top of page

ISO 27001 Information Security Management System

Cyber security

What is ISO/IEC 27001?

ISO/IEC 27001 for Information Security Management Systems requires organisations to adopt a risk-based thinking approach to the security of all information. ISO/IEC 27001 formally specifies an Information Security Management System, a governance arrangement comprising a structured suite of activities with which to manage information risks (called ‘information security risks’ in the standard).
The ISMS is an overarching framework through which management identifies, evaluates and treats (addresses) the organisation’s information risks. The ISMS ensures that the security arrangements are fine-tuned to keep pace with changes to the security threats, vulnerabilities and business impacts.  ISO/IEC 27001 is not a prescriptive document, rather it is intended to enable organisations to ensure the security of information through physical, organizational, technological and people controls.

​

The new version of ISO/IEC 27001 has been published in October 2022.  There are no major change, but the minor changes on Management Review and the security controls in Annex A.  For those organization who have been certified with the existing version 2013, shall be prepared for the transition of the new version 2022 by October 2025.  

Benefits of ISO／IEC 27001 Certification

The benefits of an ISO 27001 certified Information Security Management System are varied, including:
•    demonstrated due diligence by meeting regulatory and customer requirements
•    meeting international best practice for security
•    meeting tender requirements and stand out from the competition
•    improved reputation and enhanced company profile
•    demonstrated integrity of data to customers, suppliers and other stakeholders
•    reduced risk of fraud, information loss and disclosure
•    increased resilience to cyber attacks
•    prompt detection of data leakage and rapid reaction to breaches
•    reduced costs associated with information security
•    all forms of information, ensuring confidentiality, integrity and availability of data secured
•    ensured workplace confidentiality and improved company culture
•    easily integrated with other management systems.

ISO / IEC 27001 Information Securit Management System (ISMS) Requirements

For the detailed requirement, you can purchase from the website of the International Organization for Standardization (ISO) which develop and publish international standards or its authorities, ISO/IEC 27001 standard requires organisations to show that they:

  • identify information security risks

  • understand external & internal issues, and interested parties, relevant to information security

  • develop an Information Security Policy declaring commitment to information security

  • develop and document the assessment of identified information security risks and establishing controls (risk treatment) based on reference controls documented at Annex A of ISO/IEC 27001

  • develop procedures, work instructions or Standard Operating Procedures (SOP) required to address information security

  • control any outsourcing of information management

  • develop and monitor information security objectives or targets

  • embrace information security risks and opportunities throughout the business

  • ensure staff are competent and understand their information security responsibilities

  • monitor information security performance

  • control information security nonconformances and take corrective action for significant or repetitive nonconformances

  • conduct internal audits of the information security management system

  • ensure senior management review the information security management system.

How can we assist your organization to award ISO/IEC 27001 Certification?

Stage 1: Perform site visit and understand the organizational structure, style and culture of their operations, their existing documentation (e.g. manual, procedures or forms), resources and training you deployed.
Stage 2: Provide ISO requirement training to the responsible top management.
Stage 3: Discuss with the responsible top management to define the responsibilities of staff at all levels in your management system.
Stage 4: Perform information security risk assessment (physical, organizational, technological and people control) of your management system and coordinate with you to prepare the relevant response with associated training, documentation or resources.
Stage 5: Coordinate and define Management Policy and Objective or Goals with you according to ISO requirement
Stage 6: Establish necessary mechanism with associated resources and elaborate your management system documents in order to meet ISO requirement.  We will NOT provide a set of totally separated ISO procedures from your existing procedures that it will cause the difficulty in maintaining your management system or certification renewal.
Stage 7: Implement the approved procedures established in Stage 6 through training or briefing to the concerned staff. Among the trial period, any change is allowed to fit your needs or management style without deviating the ISO requirement.
Stage 8: Provide internal audit training to your audit team and perform the first internal audit with them to your management system together.
Stage 9: Perform management review to ensure your management system conforming the ISO requirement.
Stage 10: Select the certification body for certification.

bottom of page