Back to basics – ISO 270011 min read

As new regulations continue to be implemented and the cyber security landscape reacts to data breaches and world events, it is helpful to reacquaint yourself with security measures you may already have in place.

Many organisations will be familiar with ISO 27001, an international standard set up by the International Organisation for Standardisation and the International Electrotechnical Commission. ISO 27001 is drawn from the ISO 27000 series of standards, all of which aim to provide organisations around the world with auditable and actionable frameworks for information security. ISO 27001 specifically concerns setting up an information security management system, or ISMS.

To become ISO 27001 certified, an organisation must demonstrate to an independent auditor that it has effectively implemented policies and procedures to efficiently mitigate and counter information security risks, including but not limited to hacks and theft. This certification is considered a global benchmark for an organisation’s cyber health, protecting it not only from cyber attacks, but also from some negligence fines in the case of an unforeseeable cyber event. Audits and reviews will be conducted at regular intervals, ensuring that your organisation maintains its level of cyber health.

It is not obligatory to become ISO 27001 certified – even using the basic framework it provides will help you maintain compliant to regulations such as GDPR. However, you might find that it is helpful for your organisation to have a clear structure for information security in place, and an incentive to maintain it when audited regularly.

Ultimately, the basics of information and cyber security lie in having an effective system that identifies, analyses and manages your risks, which is why using a solution like CyDesk can help implement the structures put in place by ISO 27001 – whether or not your organisation is certified.