Guide to ISO 27001

Whether it’s a government agency, a multinational business, or a local tech startup, protecting your sensitive data is vital. While there are many standards you can work from to ensure your information security management systems (ISMSs) minimize the risk to your data, few standards are as comprehensive or as respected as ISO 27001.

What Is ISO 27001 Certification?

ISO 27001 is the world’s best-known and most trusted cybersecurity framework for managing an ISMS. The framework provides organizations with the best practices for keeping their ISMS secure, fully functional, and in line with their business goals.

ISO 27001 covers three primary principles:

1. Confidentiality: Only authorized users and systems can access your stored sensitive data.
2. Information integrity: Your sensitive data is valid and protected from malicious actions while it’s both at rest and in transit. Only authorized users and systems can modify your sensitive data.
3. Data availability: Authorized users and systems must be able to access the sensitive data whenever necessary.

How Is ISO 27001 Structured?

ISO 27001 is split into two sections, the first of which contains 11 clauses. Clauses 0-3 explain what ISO 27001 is and its goals. These clauses also provide definitions and references. Clauses 4-10 are the Clauses that define the standard and inform you what is required to achieve ISO 27001 certification.

The second section of ISO 27001 (Annex A) provides 93 controls that help you achieve certification. These controls aren’t mandatory, but can influence your certification audit and risk management assessment. The ISO 27001 controls are split into four categories:

• Organizational controls define the rules and expected behavior of the business’s users, systems, software, and equipment.
• People controls provide users with the knowledge, skills, and experience they need to carry out their duties securely.
• Physical controls introduce systems and devices that users interact with physically to enhance data security.
• Technological controls implement system components that help to secure data, such as antivirus software and data backups.

There are no ISO 27001 prerequisites, meaning the certification is available to any organization with an ISMS.

Why Is ISO 27001 Certification Important?

Achieving ISO 27001 certification can benefit a business in several ways, such as:

• Enhanced trust: Holding a global cybersecurity gold standard certification can increase the trust your customers, employees, and stakeholders have in your business.
• Increased reputation: An organization that earns and maintains ISO 27001 certification will be seen as one with significant dedication and ability.
• Compliance support: Meeting ISO 27001 standards often means that a business is also complying with local or industry regulations or standards, such as PCI DSS, HIPAA, and SOX.
• Enhanced security: Systems certified to ISO 27001 standards are less likely to experience a data breach.
• Reduced operational disruption: ISO 27001 reduces business continuity risks by mitigating the risk of data loss and ensuring documented processes in the event of data loss.
• Enhanced business alignment: By ensuring that your ISMS processes align with your business goals, cybersecurity will no longer be a barrier to achieving them.

An ISO 27001 certification can also deliver a strong ROI by reducing the business’s risk of disruptions and fines resulting from data loss. The increased trust created by the certification can also help attract new customers and retain current ones.

The ISO 27001 Certification Process

Since ISO 27001 is so comprehensive and the standards are so high, the certification process may not always be straightforward. However, the process can generally be broken down into six steps:

1. Establish the scope of the ISMS: How does the data requiring protection flow to you, through you, and outbound to vendors and clients? What regulations and client contractual obligations apply to the data?
2. Analyze your current ISMS: First, examine your current cybersecurity controls and assess where they fall short of the required standards.
3. Create a plan: Next, outline how you’ll bridge this standards gap. You should also operationalize your ISMS and validate its effectiveness.
4. Collect evidence: As you start meeting the required standards, document any evidence required to gain certification.
5. Undergo your audit: Once you’ve actioned your plan and believe that you’ve met the ISO 27001 certification requirements, you can undergo your initial certification audit.
6. Implement recommendations: After your audit, act on the recommendations your auditor sends you to help you improve.
7. Maintain your certification: After passing your audit, your ISO 27001 certificate is valid for three years, after which you’ll have to pass a recertification audit. Each year before this, you’ll also undergo a surveillance audit.

In total, it typically takes 6 to 12 months to obtain your initial ISO 27001 certification.

Who Should Get ISO 27001 Certified?

Thanks to the many benefits it offers, ISO 27001 certification would help just about any organization that stores data. For many organizations, ISO 27001 is almost a necessity, as not having it can bar them from working with or selling to many prospects.

The businesses that can most benefit from the enhanced security that ISO 27001 compliance provides are those in industries that collect sensitive customer data, such as the financial, healthcare, and legal industries.

International businesses may find that their ISO 27001 certification removes barriers to working with organizations and customers in other countries. While many standards are only recognized in one country, ISO standards are recognized internationally.

ISO 27001 FAQs

Since it can be a complex process, businesses often have common questions before pursuing ISO 27001 certification.

Is ISO 27001 Mandatory?

No, holding ISO 27001 isn’t a legal requirement. However, adopting ISO 27001 standards can help you comply with many legally required standards, such as GDPR, which applies to any business that stores sensitive data on EU citizens or entities.

What Happens During a Certification Audit?

During your initial certification audit, an external auditor will evaluate your organization’s ISMS against ISO 27001 standards to assess whether you’ve successfully met those standards. This evaluation could include interviews with staff, document reviews, and observations of the business’s controls and practices.

How Much Does ISO 27001 Certification Cost?

In total, the cost of ISO 27001 certification can vary significantly, depending on factors such as organization size, relevant regulations, and current cybersecurity maturity. We have written multiple blogs over the last 15 years on cost, with our most recent estimating all-in costs starting at about $70K. The good news is that those costs have remained relatively flat since then, as companies are generally more mature and technology changes have provided some efficiencies.

In every case, the costs of certification will include:

• Preparation, such as acquiring useful software and consulting services.
• The certification audit.
• Annual surveillance audits and maintenance.

What Are the ISO 27001 Certification Requirements for Small Businesses?

The ISO 27001 certification requirements are the same for small businesses as they are for larger organizations. Where it may differ for small businesses is in the complexity and length of the certification process, as well as the cost of obtaining certification.

Simplify the Certification Process

ISO 27001 certification can be challenging to achieve, but with expert guidance, the process becomes faster, simpler, and often less expensive.

At CBIZ Pivot Point Security, we’ve helped countless businesses achieve ISO 27001 certification since it was first introduced over 20 years ago. Our team of Certified ISO 27001 Professionals has decades of combined experience, ensuring they can deliver reliable consulting services to any organization. Through our consulting services, you can enjoy the best possible start to your ISO 27001 certification process.

Our guarantee is a testament to this confidence, as if we fail to help you accomplish your goals, we won’t bill you.

To find out more about how our consultants can help your organization achieve and maintain ISO 27001 certification, contact us today.