ISO 27001 FAQ

ISO 27001 is an international standard (a document drafted by a group of international experts) that specifies the requirements for establishing, implementing, maintaining, and continually improving an information security management system (a set of activities and methods for maintaining the confidentiality, integrity and availability of your data and information). ISO 27001 is split into two parts: The first covers procedural requirements such as documentation controls and risk management. The second covers a series of technical requirements - “controls” - relating to information security

ISO 27001 is important because it helps organisations protect their information systematically and cost-effectively, ensuring confidentiality, integrity, and availability of data. Having procedures that are compliant with the requirements of ISO 27001 can drastically reduce an organisation’s risk of information breaches or loss of critical data as well as improve its reputation with customers.

Any organisation that handles sensitive information, regardless of size or sector, should consider implementing ISO 27001 to enhance its information security position. In particular, organisations which produce software products for the health-tech sector will require well-defined cybersecurity controls, which can easily be integrated as part of an ISO 27001 information security management system.

The benefits of obtaining ISO 27001 certification include reduced information security risks, increased customer trust, protection from legal issues in the event of a breach and a competitive advantage in the marketplace. As an internationally recognized standard, ISO 27001 certification can provide peace of mind to suppliers and customers around the world and its strong reputation can be a major factor in securing contracts and tenders with a wide range of potential customers. Effective information security could also be financially advantageous too, reducing the risk of expensive data loss or security issues. A little-mentioned benefit of ISO 27001 is that often customers or distributors will require large cybersecurity questionnaires unless your company has ISO 27001 certification.

The time required to achieve ISO 27001 certification varies, typically ranging from a few months to a year, depending on the organisation's size and existing information security practices. One of the major factors that influence the timeline is the availability of accredited auditors from a certification body. Initial audits often need to be booked several months in advance, so it’s important to account for this when planning ISO 27001 implementation work.

The process for achieving ISO 27001 certification typically begins with conducting a gap analysis to determine what processes and controls are missing from the organisation. From there, procedures will need to be written and approved and staff trained. Technical controls, such as data monitoring and cybersecurity measures, are put into place by your IT team (or similar) and internal audits are carried out to ensure that the organisation is compliant. Finally, an external audit is undertaken by an accredited body, who will then issue a certificate, if they are happy with their findings.

The key components of ISO 27001 include a full range of requirements from the management and policy level, to the practical and procedural. This includes information security risk assessments to determine where controls need to be applied and the controls needed to ensure risks are handled effectively. ISO 27001 also covers management requirements such as the need to establish and monitor key objectives for information security, and periodic review to ensure continual improvement.

An ISO 27001 information security management system should be reviewed and updated regularly when significant changes occur in the organisation or its information security environment. An important aspect of the management system is the commitment to continual improvement, by periodically reviewing both the information security landscape and monitoring the performance of the system against defined objectives. Processes should be updated to ensure that the system remains effective and compliant in an ever-changing security environment. The intention is for the Information Security Management System to act as part of your day-to-day operations, so it can be maintained and improved as standard practice by your staff.

ISO 27001 provides the requirements for an ISMS, compliance against which can be verified and certified by an auditor. It outlines the procedural and technical requirements that an organisation must comply with to have an effective information security management system. ISO 27001 also provides a list of practical controls which can be put in place to meet these requirements. ISO 27002 on the other hand is a complimentary document which expands the details of the controls listed in ISO 27001. It goes into more detail about their purpose and impact on an organisation, including guidance on how they should be interpreted and understood. You’ll need to apply both documents in order to successfully complete an ISO 27001 certification.

Yes, small businesses can implement ISO 27001. The standard is scalable and can be tailored to fit the specific needs and resources of smaller organisations. A large part of ISO 27001 is a list of controls that can be implemented to assist the organisation in compliance. For small businesses, it’s possible that some of these controls are not relevant or applicable, in this case, the organisation can simply document appropriate reasoning for why they are not putting them into place.