ISO 27001 consultancy services

ISO 27001 certification, or ISO/IEC 27001:2013, is an internationally recognised information security management standard of best practices.

ISO 27001 covers a number of policies and procedures to review legal, physical and technical controls to determine the extent who which these meet the 10 clauses and 114 generic security controls grouped into 14 sections (called “Annex A”).

ISO 27001 clauses 4 – 10:

• Context of the Organisation (Clause 4)
• Leadership (Clause 5)
• Planning (Clause 6)
• Support (Clause 7)
• Operations (Clause 8)
• Performance evaluation (Clause 9)
• Improvements (Clause 10)

This will cover the following 14 controls:

• Information security policies
• Organisation of information security
• Human resource security
• Asset management
• Access control
• Cryptography
• Physical and environmental security
• Operations security
• Communications security
• System acquisition, development and maintenance
• Supplier relationships
• Information security incident management
• Information security aspects of business continuity
• Compliance

Being ISO 27001 certified demonstrates a commitment to maintaining top levels of security.

The cost of ISO 27001 certification depends on the size and nature of your business, as well as the gap between your current status and the desired, compliant state. By undertaking a gap analysis first, this journey can be accurately mapped, saving valuable time and money when it comes to implementation.

ISO 27000 series is a family of information security management standards and documents covering all areas of the ISO standard for information management security. ISO 27001 is specifically the certification standard whereas ISO 27002 (and beyond) are controls, guidance and information documents, for the ISO 27001 certification standard.

According to IBM’s Security Report, the global average total cost of a data breach in 2020 was £2.69 million. With cyber and information security making headlines every day, and hackers targeting business of all sizes, being ISO 27001 compliant is crucial.

It also enhances your global reputation, helps you to avoid the financial (and reputational) penalties of a data breach and will also reduce the number of audits you’ll have to undergo.

• Protects you from cyber attacks

  Reduces the likelihood of security incidents.

• Reduces breaches & incidents risks

  Reduces the risks of fines/penalties/reputational damage resulting from breaches and incidents.

• Drives new business

  Worldwide recognised standard which can help drive new business opportunities and provide competitive advantage.

• Cost-effective

  Can reduce costs through standardising processes and procedures, reduced cyber insurance costs and fines.

• Enriches your security culture

  Improves knowledge of information security across the business and helps build a security culture.

• Refines your processes

  Provides a framework for ensuring contractual, commercial and regulatory requirements of the business are met.

• Improves your security posture

  Improves the business response to incidents.

• Gain a competitive advantage

  Can help to simplify due diligence queries from customers, reduce the need for customer audits and speed up tender process.

• Reinforces your reputation

  Increases trust and assurance with customers, partners and the supply chain.

• Spend smarter

  Ensures that budgets for information are spent according to the risks to the business rather than based on what’s the latest and greatest.

• Protects your data

  Supports the protection of personal data and compliance with GDPR requirements.

• Drives business growth

  Provides a structure to help organisations scale for growth.

ISMS stands for Information Security Management System, and is the core component of ISO 27001. It’s the framework that outlines all security risks and your controls for them. It covers people, processes and technology and typically encompasses your entire organisation, securing your corporate information assets confidentiality, integrity and availability (CIA).

ISO 9001 is a standard for ensuring the quality of your services and is based on a QMS (Quality Management System), whereas ISO 27001 sets the standard for information security and uses an ISMS (Information Security Management System). There’s actually some overlap between the two standards, so gaining ISO 27001 compliance will give you a head start on ISO 9001, and vice versa.

When it comes to ISO 27001, the words certification and accreditation are often used interchangeably by companies who don’t know better. However, there is a difference. For ISO 27001 in the UK, a certification body tests organisations against the ISO 27001 standard, and gives them a registered certificate if they pass. The accreditation body on the other hand, is responsible for ensuring that the certification bodies all work to the same standard.

In the UK the accreditation body is UKAS and they’re recognised by the Government. So to sum up, end user companies are certified as ISO 27001 compliance by a certification body, who are in turn accredited by the accreditation body (UKAS).