ISO 27001 certification

This certificate acts as a business differentiator, separating you from the sea of competition. Acquiring the certification showcases an organisation’s commitment to continuous improvement, modification and protection of all sensitive data and other information assets.

Regular risk assessments, robust controls, and supporting policies implement this continual improvement cycle. This article will explore what it means to be ISO 27001 certified, the involved benefits and the associated steps. Let us dive in.

If we use simple words to explain, an ISO 27001 certification is similar to an advertisement, where you are telling the world about your trusted Information Security Management System (ISMS).

By acquiring the certificate, you demonstrate your compliance with clause 4.4 of the standard and that you have performed satisfactorily well in an external audit by an independent ISO certification body.

As we have mentioned above, this certification often acts as a business differentiator, helping to separate you from other businesses. Nowadays, information security is vital; unfortunately, many businesses need to be laxer about managing their valuable information.

Being ISO 27001 certified is essentially a statement to the world that your organisation can be trusted with the most valuable information assets or data, as you have a separate system to manage, mitigate or avoid all risks related to your intellectual property. As a result, this fosters an environment of trust, ushering in new opportunities and wealth.

 ISO 27001 standard is internationally recognised for implementing the best practices for information security. In the United Kingdom, it is acknowledged as the most valuable recognition an organisation can achieve. Similarly, more than one million organisations worldwide are certified, emphasising the authority that this certificate entails.

What makes this certificate so loved across the globe is that it does not just focus on technical measures. The security management standard ensures that business controls and management processes have been put in place that is adequate and proportionate to the information security threats an organisation encounters.

Additionally, here, the risk is treated as a hostile entity and an opportunity for growth. The information security management standard allows organisations to identify and evaluate hidden opportunities in their risk assessment, helping them dominate new areas and get closer to their organisational aspirations.

ISO 27001 certification versus compliance

Organisations that are new to ISO standards and information security management systems often need clarification about the difference between certification and compliance. In simple terms, compliance implies that an organisation has followed the recommendations outlined in the ISO 27001 standard to build an ISMS.

However, they have yet to undergo an external audit to verify their efficiency. ISO 27001 certification, on the other hand, means that the organisation’s ISO 27001-compliant ISMS has been certified after undergoing a gruelling external audit by impartial and unbiased external auditors from an accredited certification body.

Why do you need ISO 27001 certification?

Any organisation that wishes to understand the need to formalise and modify business processes around information security and privacy so that its information assets are appropriately secured would need to apply for ISO 27001 certification.

Here, it is essential to mention that the turnover or the size of your business does not dictate your need for getting ISO 27001 certified. Even the smallest business can benefit immensely from implementing a compliant ISMS so that the information of stakeholders and influential customers can be adequately protected. Moreover, investors view the certificate as an intrinsic assurance.

As a direct consequence of the ISO 27001 certification, your organisation will be able to demonstrate that your systems, tools, processes and people adhere to the recommendations of an internationally-recognised framework.

Let us give you a small example to showcase the importance of this statement. Imagine that you are living in an unregulated world, and no international standards create consistency in the world of health and safety or finances. Without these international standards, there would be complete chaos, financial losses, and fatalities at every turning point.

This is why adhering to an information security standard that is internationally recognised raises your brand credibility. Additionally, when you get audited from an independent certification body, you get fresher perspectives into your system, helping to change the pace of your processes and accelerating growth.

Hence, through the ISO 27001 lens, you get to see two perspectives, namely:

1. As a customer, you have increased confidence that a specific supplier is certified, and therefore, all your business risks will be appropriately mitigated, and all possible opportunities will be explored. Your benefits will be consistent, and you will have to teach lower costs to protect your information.

2. As a business owner, you can cater to the needs of your growing clientele, who is now more intelligent and digitally conscious. As your customers become more intelligent, they will likely know more about the supply chain and how it is necessary to protect it adequately. In some cases, influential customers can demand that you mandate ISO 27001 certification to transfer the risk management process down the supply chain.

In addition to winning the trust of influential customers, you will enjoy spin-off benefits such as winning extra business after becoming ISO 27001 certified versus laggards who are uncertified. Additionally, the best talent will want to work with trusted brands, and insurers will also catch up with your working practices, meaning that you can enjoy a lower premium for your organisation after becoming certified.

What are the benefits of ISO 27001 certification?

Once you get certified, the critical message you pass to all stakeholders is trust and assurance. After you get externally audited for your information security management system, you can enjoy multiple benefits, including:

Benefits to you as a business owner :

•   Protected brand, reputation and IP.

•   Winning more business from new and existing clients.

•   Reduction in cost of sale.

•   Better ability to retail business.

•   Enhanced processes are leading to massive cost and time savings.

•   Avoiding fines for regulatory non-compliance.

•   Avoiding civil suits that can result from security threats of data breaches.

•   Avoiding the unnecessary cost of remedial action due to breaches or incidents.

•   Attracting and retaining better staff.

Benefits to your staff:

•   Enhanced trust in your organisation’s sustainability.

•   Learning about information security and undergoing specific training.

•   Better clarity about roles and responsibilities because of adequate training, policies and procedures.

•   Pride in the organisation and its role in achieving organisational goals.

Benefits to your customers:

•   Trust and assurance in you and your supply chain.

•   Less likelihood of encountering a costly breach.

•   Reduced cost of supplier onboarding.

ISO 27001 certification: is it worth it?

If you have valuable information assets owned by others, doing nothing is probably not a feasible option. Some organisations’ entire business is built on managing and developing information assets.

So, in such circumstances, not getting ISO 27001 certified is equivalent to losing some or all of your business or not winning more business in the future. This is especially true if your customers and other relevant stakeholders perceive a risk related to your ability to manage information appropriately.

Now, organisations have a common hesitation. Organisations misunderstand that acquiring the ISO 27001 standard is lengthy and complicated.

However, achieving ISO 27001 certification is not as complicated or expensive as it used to be a few years ago. This is because many certification bodies provide innovative solutions online. Unfortunately, many leaders still see the ISMS as another bureaucratic tool with no real-world benefit and put it off as another “box ticking” exercise.

However, the certification has real-world benefits and could be the difference between remaining stagnant and achieving business growth. Yes, acquiring a certificate typically means that you need to invest time and resources in the process. Still, like any other strategic investment, it is not that investment that you need to focus on, but the returns and the broader benefits.

An article published by Alliantist CEO Mark Darby explores the Return On Investment (ROI) from an ISO 27001-compliant ISMS. The article stated that ISMS explores opportunities and threats, benefits and consequences, and offers a range of exercises to help consider the ROI and discover how to manage your ISMS in the future.

This article teaches business owners different analytical tools that will help them quantify the financial risks they will incur if they do not implement information security practices like those outlined in the ISMS.

What is involved in an ISO 27001 implementation?

Implementing ISO 27001 implies that you need to develop a sustainable management system. The management system is composed of people, processes, protocols and technology.

Concerning people, you must ensure that your employees have the appropriate skillset to interact with and maintain your ISMS. You must demonstrate leadership commitment to guide implementation so your employees can adapt to the new management system. As you provide adequate resources such as training programmes and support to employees through your policies, you will be able to reach your organisational goals faster.

Consequently, when you are undergoing an external audit, one of the core requirements is leadership commitment. By reviewing the capabilities of your personnel, the auditor will be assured of your commitment, business goals and your capability to maintain your ISMS. Auditors will interview your process owners to see if the “spirit of ISO 27001” is appropriately applied to all levels across your organisation.

Your people will also need to demonstrate the capability, capacity and confidence to address the requirements of ISO 27001. It is, after all, the people component that maintains your ISMS.

This means that you will need the following:

•   A digital or paper-based copy describing how you have met the core requirements of ISO 27001 and evaluated its efficiency over time. Here, you must audit the system at least annually.

•   Similarly, another document you would need to produce would highlight the controls of Annex A and how your policies were developed to ensure that support is available to the people who interact with the ISMS. To improve your compliance, don’t just write the controls and policies for the sake of it; instead, focus on how you identify the issues your organisation faces.

This documentation aims to show you all the issues and how you engaged with them to reduce their potency. So, when describing the issues the organisation faces, please talk about the interested parties and their expectations, your scope and boundaries. Your documentation should also serve as evidence of all the steps you took to mitigate the risks. You have to actually “show your working.” Hence, whenever you conduct an internal audit of your management system or its part, record the procedure and the evaluation result.

•   Your management system should have all the tools which underpin the work that you have done, documenting each step so that the auditor can easily follow it.

•   There are numerous activities that you can conduct with the help of a risk management tool to determine which of the control objectives outlined in Annex A are the most suitable for your organisation. This will help you decide what you need to implement without getting overwhelmed by the technicality of all controls. At this stage, you need to create a statement of applicability.

•   Your document set-up should easily integrate with your technology solutions. Hence, make your paper set up actionable, practical and easy to adapt.

•   If your business processes rely heavily on the supply chain, you need to show how you control any risks related to your suppliers. This is a fundamental requirement of compliance, and you can highlight how you have shortlisted your suppliers and evaluated their efficiency.

•   You also need to include a description of the control objectives and their associated requirements to demonstrate how it applies to all incidents, events and weaknesses. This means you need to showcase your policy on addressing security incidents and demonstrate evidence of any past events where you utilised incident tracker methods.

Plan, do check, act.

The foundational basis of every ISO standard is the Plan, Do, Check, Act (PDCA) cycle. The PDCA approach is the most recognised approach to implementing a system and training it for continuing growth. It is a standard approach utilised in many quality management methods.

Compared to the 2013 version, the 2017 version of ISO 27001 demonstrated a more dynamic and agile process that supports continuous improvement and evaluation of the management system. Therefore, it required real-time applications of the PDCA cycle for the approach to become more pragmatic.

This is because, traditionally, organisations seemed to have a latent approach to an operational security system that was dynamic but unsatisfactory. Examples included installing network scanners or firewalls. However, this was unsuitable for the ever-changing and ever-escalating modern risk landscape.

This landscape required an information security management system to be more agile, dynamic, effervescent and continuously monitored. That is why the PDCA cycle is scattered throughout the implementation process.

1. Plan for ISO 27001 implementation:

When you are adding context and structure to the implementation plan of your ISO 27001 ISMS, the lead implementor should adhere to the following considerations:

• Create clear goals and compelling reasons to act upon any deadlines you want to achieve, as well as include any consequences of not hitting the deadline.

• Identify the return on investment, and categorise the desired outcome under a different headline so that the right people and leadership can get behind the goal by supporting them through budget and resource allocation.

• If your team is new to the concept of ISO 27001, do not hesitate to buy ISO 27002 guidance. Reading the guidance in ISO 27002 helps to compare your current internal environment to what is required for success. In other words, it contains instructions on how to conduct a light gap analysis.

As you read the requirements, you will realise that you may already have many of the processes recommended in the standard, and all you need to do is formalise and refine them. At this point, you may identify the need to hire external training or a lead implementer for your programs. This may be beneficial and can positively affect the practicality of your ISMS only if you cannot conduct the light gap analysis appropriately.

• Consider the feasibility of pre-configured tools and technology solutions, comparing their effectiveness. If you already have the tools to make actionable documentation, you are in for a massive head-start. However, many consultancy services offer virtual coaching and training to help you achieve certification.

• Get started, do not spend too much time contemplating the ISMS. If it seems overwhelming, break down the action plan into bite-size, workable chunks and focus on the step ahead. Do not forget to celebrate small wins, as frequent progress is better than no progress. It is after all these baby steps that lead towards a hundred per cent perfection.

2. Address the critical elements of ISO 27001 standard:

ISO 27001 can be implemented using a policy-led approach from a bottom-up manner. You must do more than apply and document Annex A controls. Begin by:

•Looking at the issues your organisation regularly faces and understanding the needs of all interested parties, including your stakeholders. Mainly go on to identify the information assets as early as possible.

•Write the context of your organisation and set appropriate boundaries as you describe the scope of the ISMS.

• Define and set your organisation’s security objectives concerning its ISMS.

• Ensure that you can regularly implement reviews, audits and evaluations. Such evaluations are necessary to show that you control your ISMS.

It is also necessary to briefly document these implementations, starting from day one of the implementation journey, so that the entire process can be shared with the auditor and all the lessons learnt can be highlighted.

• Identify the risks to those information assets and conduct risk assessments to determine their potency. If you are short on resources, conducting a full-depth risk assessment is unnecessary, and you have the choice to prioritise high-risk-high-risk information assets and other significant threats.

•Based upon your risk assessment, create a detailed address assessment plan for each risk that you have identified. Wherever it is appropriate, refer to Annex A control objectives to select the most appropriate control for implementation. Ideally, all your documents should be interlinked so the auditor can understand how your assets, risks and controls fit together. If you change or rectify one part, the impact on the related file should be traceable.

•Prepare your statement of applicability so that it updates people regarding the mandatory requirements without wasting precious time.

Remember, it is necessary to document every step of the implementation process and the results of your regular evaluation to demonstrate your commitment to continuous improvement.

3. Evaluate your ISO 27001 by the standards and its readiness to achieve certification:

It is critical to have the measurements and reviews in place to ensure that your ISMS is efficient and meets your organisation’s objectives. ISO 27001 sets out recommendations for planned evaluation to take place in the form of:

•   Management reviews

•   Internal audits

•   External audits, where the audit can either be done by a certification body, customers or consultants.

4. Improve your ISMS as necessary.

The continual improvement process is a vital component of the ISO 27001 success, and auditors will want to see evidence of your ability to conduct regular evaluations. This is because security threats and vulnerabilities change rapidly, and many organisations need regular evaluations to identify these changing vulnerabilities.

The advantage of this regular evaluation is that it helps to align the assessment with the organisation’s changing goals and increased growth. A successful business is successful because it demonstrates its commitment to taking corrective actions and improving its management system. If implemented correctly, your ISMS will enable your business to grow rather than restrict its growth.

How do I get certified to ISO/IEC 27001 standard?

The first step to getting certified is implementing the information security management system and conducting the management review. This is what sets you up for the certification process. Certification is a two-stage process, where you will undergo stage one and two audits.

Stage one audit

•In simple terms, the lead auditor from the certification body will want to see that your ISMS documentation aligns with the standard’s requirements. In this stage, a desktop review of the ISMS is done.

The auditor will cover the mandatory areas of your documentation, ensuring that the spirit of the standard is alive in your management system. Many forward-thinking certification bodies do this audit remotely, as it speeds up the process and drives down costs.

• The outcome of this audit is a recommendation for stage two audit. The stage two audit is also known as a readiness audit. However, before progressing to this level, you will need to rectify any nonconformities identified in the stage one audit.

•Depending upon the status of your internal audits, the auditor may recommend that you conduct a complete internal audit before you progress to stage two. There is no set rule about this; it is all chalked up to personal preferences and the current stage of your ISMS.

Unfortunately, many organisations fail stage one audit, and one of the core reasons behind their failure is that leadership was not appropriately engaged.

Take this statement as a lesson and demonstrate your leadership commitment by regularly engaging with your employees, providing adequate support and creating appropriate policies.

Stage two audit

•   This is where the auditors will begin to look for evidence that there is no discrepancy between your documented ISMS and those in front of their eyes. If your policies are taken straight from a dodgy document tool kit, they will not be practical, and your ISMS will be inefficient, impractical and unreliable. To test the efficiency of your ISMS, the auditor will engage with you, interview the process owners, assess your scope around the physical location, observe your processes and test the validity of your systems. Like most audits, it will begin with sample size, and the auditor will slowly and steadily scale up.

•   It is the outcome of this exercise that determines your certification. If you pass this exercise, you will be granted a precious certificate. Failing, on the other hand, is not the end of the world, and you will be given a period to rectify all the non-conformities identified during the audit. You can resubmit for another audit or undergo a specific review for the non-conformity to gain your certificate.

You are maintaining your ISO 27001 certification.

When you receive your certification, you enter a three-year cycle.

•   Stage one and two audits lead to the certificate award.

•   Surveillance audit conducted in year one or even more frequently based upon your organisation’s scope, risk and size.

•   Surveillance audit conducted in year two.

• Third-year recertification audit with a more detailed evaluation.

In short, to maintain the validity of your certification, you need to conduct a yearly surveillance audit. At the end of the three-year cycle, you must undergo an audit similar to the original certification audit to regain your certificate. Remember, it may take 4 to 6 weeks to book with an audit body, so bear that in mind as you approach your expiration date.

Mandatory requirements for ISO 27001 certification

If you stick to the points mentioned below, you can fast-track your ISO 27001 implementation and reduce the ongoing management time for your ISMS. The mandatory requirements that need to be in place include the following:

•   The complete record of the implementation phase. Remember, you will not get certification with a minimum amount of work or if you treat records as a “box ticking” exercise. When an auditor sees that an organisation is putting in the bare minimum amount, it suggests that the organisation does not have proper leadership commitment and is unwilling to devote the time and effort needed to handle its security.

•   Prioritise focusing on the must-have areas and evolve your ISMS over time using a sensible approach.

•   Every main requirement between clause 4.1 and clause 10.2 must be adhered to, which includes ten key activities that drive broader investments in Annex A control. There are specific mandatory controls that the auditor will expect to see.

It is worth noting that you cannot follow what another organisation has done, as no two organisations are the same. This holds for your ISMS. For your ISMS to be effective, it needs to be customised to your organisation’s unique needs. Hence, not all controls listed in index A will apply to your situation.

How much is the cost of ISO 27001 certification?

The exact cost depends upon the size and scope of your organisation. Still, the certification cost includes the internal audit and the certification audit, the surveillance audit and the entire cycle with the recertification audit. For a medium-sized organisation, the price can be between $16,000 and $ 17,000 per annum.