{"id":1403,"date":"2021-03-05T07:14:15","date_gmt":"2021-03-05T07:14:15","guid":{"rendered":"http:\/\/people.utm.my\/azhari\/?p=1403"},"modified":"2021-03-05T07:14:25","modified_gmt":"2021-03-05T07:14:25","slug":"iso-27001-certification-provides-your-organisation-with-multiple-benefits","status":"publish","type":"post","link":"https:\/\/people.utm.my\/azhari\/2021\/03\/05\/iso-27001-certification-provides-your-organisation-with-multiple-benefits\/","title":{"rendered":"ISO 27001 CERTIFICATION PROVIDES YOUR ORGANISATION WITH MULTIPLE BENEFITS:"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Implementing an ISMS according to the ISO27001 standard improves your information security and makes it less likely that you will suffer a breach or other type of unwanted cyber incident. Secondly, becoming certified proves to interested parties, such as customers, employees, shareholders and suppliers that the organization is committed to keeping their data secure; this can be a significant marketing advantage where trust and risk is an issue.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Although it\u2019s often perceived to be a technical, IT-centred standard, ISO27001 actually covers the whole organization and is concerned with the protection of information in all its forms. It\u2019s not just for software companies and cloud service providers, many organizations, both small and large, within different industries comply to ISO27001, especially as they implement more online processes.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">What is an Information Security Management System?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">An ISMS is a set of processes that together help an organization to manage their information security by assessing their risks and taking action to reduce them. The management system is simply a set of things you must do to keep on top of your information security, and the main components are:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Information security policy \u2013 what are your rules on keeping things secure?<\/li><li>Objectives \u2013 what are you trying to achieve?<\/li><li>Risk assessment and treatment \u2013 what could go wrong and how can you stop it?<\/li><li>Roles and responsibilities \u2013 who does what in your ISMS?<\/li><li>Competence \u2013 does everyone have the skills they need?<\/li><li>Awareness training \u2013 does everyone know about information security?<\/li><li>Monitoring and measuring \u2013 quantifying what\u2019s going on.<\/li><li>Internal audit \u2013 independent checks that it\u2019s all happening as it should.<\/li><li>Management review \u2013 keeping everything under control.<\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Add in some written procedures, evidenced communication and continual improvement, and you have a viable and compliant ISMS.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">The contents of the ISO27001 standard<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The ISO27001 standard can be considered to consist of two main parts:<\/p>\n\n\n\n<ol class=\"wp-block-list\"><li>An information security management system, or ISMS<\/li><li>A set of controls used to reduce your risk<\/li><\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">Although the initial emphasis is often on the controls (such as anti-virus, vulnerability scanning and access control), the management system part of the standard is just as important and, in many cases, can pose more problems when implementing the ISO27001 standard.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">ISO has deliberately made the wording of the management system the same in ISO27001 as in other standards, such as ISO9001 and ISO14001, so it\u2019s easier to become certified to more than one standard (this layout is often referred to by the rather confusing name \u201cAnnex SL\u201d).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The other part of ISO27001 involves the 114 reference controls contained in Annex A. This is a set of good-practice ideas that you can use to make your organization more secure, and they\u2019re organised into 14 areas such as information security policies, human resource security, access control and incident management, to name but a few.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Some of these controls may not be relevant to you, in which case you can say so, in a required document called the Statement of Applicability. But in most cases the number of inapplicable controls is few, and there\u2019s no alternative but to work your way through implementing them as best you can.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">How to become certified<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">It is important to note, there\u2019s no obligation to go for certification to ISO27001 and many organizations choose to simply use the standard as a set of good-practice principles to guide them along the way to running their business in a more secure way. However, many become certified to prove their compliance internally and externally.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">When you have your ISMS in place, and you\u2019re well under way with the Annex A controls, it\u2019s time to book a stage one review with a Registered Certification Body (RCB), also known as an external auditor. This is simply a company that is accredited to carry out audits to the ISO27001 standard and issue certificates.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Stage one is basically a review of how ready you are for the main event, the stage two certification audit. You may pick up a few pointers for improvement (known as nonconformities) at Stage Two but, if these aren\u2019t too serious, your organization effectively becomes certified and can advertise the fact to anyone with an interest.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">But don\u2019t forget the auditor will be coming back every year from now on to reissue certification, so it\u2019s important to keep things running smoothly and continuously improving.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Implementing an ISMS according to the ISO27001 standard improves your information security and makes it less likely that you will suffer a breach or other type of unwanted cyber incident. Secondly, becoming certified proves to interested parties, such as customers, employees, shareholders and suppliers that the organization is committed to keeping their data secure; this [&hellip;]<\/p>\n","protected":false},"author":14428,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_et_pb_use_builder":"off","_et_pb_old_content":"","_et_gb_content_width":"","footnotes":""},"categories":[10,3],"tags":[],"class_list":["post-1403","post","type-post","status-publish","format-standard","hentry","category-gallery","category-news"],"_links":{"self":[{"href":"https:\/\/people.utm.my\/azhari\/wp-json\/wp\/v2\/posts\/1403","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/people.utm.my\/azhari\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/people.utm.my\/azhari\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/people.utm.my\/azhari\/wp-json\/wp\/v2\/users\/14428"}],"replies":[{"embeddable":true,"href":"https:\/\/people.utm.my\/azhari\/wp-json\/wp\/v2\/comments?post=1403"}],"version-history":[{"count":1,"href":"https:\/\/people.utm.my\/azhari\/wp-json\/wp\/v2\/posts\/1403\/revisions"}],"predecessor-version":[{"id":1404,"href":"https:\/\/people.utm.my\/azhari\/wp-json\/wp\/v2\/posts\/1403\/revisions\/1404"}],"wp:attachment":[{"href":"https:\/\/people.utm.my\/azhari\/wp-json\/wp\/v2\/media?parent=1403"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/people.utm.my\/azhari\/wp-json\/wp\/v2\/categories?post=1403"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/people.utm.my\/azhari\/wp-json\/wp\/v2\/tags?post=1403"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}