ISO 27001 Information Security Management System (ISMS)
- • An Information Security Management System (ISMS) is a systematic approach to managing sensitive company information so that it remains secure. It encompasses people, processes and IT systems. ISO/IEC 27001 establish best practices of control objectives and controls in the different areas of information security management:
- • This International Standard covers all types of organizations (e.g. commercial enterprises, government agencies, not-for profit organizations). This International Standard specifies the requirements for establishing, implementing, operating, monitoring, reviewing, maintaining and improving a documented ISMS within the context of the organization’s overall business risks. It specifies requirements for the implementation of security controls customized to the needs of individual organizations or parts thereof.
- • The ISMS is designed to ensure the selection of adequate and proportionate security controls that protect information assets and give confidence to interested parties.
- • References to ‘business’ in this International Standard should be interpreted broadly to mean those activities that are core to the purposes for the organization’s existence.
Benefits
• ISO/IEC 27001 certification demonstrates that an organization has adequate controls and procedures in place to consistently deliver a cost effective, quality IT service. ISO 27001 implementation improves / leads to
• Management Understanding of the Value of Organizational Information
• Customer Confidence, Satisfaction and TRUST
• Business Partner Confidence, Satisfaction and TRUST e.g. Handling Sensitive Information of Customers & Business Partners
• Level of Assurance in Organizational Security & QUALITY
• Conformance to Legal and Regulatory Requirements
• Organizational Effectiveness of Communicating Security Requirements
• The certification process can reduce the amount of supplier audits, thereby reducing costs
- Employee Motivation and Participation in Security (Best Practices)
- Organizational Profitability
- Management and Handling of Security Incidents
- Ability to Differentiate Organization for Competitive Advantage
- Organizational Credibility & Reputation
- Ability to Differentiate Organization for Competitive Advantage
• Organizational Credibility & Reputation
