The stepping stone for information security management based on internationally recognized standards.

Many organizations are actively looking to improve information security practices and establish formal programs for enterprise security. For some, the goal is to improve overall compliance with regulations and internal security requirements, while others seek to prove effective security and privacy practices to third-party partners, vendors and customers. As a template for security management, many are turning to internationally recognized information security standards such as "ISO 27001 - Information Security Management Systems - Requirements" and the companion standard "ISO 17799 - Code of Practice for Information Security Management".To help organizations establish the plan for moving forward in building and adopting manageable security programs based on ISO standards, Accuvant has developed a comprehensive ISO Gap Analysis service. Through this offering, Accuvant guides clients through the cycle of evaluating their current state of information security programs against best practices defined by ISO 27001 and ISO 17999, identifying deviations in existing security controls and defining the steps necessary for improvement.

Information Security Management System Consulting:

This service enables customers to select and deploy relevant ISO 27001 controls and best practices within their environment. The service is offered in a modular form and is customizable to suit specific needs. The key modules include:

• Threat & Risk Assessment
• Creation of ISMS Framework: ISMS design based on ISO 27001 guidelines that are

vendor and technology independent
These modules can be considered in isolation if a certification is not your end goal.

ISO 27001 for the health care Sectory.

Information Technology - Security Techniques - Information Security Management Systems - Requirements, is the newest management system standard to help ensure information security. This leading-edge tool is becoming extremely important to the Healthcare Industry as more and more organizations look to adopt the use of Electronic Medical Records (EMSs). This standard enables health service providers to organize information security processes and document subsequent actions in a format that allows for the implementation of security controls that can be customized to their specific needs. Registering to the standard demonstrates to partners in the continuum of care and patients/clients that your health service organization is committed to maintaining privacy and security of any information contained in each patient/client’s EMR.

Changes to the Standards.

The first point to underline is that the new international standard is not significantly different from the British version of the standard; it was not the intention of the International Standards Organisation (ISO) to contradict or drastically change what had gone before, or to impose unnecessary extra work on organisations already using it. All international and national standards are subjected to a periodic review process. The review cycle for the transition from BS7799 to ISO 27001 saw some 4,000 comments submitted by national standards organisations. As part of this feedback it was determined that the standard needed a refresh and additional clarity to help its successful adoption as the internationally recognised best practice. As a result a number of structural changes have been made to 27001, such as the creation of a new section on incident management using controls previously found in the personnel section. There are now a total of 133 controls in eleven sections. There are eight new control objectives, five consolidated or combined controls, 17 new controls to cover additional issues and nine deleted controls. The most significant change is the new requirement for the measurement of the effectiveness of the controls (or groups of controls) to be implemented. The rationale being that you cannot properly manage what you cannot measure, and there is limited benefit in implementing something whose usefulness you cannot measure.

ISO/IEC 27001:2005 Registration

Aims Management Consultants is accredited by the RvA (Dutch Accreditation Council) to provide registration and certification services for ISO/IEC 27001:2005 (previously BS 7799). An organization seeking formal registration to this scheme must be assessed by a third-party certification body such as Aims Management Consultants. We'll use our knowledge, expertise, experience, and industry insight to help you achieve your certification smoothly and cost-effectively.

What is information security?

Information security is the protection of information to ensure:

• Confidentiality: ensuring that the information is accessible only to those authorized to access it.
• Integrity: ensuring that the information is accurate and complete and that the information is not modified without authorization.
• Availability: ensuring that the information is accessible to authorized users when required
  

Does ISO/IEC 27001 define the methodology for risk assessment?

The standard specifies only that the organization should use a systematic approach to risk assessment (method of risk assessment, legal requirements, policy and objectives for reducing the risks to an acceptable level). A specific methodology is not prescribed.
Several methodologies are published and available for use. These include
1. ISO/IEC 13335 (Management of information and communications technology security )
2. NIST SP 800-30 (Risk Management Guide for Information Technology Systems)

What are the benefits of adopting ISO 27001/2

The Benefits of Adopting ISO 27001/2
There are of course a wide range of benefits and advantages in taking on the standards. These will vary from organization to organization. The following is an extracted starter list of some of the most common advantages reported:

• Improved Information SecurityAdopting the standards undoubtedly drives the process to improve security, and reduce risk.
• Management AssuranceManagement and others can be more assured of the quality of a system or other entity if a recognized framework is followed.
• DiligenceCompliance with (or certification for) an international standard can be used to demonstrate due diligence.
• BenchmarkingThe standard is often used as a measure of status within a peer community. Compliance with it can provide a bench mark for both the current position and future progress.
• MarketingAdherence toh the standard is often used as a beneficial differentiator in the commercial market place.

Where to start?

The obvious starting point is to obtain the standards themselves, or the toolkit (see left panel). From there, review the contents of these and research externally (with respect to the standard), and internally (with respect to scoping).
With the requisite knowledge you should then be positioned to set out your objectives, define the scope, and create a project plan. The adventure thus begins...

ISO 27001 Surveillance Audits

Surveillance audits are typically performed every six to twelve months, depending on the results of the initial ISO 27001 certification audit. A typical audit of this type focuses on the non-conformities, recommendations, opportunities for improvement, and observations discovered in the initial certification audit. Orange Parachute experts and methods can help you enhance your system between audits and sustain preparedness in anticipation of surveillance audits.

Benefits of Implementing Business Continuity Management

Some of the benefits of implementing the BS 25999 standard are as follows:

• Provides stakeholders with assurance that risks from potential disasters have been reasonably mitigated
• Provides company personnel with proper procedures in case of disaster
• Ensures a faster and more effective recovery of business operations
• Reduces risk of business and infrastructure loss
• Provides insurance underwriters evidence that the company has properly assessed the risks of conducting business
• Attain the BS 25999 certification
• Ensure compliance with standards such as ISO 27001

What is the actual definition of "ISO Certification"?:

The International Organization for Standardization headquartered in Geneva, Switzerland is the world's largest developer and publisher of International Standards, many that describe the best practices of private industry and government. Over 157 countries including the United States have adopted ISO standards as their own. After a rigorous review of our facility, practices, and technology, Tele Direct was certified in November for this prestigious distinction. This means that TeleDirect adheres to strict guidelines for the protection of your data and continuously strives to improve those safeguards. By earning ISO 27001 certification we have further demonstrated our commitment to making our Company more secure and securing your information.

CIW Security Professional Certification

CIW Security Professional Certification Course consists of three modules, namely Network Security and Firewalls, Operating System Security and Security Auditing Attacks and Threat Analysis. The course duration is for thirty hours and is a mandatory requirement for CIW Security Analyst Certification.
· Module-1 : Network Security and Firewalls
· Module-2 :Operating System Security
· Module-3 : Security auditing, attacks and threat analysis
Target Audience: This course is designed for networking professionals, network administrators, support staffs who want to implement security in Networks, Operating systems. Recommended for information security auditors.
Course Certificate: A Certificate of Achievement will be awarded to the participants by NSS. Students who successfully pass the CIW on-line examination will receive Security Professional Certificate from CIW, USA.

What You Will Learn

• Understand the requirements of the ISO/IEC 27001:2005 and ISO/IEC 27002 standards
• Practical techniques for designing and implementing an ISMS
• Detail explanations of the ISO/IEC 27001:2005 ISMS components and the improvement cycle
• Understand the necessary skills to design, implement, maintain and audit an effective ISMS
• Assess an organisation’s information security needs against ISO/IEC 27002:2007 and ISO/IEC 27001:2005

In addition the course will have hands-on activities in which delegates will have the opportunity to undertake practical exercises with the intention of formulating practical documents that can be used in their business, including:

• Information Security policy
• Identification of information assets and their value
• Determination of risk and impacts
• Identification of control objective and controls
• Risk Analysis and Risk Treatment Plan
• Statement of Applicability (SOA)
• Completion of ISMS documentation requirements
• Production of a ISMS Project Implementation Plan

Internal Communications

The team then created an internal communications programme to ensure all employees had a full understanding of ISMS and their personal roles in the process. Initiatives included informal launches at all office locations, articles circulated on the intranet, the distribution of an employee handbook and mandatory awareness training programmes. Ricoh also gave staff gifts, including a personal alarm and SIM card replicator, to reinforce the security message.
Ricoh has so far trained two UK employees as ISO27001 auditors. They are responsible for conducting internal audits, to ensure the firm remains compliant and to highlight areas for improvement to the ISMS
Hewitt commented: "We are delighted to have achieved the certification as part of a company–wide global initiative. Our customers and partners will benefit from increased confidence in our IT systems and personnel, which will ensure that we do not put confidential and sensitive information at risk."

The ISO/IEC 27000 Family of Security Standards Information

Most people have come across ISO17799 and ISO27001, the international Information Security Management Standards.
They're now part of a much larger family, of which ISO/IEC 27000 is the root for the whole numbered series of international standards for the management of information security. Developed by a joint committee of the International Standards Organization in Geneva and the International Electrotechnical Commission, these standards now provide a globally recognized framework for good information security management.
The correct designations for most of these standards includes the ISO/IEC prefix and all of them should include a suffix which is their date of publication. Most of these standards, however, tend to be spoken of in shorthand. ISO/IEC 27001:2005, for instance, is often referred to simply as ISO27001.
Some of the standards have already been published, others are still under development. Organizations interested in using or applying these standards should acquire copies, which are available through this site in both hard copy and downloadable formats. Clicking on the highlighted standard number, below, will take you to more information about those standards which have been published, including purchasing options.

ISO 27001 Certification

In terms information security standards, certification is against ISO 27001, which is the specification for an ISMS (Information Security Management System). The scheme is actually fairly mature, having existed with respect to BS7799-2 previously. And of course, 27001 has certain alignments in term of process with ISO 9001, which again, adds a degree of maturity.
With respect to BS7799-2, there is in fact a mechanism in place to hasten transfer of the certification, so by no means do those already certified against this has to start from scratch.
Certification itself is becoming increasingly popular, as security is more often viewed as an enabler, and as a market differentiator. There are in fact several registers of certified organizations around, but unfortunately, as certifications are granted nationally by different bodies, there is no complete global resource.

Information Governance services include:

• ISO27001 Gap Analysis through to Statement of Applicability, prior to certification
• ISO27001 Overview training – what’s it all about?
• Security policies and procedures – creation, development, implementation
• Information Security Awareness – programme development and overview training
• Dependency Modelling/Risk Assessment relating to organisational information assurance issues
• Business Continuity Management and Disaster Recovery reviews
• Information Management Strategy reviews and creation
• Utilisation of the Local Government Information Governance Toolkit
• Data Protection Act/Freedom of Information Act compliance reviews

Why should I invest in implementing an ISMS and certifying it using ISO/IEC 27001?

If information assets are important to your business, you should consider implementing an ISMS in order to protect those assets within a sustainable framework.
If you implement an ISMS, you should consider joining the growing number of organizations around the world that have already gone through the process to be certified against the ISO/IEC 27001 standard. A successful ISMS certification provides an assurance that an independent team of evaluators has audited your information security management system and certified your adherence to the international standard. This can be a differentiating factor for your business. ISO/IEC 27001 continues to build a reputation for helping to model business practices that enhance an organization’s ability to protect its information assets.

What skills will delegates gain?

» Understand what is Information Security
» History of ISO Information Security Standard
» How does it affect an organisation
» Understand how to plan and implement ISO 27001:2005 within an organisation
» Understand the basics of IS Risk Management
» Accreditation process and management
» Certification benefits

The relationship between ISO 27002 and ISO 27001

ISO/IEC 27002:2005 (ISO 27002) was previously known as ISO/IEC:17799:2005 but was renamed in 2007 to bring it in line with other Standards within the ISO 27000 family.
ISO/IEC 27002:2005 (ISO 27002) was previously known as ISO/IEC:17799:2005 but was renamed in 2007 to bring it in line with other Standards within the ISO 27000 family.
An organisation wishing to comply with ISO 27002 can select controls from the Standard and implement controls based on the best practice contained within the guide.
ISO 27001 is entitled "Information Technology – Security Techniques – Information Security Management Systems Requirements" and provides a framework for those organisations who are seeking formal certification.
Certification is provided by an external assessment body who are accredited to certify organisations to ISO 27001.

What are the Advantages of IEC/ISO 27001 Compliance.

Advantages of IEC/ISO 27001 Compliance

• Compliance comforts customers, employees, trading partners and stakeholders in the knowledge that your management information and systems are secure
• Demonstrates credibility and trust
• Can lead to cost savings through transparent optimized structures. Even a single information security breach can involve significant costs
• Establishes that relevant laws and regulations are being metSecurity of the business operations can be prioritized by establishing a business continuity management
• Ensures awareness and commitment to Information Security at all levels throughout an organization

ISO 27001 (formerly BS7799) desribes a 6 stage process .

• Define an information security policy
• Define scope of the information security management system
• Perform a security risk assessment
• Manage the identified risk
• Select controls to be implemented applicability"). and applied
• Prepare an So A (a "statement of

What types of organizations need Secure Information?

An ISMS is needed wherever inappropriate use, disposal or disclosure of organizational information may negatively impact on the privacy of customers or other stakeholders, diminish the standing of the organization or its stakeholders, reveal critical competitor or trading partner information or cause liability under regulation or legislation.
As the availability, volume and interdependencies of information within and between different organizations expands, so does the risk of the above occurring. That’s why demand for a certified ISMS is no longer confined to information technology or records-keeping organizations: it can benefit any industry sector that is subject to risk.

When you are dealing with Aims Management Consultants, ‘everything’ includes:

• The right specification, design, construction and operation of Data, Control and Telecommunication centres.
• Assessing, identifying and mitigating your business and security risks.
• Providing CLAS consultancy and advice on achieving Government Security Accreditation.
• Acting as lead auditors, setting security policies and risk assessment under ISO27001 and ISO17799.
• Management of Corporate Resilience, Security, Protection and Risk.
• Assessment of Threat, Risk and Physical Protection measures.
• Business Continuity and Disaster Recovery planning.
• Strategic and Operational planning.
• Technical and Security Architecture. Troubleshooting

Information Security and ISO 27001Overview:

This paper, written by ISO27001 expert Alan Calder, answers these basic questions and others and points to online resources and tools that are useful to anyone tasked with leading an information security project. The information in this paper is suitable for all sizes of organizations, and all sectors, anywhere in the world. The last few years have seen board corporate governance requirements increasingly more defined and specific. As information technology has become pervasive, underpinning and supporting almost every aspect of the organization, manipulating and storing the information on which the organization depends for its survival, so the role of IT in corporate governance has become more clearly defined and IT governance is increasingly recognised as a specific area for board and corporate attention.

What are ISO Certifications?

ISO 9001:2000 (Quality Management System) is a set of requirements against which the quality management system of an organization is evaluated. This certification assures our customers that the processes in place at TradeKey are measured and up to international quality standards.
ISO 27001:2005 (Information Security Management System) is a standard to identify, manage and minimize the risks to which information is regularly subjected. In short, it assures highest level of Customer Information security and data Integrity.
These prestigious certifications are internationally recognized as a benchmark of standardized and quality procedures and systems within the operations of an organization.

Definition and creation of security policies.

Security policies and procedures are an essential element of your organisation’s Information Security Management System (ISMS). Legislation in the UK, such as the Computer Misuse Act 1990, the Freedom of Information Act 2000 and the Data Protection Act 1998, require that organisations implement data security measures to prevent unauthorised or unlawful processing and accidental loss or damage to data pertaining to living individuals.
Our consultants are able to rapidly develop and improve your existing documentation with our ‘tried and tested’ documentation system that is based upon a ‘pre-approved’ series of documents. These have already been proven with customers that have gone through formal certification (ISO27001) and are designed to save time and money as well as reduce risk.

Information Security Policy.

The board of directors of Exlayer has been actively supporting Information Security Management System (ISMS) and has formed an IMS Committee within the organisation. Having become a BS7799 registered firm in 2003 and converted it to the International Standard ISO27001 in 2007, Exlayer is continuously maintaining and improving their ISMS. Exlayer information security objectives are:

• To provide a 24 x 7 service to customers
• To ensure that our customers' data, and indeed our own of a sensitive nature, does not fall into the wrong hands, and that we fulfil our obligations with regards to the Data Protection Act and other applicable laws and regulations
• To ensure that the data that we use are sufficient for the purposes that we wish to use it at the time that we wish to use it and that our records are in keeping with the requirements of the Companies Act and the principles of sound corporate governance
• To establish responsibility and accountability for Information Security within our organisation
• To encourage our employees to maintain an appropriate level of awareness, knowledge and skill to allow them to minimise the occurrence and severity of Information Security incidents.

How does it work?

In step one, Aims Management Consultants, together with the client, identify the client's business processes, analyze and evaluate them in order to find out which processes are most critical to the business.The next step involves identifying all types of resources, commonly called information security assets, needed for normal functioning of the business processes, identifying their value in those processes, threats and vulnerabilities they are exposed to and potential impact on the business if an incident occurs.Business Impact Analysis results provide valuable input while creating a business continuity plan and disaster recovery plan for the client’s organization.

What do ISM3 metrics measure? Security? Risk?

ISM3 metrics do not measure risk or security directly. Metrics in ISM3 are process metrics that measure

• Activity: The number of work products produced in a time period;
• Scope: The proportion of the environment or system that is protected by the process. For example, AV could be installed in only 50% of user PCs;
• Update: The time since the last update or refresh of process work products and related information system. It refers as well to how updated are the information systems that perform or support the process;
• Availability: The time since a process has performed as expected upon demand (uptime), the frequency and duration of interruptions.

Every process in ISM3 contributes to the goals of the ISM, which are defined as:

• Prevent and mitigate incidents that could jeopardize the organization's property and the output of products and services that rely on information systems.
• Optimise the use of information, money, people, time and infrastructure.

Information Security Management Systems - Protecting Your Company And Your Customers.

For most company employees, the only time they think about the corporate network is when it stops. For some companies, temporary delays in email delivery or access to a file server are just an inconvenience or minor irritation. For other companies, network downtime can cause major financial loss.
But a network failure is not the only way a company can suffer financial loss. Almost all companies keep confidential information on servers attached to the network. This data can consist of information about employees, customer details, or corporate intellectual property. Loss, alteration, or distribution of this data can have serious consequences. In most cases, a company also has a legal responsibility to protect this data from unauthorised disclosure.

What is required to Implement ISO 27001.

Developing an Information Security Management System (ISMS) that satisfies the requirements of ISO 27001 involves three steps.

• Creation of a management framework for information - This sets the direction, aims, and objectives of information security and defines a policy which has management commitment.
• Identification and assessment of security risks - Security requirements are identified by a methodical assessment of security risks. The results of this assessment will help guide and determine the appropriate management action and priorities for managing information security risks.
• Selection and implementation of controls - Once security requirements have been identified, controls should be selected and implemented. The controls need to ensure that risks are reduced to an acceptable level and meet an organization’s specific security objectives. Controls can be in the form of policies, practices, procedures, organizational structures and software functions. They will vary from organization to organization. Expenditure on controls needs to be balanced against the business harm likely to result from security failures.

Security Education & Awareness Campaigns

our security experts engage with customer management to identify areas that need awareness training, we then develop and implement successful campaigns to raise awareness and measure their understanding of information security.

The benefits of ISO 27001 information security management.

There are lots of reasons, including:

• Enhanced reputation, credibility and trust among customers and business partners.
• Clear demonstration of care taken over customer and partner data.
• Easier trading with blue-chip companies and governmental departments.
• Fewer security breaches and incidents, resulting in lower costs.
• Reduced external audit costs.
• Legal data compliance.
• Compliance with financial services acts.

What kind of organizations should certify their own Information Security Management System?

Any organization, which considers that its information system needs to be protected, must have such a management system to help it control all the risks. Additionally, the ISMS certification represents a business card that cannot be overlooked by the business partners or clients.

Why Implement an ISMS ISO 27001?

Many organisations understand that Information Security is not just about applying a proper firewall or anti-virus product, it also incorporates defining procedures and policies of information protection, roles to manage, incident management, implementation of security management, ability to control the environment, legal aspects, etc. An ISMS is implemented to secure and maintain protection of Information Assets.

What is this service?

“Information Security Management System" or ISMS in short is that part of overall management system, based on a business risk approach meant to establish, implement, operate, monitor, review, maintain and improve information security. The management system includes organizational structure, policies, planning activities, responsibilities, practices, procedures and resources. With the help of certified implementers and consultants, Paramount can help the organizations to design and build the ISMS which can effectively be used to manage and improve an organizations information security.

Why Appin Recommends ISO 27001 As the Benchmark for ISMS.

ISO 27001 is a globally acknowledged standard defining the requirements for an Information Security Management System (ISMS). The standard considers Information Security as a combination of people, process, and technology.
The standard is globally acknowedged, comprehensive and widely acknowledged. It is also easily integrated with other standards of the ISO family, particularly with ISO 9001. ISO 20000, the service delivery standard, is easily plugged on.
That way ISO 27001 enables companies to measure the risk to their information and ensure the selection of adequate and proportionate security controls that protect information assets, thus enhancing confidence of the organization's stakeholders. At the same time ISO 27001 streamlines business processes and facilitates implementing other standards.

Who should participate?

• Project manager or consultant wanting to support an organization in the implementation of an ISMS
• ISO 27001 auditor who wants to master the ISMS implementation process
• Person responsible for the information security or conformity in an organization
• Information security team member
• Expert advisor in information technology

Demonstrate your commitment to information security.

Information is a major asset. In business it supports a multitude of processes, from deals to mergers, projects to employee details. A range of information that is usually meant for company-use only, can easily be brought into public knowledge. Any disruption in the quality, quantity, distribution or relevance of your information systems can put your business at risk to attack from external sources.
That’s why you need to actively manage the security of information systems and business-critical information, not just to assure your employees and stakeholders, but also any customers and partners with whom you share that information.

What is covered?

• Introduction to Information Security: The basics, myths and reality
• Business Needs: Commercial and legal implications
• Introduction to ISMS standards: History, development, current situation
• Certification: The process, maintenance
• Accreditation: Current developments, options
• Designing and implementing a management system: - Policy - Scope - Risk Assessment - Risk Management - Statement of Applicability - Critical Success Factors
• Open Forum

Policy Awareness and Training

Aims Management consultants can provide a range of staff awareness training seminars based upon the defined policies that the company has adopted. The key aim is to ensure that staff (permanent and contract) are kept up to date about the adopted Information security policies and that they "sign-up" to execute these policies, in the course of their day to day work. This will typically involve the company's HR department to make Information Security awareness part of new staff induction process as well as part of the ongoing reviews of all personnel.

The benefits of implementation of and certification towards ISO 27001 .

• Mapping of the organization’s information structure, including the infrastructure, buildings, environment with all practical aspects, beginning with alarm system through fire service to access control
• Effectiveness and creation of missing processes not only in the field of information security
• Awareness of security risks
• Beginning of active and effective protection against risk factors
• Protection of crucial company’s values – the very essence of the company
• Continuous system optimization – regular audits
• Lower costs and higher production
• Graphically representative certificate of high standard issued by globally recognized company in any language version

The foundational information security management course is designed for:

• Information security managers;
• Business managers;
• IT managers,
• quality managers,
• project managers, and
• IT and other staff, including HR, legal and business users

What is ISO/IEC 27001:2005?

ISO/IEC 27001:2005 is a third party assessable standard against which organizations can achieve certification. It was revised in 2005 and is based on the plan - do - check - act model in common with ISO 9001 and ISO 14001 and uses risk assessment and business impact analysis to identify and manage risks to the confidentiality, integrity and availability of information.
ISO/IEC 27001:2005 aims to ensure that adequate controls addressing confidentiality, integrity and availability of information are in place to safeguard the information of 'interested parties'. These include your customers, employees, trading partners and the needs of society in general.
The ISO/IEC 27001:2005 standard covers:

• scope
• normative references
• terms and definitions
• information security management system
• management responsibility
• management review of the ISMS
• ISMS improvement

What is Information Risk Management Consultancy.

Risk assessment is the only way for senior managers to ensure that controls are cost effective and appropriate.
Risk Management involves evaluating threats and assessing potential impacts (losses) so that measures can be identified and implemented to safeguard important business assets and thus avoid losses.
The success parameters of modern organisations have raised the stakes for implementing a process of information risk assessment. These include the need to comply with legislation and regulation (such as the Data Protection Act, Combined Code and the Sarbanes-Oxley Act (SOX)), as well as protecting its market reputation, providing fast and accurate information and generally putting itself in a position to exploit the Internet and emerging technologies.
The implementation of formal information risk assessment will ensure that senior management, as an organisation's risk takers, are provided with credible, timely and quantifiable intelligence about the actual risks, as opposed to perceived ones, which they face. They can then determine more precisely their security budget and where it should be targeted.
Aims Management consultancy team is highly experienced with each consultant having over 10 years' experience in information security risk management and audit. This experience has been gained across a wide range of private and public market sectors.Aims Management consultants understand not only the technologies and risks, but also the business imperative - which is vital when conducting risk assessments and when presenting the results.

How do you comply or certify with ISO 27001?

In preparing for the implementation of ISO 27001, organisations must follow the Plan, Do, Check, Act (PDCA) process of continual improvement which requires the completion of a series of activities and the production of a number of specified deliverables that will assist in the establishment of an information security management system (ISMS). At a high level and broadly speaking, the Plan Phase entails assessing risks, the Do Phase comprises the treatment of risks, the Check Phase involves the auditing and review of the management system and the Act Phase involves implementing improvements, corrective and preventive actions. The ISMS is the mechanism by which organisations show that they have identified their information security requirements and are operating, monitoring, and maintaining or improving controls to satisfy these requirements.

An Introduction to ISO 27001.

The ISO 27001 standard was published in October 2005, replacing the old BS7799-2 standard.
It specifies the requirements for an ISMS, an Information Security Management System.
BS7799 itself was a long standing standard, first published in the nineties as a code of practice. As this matured, a second part emerged to cover management systems.
It is this against which certification is granted. Today in excess of a thousand certificates are in place, across the world.
ISO 27001 enhanced the content of BS7799-2 and harmonized it with other standards.
The objective of the standard itself is to “provide a model for establishing, implementing, operating, monitoring, reviewing, maintaining, and improving an Information Security Management System”.