ISO 27001: A Mini-Guide for Connected Business Owners

What is ISO 27001? If you’re like most business owners, you have no clue. But, you should. Here’s what it means and why you should care.

What Is It?

ISO 27001 is a specification for information security. Specifically, it refers to “specification for an information security management system” or ISMS.

An ISMS is a framework of policies that includes legal, technical, and physical controls that are part of an organisation’s IT risk management process.

Using specialty penetration testing tools and other tests, like those offered at www.sec-tec.co.uk, help companies comply with these standards and meet security objectives that are required either by contract or by law.

According to ISO 27001 documentation, it was developed to “provide a model for establishing, implementing, operating, monitoring, reviewing, maintaining and improving an information security management system.”

To achieve this end, it uses top-down processes that are risk-based and technology neutral.

Companies are required to define a security process, define the scope of the process, conduct a risk assessment, manage those risks, select control objectives, and prepare a statement of applicability.

What Are The Main Functions Of ISO 27001?

There are 12 main sections in ISO 27001:

• Risk assessment
• Security policy
• Organisation of information security
• Asset management
• Human resources security
• Physical and environmental security
• Communications and operations management
• Access control
• Information systems acquisition, development and maintenance
• Information security incident management
• Business continuity management
• Compliance

Your company is required to apply these controls in line with the ISO standard and with your specific risks in mind.

Normally, a specialist would be trained to work within your organisation and help your company meet these requirements. If you do not know how to apply them, or how to carry out the recommendations, you will need additional training and help, typically from a third-party.

Why You Should Care

There are lots of reasons why you should care about the ISO standard. First of all, you can better manage risks with the new 27001 standard. It provides a methodology for identifying threats and managing information security risks.

There are enhanced safety and security protocols that you can use today to tighten up your company’s security.

There is supply chain assurance. The certification is a frequent requirement for many suppliers. And, compliance helps satisfy certain contractual obligations while eliminating the extra cost associated with meeting specific requirements for each and every client or vendor.

Because the standard is universal, there’s an inherent value attached to any company achieving certification. This could mean new business for your company. Any company that has sensitive information is going to suffer a significant blow to their reputation if security is breached. That’s not including the financial damage from being sued for losses.

ISO 27001 helps protect organisations from destructive cyber attacks, and enhances onsite security, which reduces its liability.

Finally, there’s a matter of regulatory compliance. Many businesses are subject to HIPAA (U.S.), and other, standards which they must comply with. Implementing ISO 27001 helps meet those requirements, including the Data Protection Act and the gambling Commission’s Remote gambling and software technical standards (UK).

Jamie Parkes works as an IT security officer. He enjoys writing about his experiences in IT security. Look for his posts mainly on business blog sites.