MTI ISO 27001 Consultancy: Overview
When faced with the challenges of managing information security risks many organisations seek to adopt best practice and the ISO/IEC 17799:2005 Code of Practice for Information Security Management sets out, in practical terms, how the implementation of an Information Security Management System (ISMS) can enable information risk to be managed to an acceptable level.
This internationally recognised Management Standard, or framework, provides the desired level of security assurance, and underpins legal and regulatory obligations for implementing security compliance. It delivers proof that an organisation's control environment is maintained on the basis of continual improvement and designed to defend against the unique, often complex and ever changing threat and vulnerability scenarios facing your business today.
By adopting a properly defined ISMS you acquire the ability to demonstrate that level of assurance to your customers and business partners. You may choose or be forced to meet contractual obligations for security by further seeking formal Certification to ISO:IEC 27001:2005, the specification for Information Security Management which provides independent, external verification that your chosen security framework, or ISMS is effective.
Your ISO 27001 Questions Answered
Q1. What are the elements of an effective Information Security Management System (ISIM)?
An effective ISMS has the following characteristics:
- Executive support
- Embedded into the organisational culture
- Risk-driven and proactive
- Aligned to a strategic framework
- Delivers legal and regulatory compliance
- A robust policy environment
- Supported by active training and awareness
- Solid technical controls
Q2. How can MTI help my organisation to achieve ISO27001?
MTI has a proven track record in helping organisations to fully implement and achieve these internationally recognised Standards, both in readiness for formal Certification and in designing pragmatic yet comprehensive Information Security Management Systems that ensures serious exposures to business information are not left unidentified or unknowingly ignored.
The process we use can be briefly outline as follows:
- MTI determine what the current state of your organisation's information security programme in relation to your unique set of circumstances (security risks). We refer to this as your information security 'baseline'
- We then work with you and your key stakeholders to determine what the ideal desired future state of information security at your organisation should be
- This process makes use of compliance (round-table, workshop driven) and substantive (eyes-on) assessment methodologies, globally accepted best practices and years of experience to benchmark your current security program and determine where future investment will deliver the most effective improvements going forward
- MTI then define a remedial roadmap (or risk treatment plan) that will map the path to the achievement of your organisations information security objectives
Q3. What will my organisation get out of it?
- An Information Security Assessment (ISA): A documented 'drains up' assessment of your current information security baseline against the contextualised requirements of ISO27001:2005, together with an evaluation of your Information Security Policy documentation.
- An Information Security Standard (ISS/SOA): A comprehensive list of applicable information security control objectives unique to your organisation prioritized and chosen to reduce your organisation's unique risk profile to an acceptable level. The ISS will serve as your organisationis information security audit standard which can be evolved into a formal Statement of Applicability (Mandatory output for ISO 27001 Certification) going forward.
- A Strategic Information Assurance Plan (SIAP): A Risk Treatment plan that will close the gap between the current and desired levels of security over a period that may span up to five years allowing your organisation to budget for and address information assurance projects proactively, as well as measure progress over time.
- A Long Term Strategic Partnership: MTI will partner your organisation in a complementary manner and assist you throughout the implementation and remedial action activities and aid your transition from reactive, IT-driven information security processes to proactive, risk driven and business aligned information assurance appropriate for the delivery of your legal and regulatory compliance obligations.
Next Steps...
If you would like more information regarding ISO 27001 Consultancy please contact the MTI security consultancy team to discuss your requirements. You may also be interested in PCI DSS Compliance.