ISO 27001 Consulting Services: Certified Experts

An ISMS is a systematic, risk-based approach to managing sensitive data to remain secure.

A Risk Assessment or risk analysis is a key element of an ISO 27001 implementation. Its purpose is to identify the risks associated with loss of confidentiality, integrity, and availability of information assets and rank each risk’s importance to focus on risk mitigation efforts.

ISO 27001 is the most important standard in the ISO 27000 family of globally recognized standards that provide guidance and a logical framework that organizations use to keep information secure. It is the “de facto standard” for Information security and is widely recognized as the best way to prove to key stakeholders that you have a strong cybersecurity program.

An organization seeking to achieve or maintain ISO 27001 certification must conduct periodic internal audits, per clause 9.2 of the ISO 27001 standard. Conducted by in-house staff or a trusted third party at least once every year, the internal audit’s purpose is to help management verify the effectiveness of the ISMS (e.g., does it conform to the organization’s own requirements as well as those of the standard).

Conducted by a certification body (often referred to as a registrar), an ISO 27001 Certification Audit determines whether an organization’s Information Security Management System (ISMS) conforms to the requirements of the ISO 27001 standard. If the findings are satisfactory, the ISMS is certified as conforming to the standard. The ISO 27001 Certification Audit covers the full ISMS and occurs in the first year of the three-year ISO 27001 certification cycle.

ISO 27001 Surveillance Audits cover a subset of the ISMS and are conducted by a certification body in years two and three of the three-year ISO 27001 certification cycle.

Achieving ISO 27001 certification typically takes between 6 to 12 months, depending on the size and complexity of the organization. The time frame can vary based on the current state of an organization’s cybersecurity program and the resources dedicated to the certification process.

During a certification audit, an external auditor evaluates the organization’s ISMS against the ISO 27001 standards to verify conformance and effectiveness. This process typically includes document reviews, interviews with staff, and observations of the organization’s practices and controls.

An ISO 27001 internal audit assesses the effectiveness of the ISMS and ensures adherence to ISO 27001 standards. It identifies areas for improvement and checks that the organization’s security practices align with its policies and procedures.

ISO 27001 certification benefits all industries where data security and privacy are critical (e.g., legal, finance, healthcare, technology, etc.). Organizations across these sectors can gain a competitive advantage by demonstrating their commitment to information security.

An Information Security Management System (ISMS) is a systematic approach to ensuring that critical risks to information assets are reduced to a level consistent with management’s objectives. In essence, it is a comprehensive process for managing information security.

ISO-27002 is a collection of “best practices” (e.g., information security controls) for managing information security risks. An ISO-27001 ISMS utilizes the ISO-27002 controls as mechanisms to reduce risks to critical information security assets. In essence,ISO-27001 certification “includes” or encompasses ISO-27002 compliance.

There are three costs to becoming certified: internal costs (e.g., resource cost), consulting costs for preparation, and certification costs. The costs can vary notably based on the ISMS scope, ISMS gap assessment, resource capabilities, and the project schedule. Learn more about ISO-27001 Certification Costs.

You are required to have a registrar audit your ISMS each year. In each of the first 2 years after your certification you will require a “surveillance” audit. In the 3rd year you will require another “certification” audit. The cost of the surveillance audit is generally 60 to 80% of the certification audit. You will also need to conduct an “Internal ISMS Audit” annually. While you can do this with internal staff, most organizations favor having an independent entity conduct the audit.

It’s important to note that you may end up pursuing more than one of these “attestation standards”. So the question may be “Which should I pursue first?” As the primary business driver for pursuing these standards is “attestation” for your clients, the answer may be as simple as understanding what your clients require. If you expect to pursue more than one “attestation certification” – separating the building of the ISMS from the choice of attestation/certification is the best approach.

ISO 27001 is a specification for an information security management system (ISMS) and includes information concerning business continuity management as it pertains to the continuity of the ISMS. ISO 22301 provides a broader specification for a full blown Business Continuity Management System (BCMS) that addresses the continuity beyond the ISMS. The Management System component of the standards are completely compatible with one another.

This depends on the structure of the organization seeking certification. Most organizations choose to ISO-27001 certify the portions of the organization which process sensitive client data.

ISO-27001 does require a fair amount of documentation of the ISMS itself and evidence that the ISMS is operating effectively. Generally, we find that the additional work effort to produce and maintain the documentation is more than offset by the time saved by reductions in security incidents and third party audits.

An organization with ISO-27001 certification will benefit from the savings of increased efficiency that a well maintained ISMS provides. We also note that companies with an ISO-27001 certificate save a considerable amount of time providing documentation of the ISMS (e.g. questionnaires) to their current and potential clients. Having an ISO-27001 certificate can also be a significant competitive advantage over other companies providing the same services that you do.

An organization that is accredited by a known accrediting body for its competence to audit and issue certifications that confirm an organization meets the requirements of a specific standard (e.g. ISO 27001 or ISO 22301).

When choosing a certification body, don’t just compare prices. You should review several different certification bodies’ proposals to see what they include. There are some additional factors that should be considered during the decision-making process:

1. Accreditation. Anyone can say they’re ISO 27001 certified, but not everyone can say the same about their accreditation status. You’ll want to check to see if the certification body has accreditation before going further.
2. Experience. Ask for a list of companies that the certification body has audited previously. Don’t settle with someone who has little to no experience.
3. Flexibility. This doesn’t mean you must choose someone who is local or someone who has a completely open schedule. It may prove difficult to change the date of the audit if travel arrangements have been made previously, especially if something happens beyond your control.
4. Integrated Audit. While you may only be considering ISO-27001, the organization may want to implement additional certifications in the future, such as ISO-22301, HITRUST, or PCI. In these instances, the certification body can perform an integrated audit, which will save you both time and money.
5. Language. This goes hand and hand with Flexibility. If your certification body does provide a translator, the audit may go smoother if they already speak your language. Documents will be interpreted easily, and the relationship can be better fostered in the absence of any difference in language.
6. Reputation. While all registrars are accredited, there can be a delta in the quality of the auditor and the audit process. Some registrars have notably better reputations than others.
7. Specialization. Vertical expertise can be a significant advantage. If you are a law firm seeking certification, selecting a certification body specializing in financial or medical sectors may result in you spending a lot of time explaining your business. Worse, receiving non-conformities based on their lack of understanding.

As with most major enterprise related decisions, convincing management to pursue ISO-27001 certification could be an uphill battle. To aid you in the process, you will need to have two vital components: a list of benefits to the business that apply directly to your company, and the ability to communicate those benefits to those at the executive level in a way that they can easily understand.

Three benefits that exalt the implementation of ISO-27001 to executives:

1. Certification is a statement to everyone in the company. Whether your goals are based on customer satisfaction or objectives with production, with a certification in place, you are proving that your company is committed to meeting and/or exceeding those objectives.
2. If you are in an industry that relies on that the transmission or storage of clients’ sensitive data, ISO-27001 provides you with the marketing leverage to set you apart from your competitors.
3. ISO-27001 will significantly reduce the likelihood and impact of a data breach. With average breaches costing ~$4M, ISO-27001 is the best way to protect your company from a potentially crippling loss.

Learn more about the benefits of ISO 27001 »

Maintaining your certification is reasonably simple:

• Operate the ISMS as documented. Most importantly take a risk-centric approach to managing information security risk.
• Update the controls you have in place (e.g., your Policies and Procedures) as required by changes in risk.
• Improve your Information Security year over year in a measurable way. Continuous IMporvement is a requirement of the standard.
• Conduct an ISMS Internal Audit each year (or at different points throughout the year to demonstrate that management is committed to ensuring the effectiveness of the ISMS.
• Undergo an annual surveillance (or re-certification) audit by the registrar each year to maintain your certificate.

ISO-27001 does not explicitly require that an individual in your organization has the title of CISO. However, having someone with the senior level expertise required to establish and maintain the enterprise’s security strategy and act as the primary liaise to interest Third Parties is beneficial. Organizations that doesn’t have the resources or the need for a full-time CISO may choose to leverage an outsourced CISO on a temporary role until their needs evolve.

Learn more about vCISO services »