Cheat Sheet
ISO 27001
Can a single IT security standard apply to all businesses? Steve Cassidy explores an exacting certification scheme
I’m certainly aware of ISO 27001, but what exactly is it?
Simply put, ISO 27001 is an agreed international standard for information security. If you’re 27001-certified, there’s a reasonable chance that your data is more secure than that of someone who isn’t – and that’s something potential partners and customers may find reassuring.
How does a company go about getting certified?
It’s mostly a paperwork exercise, whereby someone reasonably senior fills in a lot of forms on behalf of the business. To do so, however, they not only need a thorough understanding of how information flows around the company, they must also be able to show that suitable management structures and systems are in place. Getting all of this in order can take anything from a few months (for a company that’s already largely shipshape) to well over a year if the business needs to stand up and deploy a new management stack. It’s no small task, which is probably why people go to such lengths to proudly display the ISO-certified logo on their websites, invoices, letterheads and so forth once they’ve got it.