ISO 27001

what is ISO 27001?

ISO 27001 specifies the management of Information Security. Applicable to all sectors of industry and commerce, it is not confined just to information held on electronic systems, as a number of people seem to believe, but addresses the security of information in whatever format it is held.

Information is now globally accepted as being a vital asset for most organisations and businesses. As such, the confidentiality, integrity, and availability of vital corporate and customer information may be essential to maintain competitive edge, cash-flow, profitability, legal compliance and commercial image. ISO 27001 is intended to assist with this task. It is easy to imagine the consequences for an organisation if its information was lost, destroyed, corrupted, burnt, flooded, sabotaged or misused. In many cases it can (and has) led to the collapse of companies.

ISO 27001 is part of the ISO 27000 series, the generic name given to a family of international standards developed to provide a framework around which an information security management system can effectively be implemented. These standards are given below:

• ISO 27000 – ISMS Introduction & Vocabulary
• ISO 27001 – ISMS Requirements (revised BS 7799 Part 2:2005)
• ISO 27002 – Code of practice for information security management
• ISO 27003 – ISMS implementation guidance
• ISO 27004 – Information security metrics and measurements
• ISO 27005 – Information security risk management
• ISO 27006 – Requirements for bodies providing audit and certification of information security management systems

Benefits of ISO 27001 Certification

Gaining certification from a UKAS accredited certification body demonstrates that the security of your information has been addressed, implemented and properly controlled. But the benefits don't stop there:

• Customers, employees, trading partners and stakeholders are comforted in the knowledge that your management information and systems are secure.
• Demonstrates credibility and trust.
• Cost savings – even a single information security breach can involve significant expense.
• Establishes that relevant laws and regulations are being adhered to.
• Shows that a commitment to Information Security exists at all levels throughout an organisation.