ISO27001 Cyber Security Systems

The purpose of ISO27001 is the preservation of:

• Confidentiality = only the authorized persons can access the information
• Integrity = only the authorized persons or systems can change the information
• Availability = the information is available when needed

So information security is not only about confidentiality, it is also about preserving the integrity and availability of information.

Your company has laptops, servers, a complex network, lots of sensitive information in databases and on paper, clients. contractors and much, much more.

Protecting the information on a single laptop presents a challenge in itself; managing the security of all of the information assets in an organization is clearly several order of magnitudes more challenging. To meet that challenge you need a system, and ISO27001 defines the Information Security Management System (or ISMS).

So, what is it that you need to do to set your ISMS? First you need to find out what can go wrong with your information – that is, how can the confidentiality, integrity and availability of each and every piece of information in your company be endangered – this is done through a process called risk assessment; once you know where the risks are, you need to select appropriate controls (or safeguards) for each risk you find unacceptable.

OK let’s debunk some ISO27001 myths!

“This is an IT job”

This is not how to view the process because security is everyone’s job – for example everyone needs to protect his or her laptop

“It’s all about writing policies and procedures”

No – the point is not in writing documents, but in applying them in practice – e.g., if the procedure says that backup needs to be done daily even for laptops, then this is something that everyone needs to do.

“We’ll get lost in all those documents”

You won’t because we will write only the documents that are really needed – we will try to keep the number of documents to a minimum. You will also have the final say over the documents before they are published.

“ISO27001 will only make our job more difficult”

This standard may require some new things from you, but it will help you with other things. For example, implementation of ISO27001 will decrease the number of IT incidents, meaning that employees in the IT department won’t have to lose time on resolving those incidents. Furthermore, it will decrease the chance of someone abusing your account and performing fraud (for which you could be held accountable).

“It will be implemented in 2 months”

Implementation of ISO27001 requires changes in behaviour, and we cannot make several changes at the same time (imagine if we published 20 new policies and procedures in a single day). This is why documentation should be introduced gradually.

“We do it only because of the certification”

Certification is one of the goals, but not the only one. Cultural change and embedding a culture of IT security within the organisation is the ultimate goal.

The benefits of information security, especially the implementation of ISO27001 are numerous. The following four are the most important:

1. Compliance
It might seem odd to list this as the first benefit, but it often shows the quickest “return on investment” – if an organization must comply to various regulations regarding data protection, privacy and IT governance (particularly if it is a financial, health or government organization), then ISO27001 can bring in the methodology which enables to do it in the most efficient way.

2. Marketing edge
In a market which is more and more competitive, it is sometimes very difficult to find something that will differentiate you in the eyes of your customers. ISO27001 could be indeed a unique selling point, especially if you handle clients’ sensitive information.

3. Lowering the expenses
Information security is usually considered as a cost with no obvious financial gain. However, there is financial gain if you lower your expenses caused by incidents. You probably do have interruption in service, or occasional data leakage, or disgruntled employees. Or disgruntled former employees.

The truth is, there is still no methodology and/or technology to calculate how much money you could save if you prevented such incidents. But it always sounds good if you bring such cases to management’s attention.

4. Putting your business in order
This one is probably the most underrated – if you are a company which has been growing sharply for the last few years, you might experience problems like – who has to decide what, who is responsible for certain information assets, who has to authorize access to information systems etc.

ISO27001 is particularly good in sorting these things out – it will force you to define very precisely both the responsibilities and duties, and therefore strengthen your internal organization.

Your role in the implementation

• Suggest which processes to document
• Suggest changes in existing & new policies and procedures
• Read all the new documents and attend awareness & training sessions
• Comply with policies and procedures once they are published