ISO 27001 and Why It Matters For Your Organization
When I first began considering a career with Schellman, I began to dig through industry jargon to familiarize myself—my background was in nonprofits, and there was a lot of new information to parse through, including many, many acronyms. Among those that I discovered was ISO, an abbreviation that up to just a few months ago, was lost among others like NBA, NCAA, and TSLA that some might argue are more important. When I initially learned, more specifically, of ISO 27001, I had no clue what it meant, but I’d eventually discern that this certification was the one that potentially could change the course of my professional career. Throughout my extensive research, it was the unique nature of ISO 27001 that was among the important gems I discovered that would eventually draw me into the industry.
What is ISO 27001?
At a basic level, ISO/IEC 27001:2013 (ISO 27001) is a management system framework for an information security management system (ISMS) that a company can be certified against by conforming to the ISO 27001 standard. Structured primarily around how a company manages information security and its related risk, this standard is a powerful one, as almost every company in the modern age now “manages information security” of some sort. Though technology companies may seem like obvious candidates to pursue certification against this standard, ISO 27001 can surprisingly also apply to your local YMCA just as readily, as well as other, larger sectors such as law firms, financial institutions, and research companies.
Should an organization wish to actually obtain this certification, an independent certification body like Schellman must conduct an ISO 27001 audit. Said audit examines the management system of a company to determine its conformance to the standard and how effective it is in securing information—then, if the ISMS in question meets the requirements, certification is achieved.
How is it Different?
But why would an organization seek this certification? What sets ISO 27001 apart from other compliance standards? There are a few reasons, in fact.
Most predominantly, ISO 27001 suggests a more holistic approach to managing an organization’s information security risk. Per ISO/IEC 27001:2018 (ISO 27000), a management system is defined as a “set of interrelated or interacting elements of an organization to establish policies and objectives and processes to achieve those objectives”—in the case of ISO 27001, those referenced objectives relate to information security. At Schellman, our ISO practice methodology similarly separates the “elements” of ISMS into policies and procedures, as well as a people component, examining how all of these interrelate to ensure effective information security risk management. And while the baseline of a trustworthy company is sound policy and procedure, we recognize that those do not mean much if the necessary people are not following said policies and procedures. ISO 27001 separates itself from other audits because it also puts a different, more prominent focus on relevant human factors and how they may put company information in danger in the same way lacking policies and procedures can.
Leadership, risk management, process review, and performance evaluation are just some of the additional areas covered in ISO 27001, and as such, it is hard to find a hole within the standard if it’s applied correctly. A proper audit allows a company to see things from a birds-eye view, but does not miss the persons on the ground actively carrying out the system’s everyday functions, and because ISO 27001 touches on so much, it makes a healthy boon for an organization truly aiming for an independent review on conformance and the effectiveness of information security risk management.
Why Should a (or your) Company Care?
Though most consumers place little value on such certifications—it’s highly unlikely that anyone chooses their next iPhone because it is covered by an “ISO 27001” certified ISMS—their real value in lies company-to-company in the increasingly global market. To put it succinctly, organizations trust other organizations that have gone through this certification. Information or data is likely safer when processed through ISO 27001-certified companies as opposed to non-ISO 27001-certified companies because it means that the processes, procedures, and people are in place to help ensure that safety. Moreover, because this certification is valid for three years before renewal, ISO 27001 becomes a commitment to information management security, which is good for business. Consequently, it’s no surprise that the number of ISO 27001 certifications in the United States continues to grow—the latest number from the ISO survey notes that 758 certificates were maintained in 2019—and since this charge is being spurred by industry leaders, we should only see that number increase.
Perhaps the most telling sign of the impending importance of ISO 27001 is the global recognition of the certification. According to survey statistics from 2019, the U.S. ranks just 9th against other countries across the world in ISO 27001 certifications—China (8356 certifications), Japan (5245 certifications), and the United Kingdom (2818 certifications) make up the top three, followed closely by India, Italy, Germany, the Netherlands, and Spain, respectively. While an ISO 27001 certification can surely promote internal organizational maturity, those numbers imply more business within the international community as a whole, meaning any company with global aspirations should probably consider ISO 27001 certification in the near future.
Should your organization be one of these, and you desire more information regarding the details of ISO 27001 or would like to pursue a certification, please contact Schellman, as our team members are eager to help with anything regarding this unique compliance space—and that includes me.