0333 444 0881
ISO 27001 is the internationally recognised standard for information security management. It’s not just for IT security, the latest version of this standard takes a business risk approach to all information assets of the organisation and creates a framework for managing threats to those assets. Some organisations choose to implement the standard in order to benefit from the best practice it contains while others decide they also want to get certified to reassure customers and clients that its recommendations have been followed.
Our ISO27001 consultancy service can help you implement an Information Security Management System and achieve certification. We will work with you to build a management system that fits with your organisation. We start by documenting an InfoSec Risk Assessment that defines your Statement of Applicability (SoA). This forms the foundation of your ISMS and ensures your ISMS Policies & Processes are appropriate. We can then support in the development of your ISMS Policies and Processes ensuring that the business operates and delivers its Legal and Regulatory obligations, whilst maintaining coherence with the Quality Management System. We can also build on the good work you have already done to support your ISMS improvement projects.
ISO27001 Certification is a globally recognised indicator that your organisation has a mature & managed framework approach to information security with robust systems in place to protect customer data.
HM Government, G-Cloud, Public Sector, Financial & Corporate organisations are already insisting that suppliers can demonstrate ISO27001 compliance & full Certification is increasingly becoming a differentiator in commercial decision making. Certified companies instill greater customer confidence & are protecting their future revenue.
Ongoing compliance with the ISO27001 Standard ensures that employees are reminded of their security & risk responsibilities through policies, procedures & ongoing training; making security breaches via theft or human error less likely & injecting a greater collective responsibility for protecting corporate data into your business’ DNA.
The ISO/IEC 27001 Standard identifies & manages risk, reduces threats & installs an Information Security Management System (ISMS) to manage information security professionally across all systems & processes. Regulatory Compliance for your industry is included within the ISMS checks – efficiently managing compliance issues under the cover of ISO27001.
Risk Assessment & Risk Treatment : The ISO 27001 standard takes a risk management approach to information security and therefore requires the organisation to define a risk management strategy, and decide on an appropriate risk assessment methodology. We could help you align this to ISO 31000, the standard for risk management, or you could decide to adopt another proven risk assessment method. After assessing the threats to information assets, the standard provides 114 possible controls to apply, within Annex A.
Asset Management & Human Resources : Some of the controls in Annex A refers to the acceptable use of assets, classification of information and human resource processes such as screening and disciplinary policies. We can help you define your organisation’s approach to these controls based on your existing arrangements.
Supplier Relationships : Another section of Annex A focuses on the organisation’s relationships with it’s suppliers, in particular those that have access to the organisation’s information. We will help consider the risks associated with your suppliers and ensure suitable policies and procedures are in place to manage supply chain risks.
Legal & Regulatory Compliance : ISO 27001 also requires consideration of legal and other requirements placed on the organisation, and this becomes more relevant as Data Protection Laws are evolving across Europe, America and the world. Our legal compliance audit can help you identify the legislation that’s applicable to your organisation, and measure how effectively you are meeting those obligations.
Information Security Objectives & Continual Improvement : As with all management system standards, ISO 27001 looks for continual improvement of the system by setting measurable, achievable objectives which can be driven from the vulnerabilities identified in the risk assessment or more general business strategy.
After implementation of your ISO27001 ISMS, certification is achieved after the stage 2 visit and your certificate will be available a short time after the audit. For the stage 2 visit there needs to be at least three months of records to show that the management system has been successfully operating in the organisation. Certificates are valid for three years at which time a re-certification audit is required. During the three years, shorter surveillance audits are undertaken periodically to sample different areas of the management system. The certification body will plan all the visits for the three year cycle during the Stage 2 audit. So you will know which dates they are coming and roughly what areas they will be auditing. Cyber Smart Consulting can provide support through the whole process.
External ISO 27001 Certification : Having your Information Security management system certified by an external UKAS accredited assessment body publicly demonstrates your commitment to protecting your customers’ data and can give you a significant advantage when tendering for contracts. We can help you choose a certification body and guide you through the process.
We deliver security capability at all levels of an organisation and are on hand to help ensure that your projects deliver solutions
that are appropriately aligned to your cyber security risk position and satisfy your regulatory compliance requirements.
Learn more about how we can help you achieve your critical priorities: