ISO 27001 Certification - The Benefits and Challenges
- 1. ISO27001:2005 Implementation: Benefits and Challenges 22 November 2011 Han van Thoor
- 2. Subjects discussed: Challenges Managing management and peers Risk Assessment Statement of Applicability Post certification Benefits
- 3. Challenges Manage managers Commitment : Is the implementation done because we have to due to our customers/legal reasons or is there a real security awareness within management ? Finance : Is there a real budget, is there a provision for unforseen costs ? Implementation times: how long do you have ?
- 4. Challenges Manage peers Buy-in : Translate security policies into accepted work practices Managing change : People might have to change behaviour and procedures
- 5. Challenges Risk Assessment Know your assets! Methodology
- 6. Challenges Risk Assessment Methodology What are your Key Business Processes (KBP) What information assets are being used by the KPB's How valuable are the assets Score risks against assets to identify highest risks
- 7. Challenges Example of a methodology (Integrity+Confidentiality+Availability)*(Likelihood)*(Value)
- 8. Challenges Statement of applicability The less the better ?
- 9. Challenges Post- certification Maturing the ISMS
- 10. SME versus Corporate Implementation Cost Complexity Time SME < 6 months € 0 - ?? Simple, few systems, people, direct lines Corporate < 18 months € 0 - ?? More complex, more systems,more people longer decision times
- 11. Benefits Proof of security to third parties (for clients, partners and legal purposes) Competitive advantage: ‘documented quality’ by an independent authority Cost reductions through transparent, optimised structures. Security becomes an integral part of business processes Knowledge and monitoring of the IT risks and residual IT risks Documentation of structures and processes Increased employee awareness of security Evaluation of the organisation’s processes from a security point of view. Prioritising the security of the business operations: business continuity management Globally recognised standard Potential reduction in insurance premiums Referencing the IT process management standard (ITIL) to ISO 27001 Seamless transition from ISO 27001 in management systems to ISO 9000