1em;height:1em}.elementor-widget-text-editor .elementor-drop-cap{float:left;text-align:center;line-height:1;font-size:50px}.elementor-widget-text-editor .elementor-drop-cap-letter{display:inline-block}<\/style>\t\t\t\t<p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">Information security is important to everyone. Many of your current and future clients may add ISO 27001 certification as a condition of doing business with you, putting you in a position where you need to start assessing your policies, processes, and procedures.<\/span><\/p><p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">While ISO 27001 alone won\u2019t guarantee you have effective information security practices in place (sad, but true), and it won\u2019t make a hacker think twice before targeting your organisation, getting the certification is a (small) step towards understanding just how secure your organisation is.<\/span><\/p><h2><span style=\"font-weight: 400;\">What is ISO 27001?<\/span><\/h2><p style=\"font-weight: 400;\"><a href=\"https:\/\/www.iso.org\/isoiec-27001-information-security.html\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">ISO 27001<\/span><\/a><span style=\"font-weight: 400;\"> is an international standard for information security management within organisations. ISO 27001 was published jointly by the International Organisation for Standardisation (ISO), and the International Electrotechnical Commission in 2005, and updated in 2013 and 2017.<\/span><\/p><p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">ISO 27001 sets out requirements for organisations to establish, implement, maintain and continually improve an information security management system (ISMS) based on their specific information security needs. ISO 27001 is a living framework which is improved and updated regularly based on experience, new information, and annual audit results.<\/span><\/p><p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">Any organisation who handles information, and is of all sizes, and operates in all sectors can get ISO 27001 certification.<\/span><\/p><h2><span style=\"font-weight: 400;\">The benefits of ISO 27001 certification<\/span><\/h2><p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">ISO 27001 is not compulsory for any organisation, but yet many organisations have their reasons for going for ISO 27001 certification.<\/span><\/p><h3><span style=\"font-weight: 400;\">Reduce information security and data protection risks<\/span><\/h3><p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">ISO 27001 certification provides a clear framework for information security management. The information security management system sets out your key risk areas including network security, endpoint security, security monitoring and events management, anti-malware controls, secure software development and testing on operational environments, information backup, and more, and supports your efforts to mitigate them.<\/span><\/p><h3><span style=\"font-weight: 400;\">Comply with regulatory requirements<\/span><\/h3><p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">While ISO 27001 does not fulfill all the requirements of the <\/span><a href=\"https:\/\/outofsite.biz\/cynance\/security-risk-and-compliance\/privacy-data-protection-gdpr\/\"><span style=\"font-weight: 400;\">GDPR<\/span><\/a><span style=\"font-weight: 400;\">, gaining ISO 27001 certification demonstrates that you adhere to the principles of information security and data protection. It may also help you avoid GDPR fines, which are usually accompanied by negative publicity, which in turn damage reputations, and lead to falling client bases and income.<\/span><\/p><h3><span style=\"font-weight: 400;\">Demonstrate your commitment to information security to clients and partners<\/span><\/h3><p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">In today\u2019s world with constant information security breaches, customers, clients, and partners need constant reassurance that you take information security seriously and are doing everything you can to protect their data. ISO 27001 is recognised worldwide as a sign of commitment to information security best practices.<\/span><\/p><p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">Some of your clients may require ISO 27001 certification because they themselves are subject to regulations. If you don\u2019t have it, they will not do business with you, and you will miss out.<\/span><\/p><h3><span style=\"font-weight: 400;\">Obtain external validation of your security posture<\/span><\/h3><p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">ISO 27001 certification is validated by external audits of your information security management system. Certification is only awarded when the external auditors are satisfied that your ISMS provides adequate data protection.<\/span><\/p><h2><span style=\"font-weight: 400;\">ISO 27001 culture<\/span><\/h2><p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">Responsibility for information security often falls on your IT and R&amp;D teams (or even just one person in those teams). ISO 27001 states that information security and data protection is the responsibility of everyone across the entire organisation.<\/span><\/p><p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">ISO 27001 is a living, breathing certification. You will need to constantly update documents, train new and long-term staff, and ensure that your cybersecurity practices are up to date. There is no right way to stay on top of these requirements, with some companies preferring to keep it all in house, while others use the services of external advisors for ISO 27001 certification and compliance.<\/span><\/p><h2><span style=\"font-weight: 400;\">What needs to be done to achieve ISO 27001 certification?<\/span><\/h2><p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">ISO 27001 certification requires a clear project plan with clear roles and tasks for stakeholders across the organisation.<\/span><\/p><p style=\"font-weight: 400;\"><b>Prepare for the ISO 27001<\/b><\/p><p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">Before you start the ISO 27001 certification process, make sure you understand what ISO 27001 is and what the requirements are. Next, create a project team of stakeholders from across the entire organisation, a project plan, and project risk register.<\/span><\/p><p style=\"font-weight: 400;\"><b>ISO 27001 gap analysis<\/b><\/p><p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">Identify how your current information security measures perform against the ISO 27001 standard, what areas need improvement, and where controls are missing and need to be implemented.\u00a0<\/span><\/p><p style=\"font-weight: 400;\"><b>Create the ISMS<\/b><\/p><p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">The information security management system sets out your organisation\u2019s approach to information security, including all the policies and procedures you have in place. Everyone in your organisation must have access to it to understand their information security roles.<\/span><\/p><p style=\"font-weight: 400;\"><b>Develop the documentation for ISO 27001<\/b><\/p><p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">ISO 27001 requires you to have information security policies, procedures, and controls in place. The list of controls is summarised below.<\/span><\/p><p style=\"font-weight: 400;\"><b>Assess, review, and audit your information security<\/b><\/p><p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">ISO 27001 requires you to regularly review, test, and audit your information security in order to ensure that your controls are working correctly, and to test the robustness of incident response plans.<\/span><\/p><h3><span style=\"font-weight: 400;\">ISO 27001 requirements and controls<\/span><\/h3><p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">In order to achieve ISO 27001 certification, your organisation\u2019s information security must meet the requirements set out in <\/span><a href=\"https:\/\/www.isms.online\/iso-27001\/requirements-controls\/\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">clauses 4.1 to 10.2 of the standard<\/span><\/a><span style=\"font-weight: 400;\">. There are 22 requirements in ISO 27001 including:<\/span><\/p><ul style=\"font-weight: 400;\"><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">The creation of an information management system (<\/span><a href=\"https:\/\/www.isms.online\/iso-27001\/information-security-management-system\/\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">clause 4.4<\/span><\/a><span style=\"font-weight: 400;\">)<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Demonstration of leadership and commitment to ISO 27001 (<\/span><a href=\"https:\/\/www.isms.online\/iso-27001\/leadership-commitment\/\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">clause 5.1<\/span><\/a><span style=\"font-weight: 400;\">)<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">The establishment of an information security policy (<\/span><a href=\"https:\/\/www.isms.online\/iso-27001\/information-security-policy\/\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">clause 5.2<\/span><\/a><span style=\"font-weight: 400;\">)<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Statement of the actions to address information security risks and opportunities (<\/span><a href=\"https:\/\/www.isms.online\/iso-27001\/actions-to-address-risks-opportunities\/\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">clause 6.1<\/span><\/a><span style=\"font-weight: 400;\">)<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Operational planning and control to address information security risks and opportunities (<\/span><a href=\"https:\/\/www.isms.online\/iso-27001\/operational-planning-control\/\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">clause 8.1<\/span><\/a><span style=\"font-weight: 400;\">)<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Evidence of a clear internal audit plan for information security (<\/span><a href=\"https:\/\/www.isms.online\/iso-27001\/9-2-internal-audit\/\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">clause 9.2<\/span><\/a><span style=\"font-weight: 400;\">)<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Commitment to, and existing evidence of continual improvement for ISO 27001 (<\/span><a href=\"https:\/\/www.isms.online\/iso-27001\/10-2-continual-improvement\/\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">clause 10.2<\/span><\/a><span style=\"font-weight: 400;\">)<\/span><\/li><\/ul><p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">Some requirements overlap, but as a whole, ISO 27001 requires your organisation to take a full and robust approach to information security.<\/span><\/p><p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">In addition to the ISO 27001 requirements, Annex A (<\/span><a href=\"https:\/\/www.isms.online\/iso-27001\/requirements-controls\/\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">A.5 to A.18<\/span><\/a><span style=\"font-weight: 400;\">) sets out the controls you may wish to create as a result of your information security risk assessment and the actions you need to carry out to mitigate those risks.<\/span><\/p><p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">ISO 27001 audit controls include information security policies, asset management, access control, operations security, information security incident management procedures, compliance, and more.<\/span><\/p><h2><span style=\"font-weight: 400;\">How long does ISO 27001 certification take?<\/span><\/h2><p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">ISO 27001 certification usually takes between three and six months but it can take up to a year. The time taken depends on the size of the organisation, and the information security policies and procedures already in place before starting the ISO 27001 certification process, and most importantly, the commitment of your management and internal teams.<\/span><\/p><p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">ISO 27001 certification lasts for one year. Since the ISMS is designed to be a living document, it must be updated and maintained, and your ISO 27001 accreditation body may audit you every year.<\/span><\/p><h2><span style=\"font-weight: 400;\">Choose your ISO 27001 certification partner and get started<\/span><\/h2><p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">ISO 27001 certification requires extensive work and considerable expertise to achieve and maintain. While the task may appear daunting, both the process of gaining ISO 27001 certification, and the accreditation itself will have major benefits for your organisation that go far beyond information security.<\/span><\/p><p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">But don\u2019t think you are alone in the process. A <\/span><a href=\"https:\/\/outofsite.biz\/cynance\/security-risk-and-compliance\/cybersecurity-risk-management\/\"><span style=\"font-weight: 400;\">dedicated information security company<\/span><\/a><span style=\"font-weight: 400;\"> can guide you through every stage of the journey from gap analysis and risk assessments to the creation of the ISMS and other relevant documentation, policies, and procedures.<\/span><\/p><p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">Good luck on your journey to demonstrating your dedication to information security with ISO 27001 certification.<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>Information security is important to everyone. Many of your current and future clients may add ISO 27001 certification as a condition of doing business with you, putting you in a position where you need to start assessing your policies, processes, and procedures. While ISO 27001 alone won\u2019t guarantee you have effective information security practices in&hellip;<\/p>\n","protected":false},"author":10,"featured_media":7172,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[18],"tags":[63,62],"_links":{"self":[{"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/posts\/7167"}],"collection":[{"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/comments?post=7167"}],"version-history":[{"count":0,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/posts\/7167\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/media\/7172"}],"wp:attachment":[{"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/media?parent=7167"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/categories?post=7167"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/tags?post=7167"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}