ISO 27001 is a standard which helps organizations manage information security. It was published by International Standardization Organization (ISO). The latest revised version is ISO 27001:2013. First version was published in 2005. This standard was developed on British Standards BS 7799-2.
Which type of organizations can get certified for ISO 27001?
ISO 27001 can be implemented in any kind of organization, profit or non-profit, private or state-owned, small or large. ISO 27001 establishes framework for the implementation of information security management in an organization. Organizations can also get certified for ISO 27001. The independent certification bodies perform the audit and upon compliance with the standard, it issues the certificate to organizations.
What are the benefits of ISO 27001?
- New client acquisition and retention of old clients
- Avoid losses and penalties for data breaches
- Comply with business, legal and regulatory requirements
- Protect and enhance organization’s reputation
- Provide competitive advantage
- Consistency in the delivery of service or product
- Builds a culture of securitySearch Marketing: SEO & PPC
How ISO 27001 standard is structured?
ISO 27001 is split into 11 sections, plus Annex A. Sections 0 to 3 are introductory (and are not mandatory for implementation), while sections 4 to 10 are mandatory – meaning that all their requirements must be implemented in an organization if it wants to be compliant with the standard. Controls from Annex A must be implemented only if declared as applicable in the Statement of Applicability.
How to implement ISO 27001?
Steps involved are:
- Get Sponsorship for the project
- Define the scope for ISO 27001
- Conduct ISO 27001 Awareness Training
- Establish top-level Information security policy
- Prepare the asset list
- Perform the risk assessment and risk treatment
- Write the Statement of Applicability
- Prepare Risk treatment plan
- Implement all applicable controls and procedures
- Conduct Internal Auditor Training
- Perform internal audit
- Perform management review
- Implement corrective actions
- Conduct Certification Audits
