Is ISO 27001 accreditation worth it?

by Nicholas King on May 28, 2019

Have you ever wondered whether your organisation should become certified to ISO 27001?

ISO 27001 provides the specification for an effective ISMS (information security management system) – a framework that offers a structured, comprehensive approach to managing information security risks. An ISO 27001 ISMS addresses the three pillars of information security: people, processes and technology, and takes a risk-based approach to securing information assets.

To achieve certification, organisations must first identify the information they process, then undertake a systematic review of information security risks and their potential impact. Once all risks are identified and understood, the organisation must design and deploy appropriate processes and controls to deal with any risks that exceed its risk tolerance.

Such controls might include common security practices (e.g. firewalls), policies and procedures (e.g. to control access), and more advanced methods (e.g. encryption). Controls are implemented only where risk assessment indicates they are needed, allowing the ISMS to truly reflect the needs of your organisation. The ISMS is then supported by a continual improvement programme, ensuring that processes and controls remain effective over time.

Once your management system is operating in line with the Standard’s requirements, you can choose a certification body to assess your actions. If successful, your organisation will be issued with an ISO 27001 certificate.

Sponsorships Available

Certification is by no means mandatory, but it does have some significant advantages:

Improved reputation

ISO 27001 is internationally recognised as providing a best-practice specification for an ISMS. By achieving certification, you display your organisation’s commitment to robust security, ongoing risk management and protecting sensitive information – a reputational boon to customers, suppliers and partners.

Enhanced security and risk management

ISO 27001 offers a comprehensive, risk-based approach to information security and risk management, with strong emphasis on continual improvement to ensure controls remain effective over time. Implementing the Standard can substantially improve information security within your organisation.

Of course, you can implement the Standard without working towards certification, but achieving certification not only provides independent verification of your efforts (and the associated peace of mind) but can also help mitigate enforcement actions in the event of a data breach by demonstrating an effective and independently verified approach to information security. While even the most robust system can still be vulnerable to newly discovered threats, a haphazard, patchy approach to information security will likely attract higher penalties, should a breach occur.

Stand out from the competition

Whether your organisation operates in a sector with strict compliance requirements, such as financial services or healthcare, or one where there is more leniency, achieving ISO 27001 certification shows that you’ve gone the extra mile and can be an excellent way of standing out from your competitors. According to a recent report published by the UK government, 41% of UK businesses and 27% of UK charities require their suppliers to be certified to a recognised standard such as ISO 27001.

How Vigilant Software can help

Vigilant Software’s vsRisk Cloud solution guides organisations through their risk assessment in line with all of ISO 27001’s requirements, allowing users to identify risks by selecting assets, threats and vulnerabilities, and to apply controls to reduce those risks to an acceptable level within the compliance framework. vsRisk Cloud automatically produces the SoA required by ISO 27001, and enables the risk assessment to be easily repeated year after year.

In line with the demands of the GDPR, we have recently updated vsRisk Cloud with a specific module focusing on data privacy, so that this crucial area can be appraised and managed as part of the broader ISO 27001 risk assessment.

For more information on vsRisk Cloud please request a demo by clicking here.