|
ISO 27001 - Are your information assets secure? We’ve all heard the story about a trusted financial institution reporting an unauthorised release of personal information, or perhaps the rumour that a government department has lost a critical back-up tape? In terms of your business, how much protection do you have? How much is enough? What level of information security do we owe our customers, staff, stakeholders and regulators? There is a simple answer: ISO 27001 Information Security Management Systems.
ISO 27001 has been available for a number of years, initially as AS/NZS 4444 and then subsequently as AS/NZS 7799. In 2005 it was released as an internationally recognised standard. In Australia, it was adopted as an Australian Standard AS/NZS ISO 27001:2006. ISO 27001 is recognised around the world. Over 6000 certificates have been issued globally and this is increasing rapidly as the value of certified systems are implemented.
ISO 27001 is suited to any organisation that manages assets - data, people, software and intellectual property. This includes government departments (or their critical suppliers such as mailing houses, or data warehouses), energy providers and utilities, banks, insurance companies and corporates across all sectors of the economy.
If TRUST, REPUTATION and BRAND are an integral part of your business then it is essential to consider the management of the information with which you are entrusted. Increasingly you must take responsibility for your processes, even when these are outsourced.
ISO 27001 is a practical, internationally recognised benchmark that relies on assessing and managing risk to manage information and asset security. The system, as with all systems should be implemented to reflect the needs of your organisation and consider the current processes, size and structure. The identification and rating of threats and vulnerabilities (including logistics, servers, network management and third parties such as contractors, internet service providers and HR), are a key underlying requirement of the standard. ISO 27001 should be viewed in combination with ISO 17799 which lists 11 control objectives and over 100 specific controls that an organisation should consider. These control objectives include: 1. Security Policy The ISO 27001 standard is aligned with ISO 9001:2000 and ISO 14001:2004, supporting easy integration with existing management systems.
5.1 Step One: Scoping Workshop A Scoping Workshop is an option favoured by organisations that have identified a business requirement such as ISO 27001 and are aware that implementation within the organisation will be significant in structural or investment terms. It allows you to gain a feel for the implications, possible outcomes and benefits, and importantly, consolidate senior management understanding and commitment. During the working session NCS International facilitators will: 5.1.1 Workshop Outcomes: 5.2 Step Two: Gap Analysis A Gap Analysis approach often proves an invaluable tool in determining system implementation maturity and audit readiness. The methodology applied by NCS International includes a review of your current system, and identification of specific gaps against the Standard. Importantly, prior to undertaking a Gap Analysis, our audit team will contact your identified management representatives to familiarise themselves with organisational priorities, objectives and expectations so that the Gap Analysis proves beneficial and aligns with an organisations’ goals for the roll-out of the system. 5.3 Step Three: ISMS Implementation Before you implement the ISO 27001 Information Security Management System, NCS International will work with you to develop a capability statement describing the scope of your ISMS. This is fundamentally at your discretion however consideration should be given to starting small and specific and expanding the scope of the certification as your system matures. Once prepared, your organisation will then have the framework and the key information to implement its ISO 27001 Information Security Management System. Implementation is the responsibility of the organisation, though suggestions may be offered to assist your understanding of the requirements of the standard and its applicability and alignment with your organisational. 5.4 Step four: NCSI Certification External recognition of your achievement, including an independent and objective assessment of the management system against the requirements of the standard, is a vital ingredient in demonstrating to your internal and external stakeholders that there is a robust management system in place. The certification team will include experts that are aligned to your business requirements. Certification Audits are undertaken in a three year cycle including an initial certification audit and subsequent periodic audits to verify that the integrity and effective operation of the system is maintained.
Organisations can no longer rely only on their IT department to ensure that information security is managed effectively. IT systems are just one business tool which help to deliver an outcome. Taking ownership of this issue by reviewing your information security status is the first step to implementing a strong system to ensure that your Board, Senior Management, staff, customers and stakeholders can be confident that the risks you have are managed professionally and appropriately. Think it can't happen to your system? Think again! |