Managers who claim that their organizations comply with ISO/IEC 27001:2005 but that they see no need to go through the bureaucracy of getting the ‘badge on the wall’ are only deceiving themselves. The reality, I suspect, is that the vast majority of organizations that won’t submit their Information Security Management Systems (ISMS) to an external audit against ISO 27001, fear that, when it comes to the push, their systems would fail the test.
Survey after survey tells a depressingly familiar information insecurity story. Most recently, the 10th annual CSI/FBI survey revealed that, amongst the security-conscious, information security control-focused members of the CSI, computer crime continued to have a significant financial impact. The average incident last year cost $204,000, and the top two security breaches were through virus attacks and unauthorized access - both of which are comprehensively controlled through the controls and management systems mandated by ISO 27001.
ISO27001 Effectively Manages Data Security
This evidence, combined with the findings of a recent survey carried out amongst UK-based organizations that ISO27001, suggests - somewhat contradictorily - that securing information is rarely the primary driver for achieving certification. The top reason was commercial advantage, summed up by one respondent who said that a certificate ‘gives customers confidence that our data security is well managed and certified by an independent source.’
And it’s that certification ‘by an independent source’ which is the real benefit of pursuing ISO 27001 in the first place. US regulators implicitly recognized the importance of external validation for information security effectiveness when they observed that: ‘the best way to strengthen US information security is to treat it as a corporate governance issue that requires the attention of boards and CEOs.’
Achieve High Security Standards through ISO 27001
There are sectors in which the ‘badge on the wall’ debate is already history, and in which certification is now becoming a basic business requirement. UK cheque printers, for instance, are required to comply with a sectoral version of ISO27001 and suppliers to the NHS are expected to be on track for certification (there is now a health sector version of ISO17799) - even if the NHS itself still has some way to go. Business Process Outsourcing companies are finding it much simpler to provide a copy of their ISO 27001 certificate in their tender documentation than to answer detailed information security questionnaires.
Source: http://EzineArticles.com/?expert=Alan_Calder
Subscribe to:
Post Comments (Atom)
1 comment:
The iso27001-certification team works with your organization to successfully design, plan, implement and maintain an ISO 27001 Training. Each certification project is unique; our team limits engagements, maintaining a greater focus in order to guarantee a successful certification and an effective ISMS. The following services have been developed for our customers and can be custom tailored for each engagement:
Post a Comment