Our Lead Consultant, Colin Brown, has worked with clients seeking ISO 27001 Certification since it’s infancy. He has seen a recent rise in interest in the standard. Marketing Consultant Rob Govier asked some questions, taking advantage of his “insider” knowledge.

You’ve noticed a spike in ISO 27001 Certification. Is this due to high-profile data breaches? Or are clients finally waking up to it’s value?

The high profile breaches have certainly had an impact. Our clients are realizing that a regular and systematic review of security risks isn’t just a “nice to have” item.

But the main driver are clients’ own customers. They are insisting that they control their security risks. So customers are putting pressure on their suppliers. Pressure is applied to gain an ISO 27001 certification. Also, buyers are using ISO 27001 as a differentiator in procurement. Therefore, waiting until you are driven may be an option, but could also mean lost bids and tenders.

Do you think that the whole cyber security issue will get worse before it gets better? The whole BYOD issue seems to be a major threat.

Cyber security is not going to cease to be a problem in the near future. As long as software companies can save money by reducing their pre-release testing, there will be products with vulnerabilities. Link that with the fact that hackers are as clever as software developers, its pretty obvious that every now and then there’s going to be failure. And someone is going to be caught out.

BYOD is not such a problem as feared. But I’m always surprised at how many companies tolerate staff (particularly sales staff) wandering around with confidential sales and pricing strategies on private smart phones. At one time, salesmen had to secretly photocopy information useful to competitors in order to get them their next job. Now they don’t need to bother. The information they need is probably in their phone anyway.

What do you normally find when you do an initial analysis for ISO 27001 certification? Are you often shocked at what you find? What are the common weak spots?

It’s not unusual to find that data backups never leave the site As a result, they would burn with the rest of the premises. It’s also very common that nobody has ever tried to actually test a backup. So even though your failure might not be as catastrophic as a burnt down factory it’s always worth checking that precautions do actually work.

I often see a tendency to “trust” rather than positively verify. –“The MD of the IT service company goes to Rugby matches with the Sales Director, he’s a really good guy. A great laugh, talks about software and servers all the time. He must know what he’s doing.  He’s the expert after all…..”. I wish I had a pound for every time I’ve been told this.  I could also talk about “IT Maintenance” companies run from a garage Server “farms” which turned out to be a single server, with broadband but no fire alarm.  Neither UPS back-up power nor staff to monitor them.

It’s always worth asking your “outsource partner” a few very basic probing questions. You could even visit their premises.

How often do you find that clients are already using “best practice” anyway?

I would say most companies are 70% of the way there already. However, with security, the extra 30% is often crucial, but expensive. Having an unchecked security leak is like having an undetected illness.  The ignorance might stop you worrying but sooner or later it could also kill you.

There’s a “part two” of this interview on the way soon! Meanwhile, Colin Brown is happy to share more of his forthright insights on ISO 27001 Certification. You’re welcome to drop him a line..

It seems that many people look for an ISO 27001 PDF Download Checklist on the web.

We’ve created our own. Contact us for details. However, it shows how wide the scope of ISO 27001 is.

We are not in favour of the approach behind an ISO 27001 PDF Download Checklist  as we wrote here. Like most ISO standards, successful approval will involve the whole business. Not a checklist in the IT department. Or anywhere else.

We do, however, make our key ISO 27001 PDF download templates available for sale via our shop page. These are not checklists, but the solid foundations for system design.  And they are fully remote-supported by our staff .

However, as an ISO Consultant, I’m frequently asked the same question about ISO 27001:-

“So ISO 27001 is all about IT Security isn’t it ?”

Well, “yes”. But mainly “no”.

What Is It About, Then?

The standard is about installing a quality management system.  This manages the security of all information held by the organisation (IT security does, of course, play a part in this), As a result has a significantly wide wide reach across a business.

But just how wide?

Here’s a list of the documentation used by us for a recently approved company. Are you sitting comfortably?  And this isn’t even the complete version.

Policy for all Staff

Information Security Policy Statement – Statement of system requirements

Information Security – Objectives Table – Progress in implementing the IS Policy Statement

Information Security Management System Manual – System explanation & responsibilities for all staff

Supporting Documentation

Company Organisation Chart

Management Responsibility Statements and Job Descriptions – Documented responsibility statements for those holding security responsibilities

Network and Server Architecture Diagram – Diagram of all the IT network and services covered by the Information Security Management System

Approved Software – Software which can be installed on PS’s as required

Network Capture/Analysis/Scanning Tools – List of network tools that can only be used by IT Support staff

Control of Non-Conformance and Corrective Action Procedure – What to do if you think there is a security breach,and what will be done subsequently. .

Use of Email, Internet, and Social Media – Specifics on use of email, social media etc.

( Possible Addition to the Employee Handbook)

IT Support Procedure – How to log security breaches or any other IT issues you need help with.

Control of Documented Policy & Procedures, – How to update/get a policy or procedure updated

Data and Records

Human Resources Index – Staff Handbook and HR related procedures

Information Security Risk Assessment & Treatment Plan – What the risks are to our information

Statement of Applicability for ISO 27001 – Responses with evidence for the Appendix Compliance Questions

Register of Legislation and Handling – Register of applicable legislation

Business Continuity Plan – How to keep the business running if an emergency occurs.

Supplier and Sub-Contractor Management – How to select sub-contractors and suppliers and what security practices affecting them should be in place

Purchasing Procedure 

Approved suppliers and sub-contractors list-  List of those who have confirmed acceptance of your security practices.

Internal and External Audit Procedure – How to complete ISO audits

ISO 27001 Audit Plan – Schedule/Plan for audits

Audit Report Form Template – Template for audit results

Preventive Action and Management Review-  Planning the development of the security system and implementing a full review of the system by management.

Management Procedure for Training and Competence    –Description of how staff are trained and make themselves familiar with the management system and competent with security issues.

Information Systems Continuous Improvement plan

Data Protection Registration

Requirements for Specific Roles

IT Support

IT Network Managers Security Procedures – Security procedures specific to the Network Management Role

Backup Procedures – Procedures for backing up information and records

Assets and Services – List of all IT and Information Assets

New Joiners

Induction Checklist Evidence that new joiners are made aware of information security system practices and requirements.

Marketing

PR process – Process to ensure press releases etc. are suitable approved prior to release.

Phew!  Yes, it really is that involved. I think that this is outside the scope of most ISO DIY-ers with their ISO 27001 PDF Download Checklist . We’ve even left some things out of this.

However, this is simply a “to-do list”. A “how to do” approach is what is really needed.

All ISO standards should be bespoke to the business. Otherwise, they don’t “fit” it’s aims, activities, and culture. And, if they don’t fit, they don’t work. Hence why you need an ISO consultant to help.

Successful approval to ISO 27001 and it’s is way more than what you’d find in an ISO 27001 PDF Download Checklist. If you think we could help, please drop us a line!.

We’re often contacted by companies wanting to bid for a tender, but faced with the requirement for ISO Certification. To make life easier, we’ve put together an ISO Certification Tenders PDF that answers the main points. Contact us for details.

However, we thought we’d expand this a little, looking at some background, plus wider benefits for your business. (And yes, I’ve struggled with tender responses myself, too.)

ISO Certification for a Tender is Not a “Nice To Have”. Some companies seem to believe that holding a particular standard such as ISO9001 will give the tender issuer a “warm feeling” about their company, rather like charity and community involvement, sponsorship of a donkey sanctuary, brass band etc, etc. It indicates in a vague sense that the company has a “conscience” about quality, a vague intention.

Quite the opposite is true. Tendering bodies now place a huge weight on an organisation holding ISO Certification, for reasons I’ll outline below, so holding the appropriate approval needs to be given serious consideration. This is more than a framed certificate on the reception wall, or a logo on a letterhead. ISO Certification is taken very seriously indeed by those wishing to place, long-term business, and seeking a reliable supplier. Understandably so.

ISO Certification Makes The Tender Process Easier For All. Quite simply, if you hold a specific and current approval, it immediately benchmarks your company in the eyes of the procurement department. There’s not always a need to go into detail about some of your key quality structures and routines – they are already implicit in the the standard, because that’s what the standard is about. And an external verifier has checked that you’re actually telling the truth, too. Approvals can be hard-won, but once in place, are regarded as significant by those wishing to trade with your company.

And conversely, if you don’t hold ISO9001 or similar, it is highly likely that, even if it’s not explicit in the pre-tendering requirements, your bid, (however well-written), will be put to the back of the queue, or worse. Faced with a heap of bid documents to process, staff will look for the easiest excuse to exclude bidders.

You Can’t Do-It-Yourself and Beat The System. In theory, you could try and impress the procurement person with your own framework of quality, and even still be successful. However, the heart of ISO Certification is risk management, and the key control measure is the Quality Management System (QMS). This is the document (and process!) that determines what you do, why you do it, and how this is measured in respect of quality.

Sadly, most organizations would not know where to start in putting a QMS together. Even the ones working within classic ISO guidelines still sometimes struggle! And, in my previous life as an ISO assessor, I could spot a “downloaded from the internet” or D.I.Y. attempt instantly. If you plan to devote some staff management resource at all to the subject of quality within the company, then you might as well do it within the ISO framework, helped by a friendly consultant, and gain a recognised approval at the end of your hard work.

Beyond The Tender, ISO Certification is A Jolly Good Investment! Once installed and working, the approval simply needs revalidating, amending to the changing needs of your business. Furthermore ISO9001, contains elements and frameworks that can be used in other, more specific standards, such as ISO 14001, and ISO 27001. Seeing it as a tool to win a single bid will make certification seem very expensive and risky in terms of potential return. Longer-term, you have all the benefits of an internationally-recognised, independently-verified standard of working.

And It Might Actually Do Your Business Good! I fight a continuing battle to convince managers of all levels that this is more than a “paper exercise”. In the rush to try and compete on a major tender bid, the key fact that ISO Certification is actually highly beneficial to daily business life is often lost. Less waste, more productivity, greater customer satisfaction, all results of working smarter, based on a bespoke Quality Management System.

And Next Time, You’ll be Ready… Sadly, companies often approach me in a bit of a panic in order to comply with a deadline, and have a chance of winning a highly lucrative bid. Sadly, there’s no “Approval Wizard” in the style of a Microsoft Word application that will achieve your certification in five days. Approval takes time. But it then opens up many new opportunities.

And The The Major Point Is…? Start Now. Drop us a line. We’d love to help.

https://www.iso.org/standard/62085.htmlSo, before going for ISO 14001 or ISO9001 certification, I’d recommend asking some challenging questions. Twenty-five years’ experience in this industry has taught me that the following issues are foundational.

Step 1 – “Why”? Do you want to win a tender, or is a profitable customer pushing you for ISO 9001 or ISO 14001 ? If you business has grown rapidly, Perhaps many of your staff might not understand how the overall business works. So you need properly defined processes and procedures for them to follow, and discipline to make and do things well.

Whatever the reason, (and all the above are perfectly acceptable drivers for introducing an ISO standard), make sure you understand why you’ve made the decision. Getting an ISO certificate can be rapid and inexpensive. For instance, I have implemented ISO 9001 in small, basic businesses with only 2-3 days of my time, where the priority was to respond to a tender which mandated approval of a certain standard.

However, the processes put into place under these circumstances are very basic, and unlikely to be very helpful if the aim is to tighten internal processes and improve consistency throughout the business. Under these circumstances more time is required for a consultant to work with staff and gain their buy-in to the new ways of working. So, a quick fix and a certificate on the wall, or something more?

Step 2 – A Matter of Time. I’m frequently surprised by the number of customers who pay for my services, and then don’t have the time to listen to what I have to say, or adopt the “best practice” which they tell me they want in their businesses. Even if you have excellent, disciplined processes already in place within your business, gaining certification WILL need some of your time, as what you put in really does have a bearing on what you get out.

Step 3 – Take Up Modelling. Are you ready to be  SEEN to support and apply the system? If you pay mere lip service to the new Quality Management System, then revert to your old ways of working (whenever your consultant or auditor isn’t looking), your staff will notice. They will not take something seriously if you don’t “model” it. If you want the correct process followed, make sure you do yourself. If you want something checking before you ship it, don’t push your staff to despatch everything they can find on the last day of the month just to get the figures up.

Step 4 – What Gets Measured Gets Done. What do you want to achieve in terms of Quality or the Environment? Your policy MUST be underpinned by measurable objectives, which, I’ve observed, most senior management teams struggle with. Reflect on whether your business is getting too many customer complaints, or too many returned products. Have your neighbours moaned about the noise from your machines or the Environment Agency your emissions? What are your big issues? And how can you measure improvement? This is a great driver for real measures within a “standards” framework. No consultant will be able to dream up such actions – it needs a knowledge of the business, and the real problems which it faces every day. Which only you have.

Step 5 – Give me a call! ( I understand there are other consultants but you should really go for the best… ), I’ve been working in ISO systems for over 25 years, with some of the largest employers in the UK, and many of the smallest. In many different industries, from telecoms to pharmaceuticals, nuclear power generation to web site production, software engineering and basic fabrication. And I began my career on the shop floor in Nottingham, so know industry literally from the ground up. There’s much to tell, and I’d love to help.

In my role as an ISO Consultant, I’ve been delighted to observe many an ISO internal audit done very well indeed. The value added to the business, both by doing better business, and not having to engage a consultant to sort out messes, is significant. When Internal Auditing works, it works very well indeed.

Yes, you’ve guessed it. When it becomes dysfunctional, it really does do some damage to the long-term willingness of the enterprise to engage with the standard. And it wastes staff time simply due to a task being conducted badly. Then there’s the cost of additional days of an ISO Consultant’s time in putting things right. Now, I don’t really mind the latter, as it helps to underwrite my wife’s shopping habit, but it certainly does distress my professional conscience. It really does not have to be like this.

So, some points on what goes wrong.

1. Utilising staff that do not believe in the value of the standard (and need for audit) value.
2. Not making senior Management aware that you add value.
3. Simply reiterating old audits to “tick boxes”. Audits need to change with the business.
4. Issuing out of date, over-long, factually-incorrect, over-detailed and generally non-user-friendly reports.
5. Focussing on insignificant problems, rather than broader, more business-critical issues.
6. Lack of quality communication (minimal rapport, outward suspicion) with those audited. This includes lack of informal socialising!
7. Audit team not truly understanding the areas of the business they are auditing, including technical, regulatory and current industry sector issues.
8. Re-auditing after an external audit, again to tick an (irrelevant) box (No need to redo work that has been done by others.)
9. Lack of professional standards in punctuality, dress, protocol, use of time.
10. A “hit and run” approach – not following through on actions. Not being available or responsive.
11. Not sharing and explaining audit tools, such as flow charts, walk-through documentation, key performance indicators, etc.
12. Having reports that are negative and destructive in approach and tone.
13. Not attending business strategy meetings.
14. Transferring blaming, declining to take ownership of issues.
15. Finishing audits even if they don’t need finishing, such as when you have already determined key controls are working.
16. Having no team personnel turnover. No new blood – or thinking. Or…
17. Having too little experience or continuity.
18. Hiding behind distance and independence and not adding value via “team participation”
19. Monitoring the wrong KPIs (key performance indicators).
20. Not continually educating Senior Management about the top inherent areas of exposure, as well as residual risks.
21. Being a data-provider not knowledge-provider. An Internal audit adds value through application of findings, not just by supplying findings alone.
22. Not “selling” the audit across the organization via every possible means. Talk to key stakeholders!

 

And I pose the following tough but revealing question; if you had been a client, would you have paid for your last audit?

It really does not need to be this way. We have some experience in this area If you need help, please drop us a line

Written by Colin Brown of ISO Consultants

What can you compare the job of ISO Consultant to? Occasionally, it seems a very strange job, running an ISO Consultancy. There are parallels with being a vicar, priest, or miscellaneous other minister of religion. Now, I wouldn’t say that being an ISO Consultant is a holy calling of The Almighty. However, in trying to interpret rules and standards from “on high” to a practical, workable scheme of things, like ISO 9001, and getting folks to embrace it in their daily working lives, there are great similarities.

And then there are the continual challenges of common misconceptions. Put simply, “myths and legends” that don’t really have much to do with the true essence of what ISO Standards are all about. Here are ten of them:

1. You can tell a good Quality/Environmental/Health and Safety System document by its weight/thickness.

No. “Less” is often “more”, providing it makes a difference to your business.  It helps you meet your business objectives. Usually, concise systems are more effective.  Because people are more likely to read, understand, and follow them.

2. Implementing an ISO based system, such as ISO 9001, is a major project and means you have to change the way you run the business.

Generally “No”,  but there are usually a few things to be changed. All companies have “processes” , even if these aren’t documented. A good ISO-Based Quality Management System should be written around how you already do business, not consist of alien practices inflicted to get you through the certification. Your business is unique, and the ISO system needs to be based around that uniqueness. Protecting, nurturing and helping it grow. In short, it’s purpose is to support and formalise the good bits of what you’re already doing well, rather than impose badly-fitting bureaucracy.

3. The Quality/Environment/Health and Safety Manager is responsible for Quality/Environment/Health and Safety, and lives in their own world. Meanwhile, the rest of us get on with running the business profitably.

No. This might be acceptable if we lived in a world with no fines for breaking laws, and accidents never happened. However, in this area there are very serious implications for non-compliance. So ideally, there shouldn’t be anybody in an organisation whose operations aren’t affected by them. In successful companies, with well-designed ISO systems, no-one should be able to notice that they are actually working to a standard. They should truly be part of “business as usual”. It’s safer (and cheaper) that way, too.

4. All these quality systems are just government bureaucracy and don’t do anything for the business.

This is closely related to myth three (above) Although backed by governments internationally, properly-written business-focused standards should help, not hinder companies. A good Quality Management System should help you be more efficient and consistently meet your customer’s requirements. Environmental health and safety systems, although protecting your staff and surroundings, should also help you avoid large fines, some of which could be large enough to threaten the whole future of your business. Properly-implemented, they should lead to contented customers, more efficient activity, and better business.

5. Quality systems are really just about controlling documents. Therefore, if in doubt, sign everything.

Perhaps in the past, quality systems in particular were over- focussed on documentation. But changes over the last 10-15 years have aimed them much more at improving effectiveness and efficiency. That said, the control of information within a business remains important, and for good reasons. You can’t manage without documentation, but it should serve the business, rather than the business serving it.

6. We can hide our problems areas. If you manage the auditors properly, you can keep them in the Quality Managers office all day.

Being clever with the auditors and keeping them away from problem areas may be a crafty and useful tactic in the short-term. But if your systems are really any good, then you shouldn’t have problem areas that you aren’t addressing. However, if you do have weak areas, then honesty really is the best policy. If you are taking action to improve things, then auditors should respond positively, and letting them see what you’re doing can be positive for two reasons. Firstly, they know you are committed to improvement. Secondly, having seen lots of similar situations before, they may actually be able to offer advice. This is the “auditor as business improvement consultant” approach, and is highly effective.

7. It’s always best to keep your mouth shut and only give the minimum of information to the auditors.

Yes, but don’t expect to get a lot out of the audit if you don’t put much in. Make some more words up !

8. The auditors are only looking for reasons to fail you.

Funnily enough, in over 20 years’ experience of this environment I’ve rarely found an auditor who just wants to fail people. This is their job, day-in, day-out, and very few people can be so negative for so long. However, if you really don’t get on with your auditor, then change him. If the certification body aren’t helpful with this, then change them too. There are around 120 certification bodies in the UK so you have plenty of choice, and they all take very kindly to people changing from their competitors, so you might even find a lower cost alternative.

9. Environmental systems just increase your operating costs.

An Environmental Management System (EMS), such as ISO 14001, should not be about tree hugging and love for little furry animals. It’s no longer a PR-friendly “nice-to-have” marketing tool, but should be make very sound business sense. And why? Breaking environmental law now has very expensive consequences. It could even be enough to push you into liquidation. Ignorance of the legislation affecting your operations is no defence, so having a good environmental system which is properly maintained should keep your business lawful, and you out of jail. Yes, and I really do mean “jail”

10. If you get one well written set of risk assessments, then you’ve addressed your Health and Safety requirements, and the staff can carry on as normal with their everyday jobs.

Health and safety systems are now a commodity like most other things. If you just want some risk assessments then you could buy them in. But the value of such systems is in them being applied to real business life. Do you really want your staff knocking holes in walls without checking if there are mains cables hidden in the plaster, or driving stacker trucks without being trained ? Health and Safety isn’t a matter of documentation. It should be a matter of practice, though documentation and records are, unfortunately, required.

If you’ve read this far, then you’ve got a good idea of how I work.

Hopefully, you will get some idea of the challenges of being a ISO Consultant. There is an art in keeping compliance and business success in tension, which involves large amounts of both technical comprehension and hard-won common-sense. After over twenty years in the industry, and having advised many types and “flavours” of enterprise, I suspect that I may have at least a few things to offer to your organisation. And I’d be happy to “bust” a few more myths that I’ve not mentioned here.

So, if you need more plan-speaking from an ISO consultant, please be in touch!

I received a call from a prospective customer. who explained that he’d bought a business which held an ISO 9001 certificate from a reputable certification body.

However, he’d identified that discipline within the business wasn’t good, and that most of the staff were unaware of their operating processes. But although business had a “sloppy” feel, the product range had potential and sales were reasonable.

He had a discussion with the company’s Quality Manager, who tried to quell his fears, proudly producing a set of internal audits. So everything seemed fine. The certification body visited the next week, audited through the business, gave it an all clear and left. So all was well. Or was it?

“But I know the system doesn’t work and the staff don’t know what’s in their operating procedures so can’t be following them ! ” he said to me.

Yes indeed. I often ponder why don’t other people ask this. How do we make ISO9001 truly work?

ISO 9001 provides tools that ensure consistent products and services are provided to a set cost and standard. It offers a process for managing longer term business improvement, helps to change cultures and can instil disciplines and consistent processes. However, many ISO certified companies see their newly-acquired standard as an end, not a beginning. Having the tools does not get the job done. Only using them does.

So back to my prospective customer and his “approved” company with little sign of “Quality”. He’d probably just managed to escape having the ISO 9001 certificate removed by the certification body if things were really as bad as he suggested. But if the system wasn’t delivering because the tools had stayed in the box.

There is overwhelming evidence that the processes which ISO 9001 encourages WILL deliver business improvement, so if they aren’t doing it in your business then it must be something to do with the way you are using them – a saw is always a saw, it will always cut, though if you leave it hanging on your shed wall, it might as well be a blunt pen knife.

An ISO 9001 management system WILL, for example, provide a certificate which should get you through many high-value tender adjudications. Beyond that, it will also provide a framework for continual improvement, encourage the establishment of business measures and metrics, formalise internal processes and procedures and drive consistency in their output. But you need to see the system and the principles behind it as more than a certificate that means you can tender.

So what happened to my gentleman? I explained how the system worked and suggested he start by aligning the Quality Policy and its objectives with his Business Plan. It’s then up to him whether he uses the tools he has or keeps the box firmly shut.

I hope he uses them, we need more British businesses which are strong, innovative and improvement based.

 

Written by Colin Brown of ISO Consultants

The whole Bring Your Own Device (BYOD) trend seems to be “the perfect storm”, but perfectly addressable through the security issues ISO 27001 addresses.

However, a quick Google reveals some interesting and disturbing statistics.

75% of IT directors see BYOD as their major threat.

60% (or more) of all employees are using their own devices at work.

33% see absolutely no problem with doing this in respect of security risks.

Occasionally I wake up in the morning and thank God that I’m not a head of IT. The implications of a breach of security in terms of damage to corporate image, customer relations, and ultimately revenue don’t bear consideration. Or do they?

Now, I’m in the quality standards business, so you may be slightly ahead of me here in thinking that I’m matching this threat with something I offer as a service, and this piece is simply a long advertisement. Well, actually, you’d be quite right. Implementation of the ISO 27001 security standard can be a significant weapon against the very real threat.

Some Suggestions:-

1/ Face The Problem. It’s going to happen anyway, driven by the device market. I’m regularly amazed that many corporates believe that BYOD is a social media-driven fad. The whole business of implementing standards, including ISO 27001 is based around application of agreed standards of honesty and (occasionally painful) reality.

2/ Face The Opportunity. A lot less PCs to buy, software upgrades to tackle, and productivity benefits of mobile working across the enterprise. And the chance to spring-clean your IT security policies at the same time.

3/ Have a Strategy. It’s not hard, but it is necessary. BYOD needs fair policing across the business, otherwise inequalities develop and cyber-anrchy may follow. Remarkably, many do not have a plan. See below.

4/Have a Overall IT Strategy. If you’re sorting this particular challenge out, you might as well set policies, standards and procedures across the whole of your IT activity.

5/ Have a Holistic Vision of The IT Function. ISO 27001 security isn’t actually about IT, but systematic management, which embraces many functions and areas of responsibility. Specifically for BYOD, there are (or need to be) HR, security and legal implications, which will have organisation-wide implications.

6/ Make Policies and Procedures Simple. Less fuss and hassle means buy-in from employees is more likely. A well-written and researched overall ISO 27001 security policy should serve the business, not the other way around. Willing cooperation and adoption comes easily when the rules are easy and everyone knows them. Nothing breeds non-compliance faster than complexity.

7/ Review and Amend. The ISO 27001 security standard should include a process to monitor, evaluate and alter, otherwise it becomes static and irrelevant. It’s a start, not an end. The IT function is likely to be the most dynamic in the company, and hence a regular audit should be made part of the overall procedure. Reviews should seek to simplify rather than supplement and complicate.

8/ It’s Not Just a Security Issue. As the BYOD ”challenge” becomes more of a major issue, potential customers are likely to expect it before they release their commercially-sensitive data to you. There are key commercial benefits of holding ISO 27001.

So, it’s not difficult to be ready for the issues that are rapidly emerging, neither is it expensive. And it may just benefit many other areas of your business….

 

Written by Colin Brown of ISO Consultants