ISO 27001Information Security

ISO 27001 is an agreed set of international principles that embody ‘good information security management’. The focus of ISO 27001 standard is risk management, and as the name suggests, more particularly, your information security risks. The principles of ISO 27001 are applicable to anyone who has a requirement to manage information security. ISO 27001 requires you have a robust risk management framework. The central principle of this standard is that you identify what your information security risks are, and that you develop a plan to manage these. The Annex in ISO 27001 provides a suggested suite of controls. Most businesses use this as a basis to write a statement of applicability, The statement of applicability (often referred to as a SoA) is a detailed description of your risks and what controls you are implementing to control these.

When businesses are certified to ISO 27001, they can demonstrate structured processes for:

• Considering all stake holders in decisions about how information security is managed
• The management is actively involved in and supports the information security management system and its performance.
• Consistent processes for management of information security risk
• Organizational accountability for information security
• Reporting and responding to incidents and breaches
• Actively looking for ways to prevent information security incidents
• Regularly assessing/auditing information security controls to ensure compliance with process and the international standard, and
• A thorough understanding of legal and other requirements (and incorporation of these requirements into systems and processes).

HOW CAN WE HELP?