ISO/IEC 27001

Information security management systems

The issues of information security (IS) for a modern organization are vital.

Having an information security management system in accordance with the requirements of the ISO/IEC 27001 standard will help an organization protect its assets and ensure the integrity, reliability and confidentiality of information.

Since 2005, more than 25,000 companies around the world have been certified for compliance with ISO/IEC 27001 (according to IRCA).

Certification is a useful tool for increasing trust, thereby demonstrating that the products and services provided meet the needs of customers in the field of information security.

The ISO/IEC 27001 standard is a source of best practices in the design of management systems, applicable to almost any organization, regardless of the form of ownership, type of activity, size and external conditions. It is technologically neutral and always leaves a choice of technologies. ISO/IEC 27001 is one of the most famous standards of this series, which meets the requirements of information security management systems. There are over a dozen 27000 series standards.

The Information Security Management System (ISMS) is a part of the overall management system based on the business risk approach, with the aim of creating, implementing, operating, constantly monitoring, analyzing, maintaining and improving Information Security. It is a systematic approach to managing confidential information. This system includes personnel, processes, and IT systems integrated through the implementation of risk management processes.

In order to form complex requirements for information security , the standard defines three main indicators:

• assessment of the risks that the organization faces (determining the threat to resources, their vulnerability and probability of threats, as well as possible losses););
• compliance with legal, regulatory and contractual requirements that must be met by the organization itself, its business partners, contractors and service providers;
• formation of a set of principles, goals and requirements for information processing developed by the organization to support its activities.

Main elements of the information security system:

• protection against unauthorized access to systems,
  including internal protection against unauthorized access of employees of the organization;
• authorization and authentication;
• protection of data channels, ensuring integrity;
• ensuring the relevance of data when exchanging information with customers;
• electronic document management;
• information security incident management;
• management of business continuity;
• internal and external audit of the information security system.

Main objectives of the Standard:

• establishment of uniform requirements for ensuring information security of organizations;
• ensuring the interaction of management and employees;
• improving the effectiveness of measures to ensure and maintain information security of organizations.

The ISO/IEC 27001 standard provides:

• defining goals and understanding the direction and principles of information security activities;
• defining approaches to risk assessment and management in an organization;
• Information Security Management in accordance with current legislation and regulatory requirements;
• using a unified approach to create, implement, operate, monitor, analyze, maintain and improve a management system to ensure that information security goals are achieved;
• defining information security management system processes;
• determining the status of information security measures;
• use of internal and external audits to determine the degree of compliance of the information security management system with the requirements of the standard;
• providing adequate information to partners and other interested parties about the information security policy.

Integration with other standards

The benefit of implementing the ISO/IEC 27001 standard is a direct benefit to organizations wishing to implement more than one management system at the same time. ISMS, for example, can be integrated with:

• business continuity management system (ISO/IEC 22301),
• IT Service Management System (ISO/IEC 20000-1)
• or quality management system (ISO 9001).

A similar structure of standards saves time and money as integrated policies and procedures can be implemented.

Benefits of Implementation and Certification:

• increasing the trust of customers, partners and other interested parties;
• improving the stability of the functioning of organizations;
• gaining international recognition and strengthening the company’s image in the domestic and foreign markets;
• achieving the adequacy of measures to protect against real threats to information security;
• prevention and (or) reduction of damage from information security incidents;
• demonstration of a certain level of information security to ensure the confidentiality of information of interested parties;
• an increase in the value of intangible assets, a decrease in insurance premiums, which makes the value of the company higher;
• reduction of transaction costs and exclusion of «cross-financing» within the framework of a uniform ISMS;
• expanding the company’s participation opportunities in major government contracts;
• it can significantly simplify the process of passing audits for compliance with PCI DSS, ISO/IEC 20000-1.

Benefits of implementing ISO/IEC 27001

The main advantage of creating and implementing an ISMS in accordance with the requirements of ISO/IEC 27001 is independent proof of the stability and reliability of the organization’s business processes, including:

• increasing trust in the organization;
• improving the stability of the functioning of the organization as a whole;
• achieving the adequacy of measures to protect against real threats to information security;
• prevention and (or) reduction of damage from information security incidents.

The economic advantages are:

• independent confirmation of the fact that the organization has properly implemented risk management, appropriate management system procedures have been developed and implemented, constantly analyzed and improved by competent and responsible personnel;
• proof of compliance with applicable laws and regulations (compliance with the system of mandatory requirements);
• evidence of the commitment and responsibility of top management to provide the management system to the extent required for the entire organization in accordance with the established requirements;
• demonstration of a certain level of «maturity» of management systems to ensure a high level of customer service and partners of the organization;
• demonstration of regular audits of management systems, performance evaluation and continuous improvements.

A useful advantage is the effective management of outsourcing due to clear criteria for evaluating service providers and the responsibility of both parties..

Competitive advantage is evidence that the organization’s information security processes are able to meet the needs of external users in the long term, the risks are assessed and managed.

ISMS certification for compliance with the requirements of ISO/IEC 27001, respectively, is the only generally accepted confirmation of compliance with international requirements in the world practice.