What is ISO 27001?

ISO 27001 is part of the ISO 27000 family, a group of international standards for Information Security Management Systems. It is the best-known standard in the family providing requirements for an information security management system (ISMS).

The standard has 10 short clauses and 114 controls that are designed to cover so much more than just IT. The clauses and controls are tested as part of an ongoing external assessment.

Management within an organisation is responsible for determining the scope of the ISMS for certification purposes; this can be limited to a single department, location or the whole organisation.

Just remember that having the certificate in one area of the organisation does not mean that any other areas of the organisation have an adequate approach to information security management.

ISMS provides an approach to managing sensitive company information so that it remains secure. It includes people, processes and IT systems by applying a risk management approach. It can help organisations of any size or sector keep vital information assets secure.

What to consider before embarking on your ISO 27001 journey?

Before you begin, you need to answer yes to all these simple questions if you are serious about gaining an ISO certification.

We won’t lie, it is a commitment that takes some time to implement and to keep up to date, but the benefits to your organisation are well worth the time it takes, and if you have buy-in from the whole organisation they can assist with the implementation.

What are the benefits of ISO 27001 to your organisation?

ISO 27001 integrates information security principles into your organisation as usual processes, giving you the confidence to meet clients growing data protection expectations and new business opportunities.

Once you have achieved your certification, your organisation will be able to claim that you:

Other benefits include having a solid foundation to comply with legislation in turn reducing the risk/likelihood of costly fines or financial loss, protecting/enhancing your brand reputation and assuring clients and regulators that you take cyber security risks seriously.

Our ISO 27001 journey

Here at Bob’s Business, we started our ISO 27001 journey back in 2015. Why? Well, we wanted to be seen by our clients as a security-conscious supplier, who cares about their client data and practices what they preach in our cyber security awareness courses, which are aligned to the standard and teach end users how to help your organisation become more cyber secure.

For us, as an organisation the ISMS has provided guidance on the policies and processes that we needed in place that have supported the growth of the organisation from four employees back in 2015 to nearly thirty now. It has enabled us to submit tenders for more contracts that previously we would not have been able to, as it demonstrates to potential clients our commitment to Information Security and Data Protection.

Having ISO 27001 in place made our GDPR journey less daunting as both of them aim to strengthen data security and mitigate the risk of data breaches. It has enabled us to quickly complete client questionnaires relating to GDPR and how we protect their data.

A key component of ISO 27001 is ensuring policies are rolled out to staff and that training/education around information security is provided. Our Learning Management System (LMS) allows for tracking, reporting and policy integration of cyber security training, policies and policy acceptance.

By having the LMS and the training in place, we are able to demonstrate to external auditors that we train all our staff in cyber security awareness and that the policies have been read and accepted.

Would Bob’s Business recommend ISO 27001?

Yes, most definitely, not only has it given clients and prospects assurances that we are a security-conscious organisation, but it has helped us grow the business while maintaining the integrity of information security.

As a growing SME, ISO 27001 enables us to be able to react quickly to internal and external issues. We have the ability to revoke privileges, close accounts and reallocate key information if we lose a member of staff. When or if a breach occurs we are able to notify those involved in a timely manner.

How can you achieve ISO 27001 compliance?

Our courses are designed to give end users within any organisation awareness of information security in a short, engaging, entertaining manner. We offer over 20 bite-sized courses, all designed to be completed in less than 15 minutes, this keeping employee time spent training at a minimum.

If you’d like to find out more about our courses, click here.