What Is ISO 27001?
ISO 27001, also known as ISO/IEC 27001, is a widely recognized international standard that defines best practices for implementing and managing information security in an Information Security Management System (ISMS).
Since it was first developed, the goal of the standard has been to provide a model for establishing, implementing, operating, monitoring, reviewing, maintaining, and improving an information security management system.
The risk-based standard was published by a joint technical committee comprised of the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) in 2005 but has been revised since then, including in 2013 and most recently in 2022. That version, released in October, is known as ISO 27001:2022.
Who Needs ISO 27001 Certification?
While ISO 27001 is not mandatory, it is viewed as a best practice for any organization that wishes to protect its critical data and comply with rapidly changing data protection laws and regulations. Accepted in 168 countries, it is particularly favored by companies that handle sensitive data, such as healthcare firms, financial services companies, and government contractors.
The ISO 27000 Series: ISO 27001 vs. ISO 27002 vs. ISO 27003
ISO 27001 is part of the ISO 27000 family of standards, designed to help organizations secure information assets, including employee data, customer data, intellectual property, contracts, financial data, and other sensitive information.
ISO 27001 is a body of certification standards for managing Information Security Management Systems (ISMS) in a way that keeps confidential information safe and adheres to the CIA triad (Confidentiality, Integrity, Availability).
ISO 27002 focuses specifically on controls; their implementation, design, and purpose as they pertain to achieving the standards set forth in ISO 27001.
ISO 27003 dives deeper into how to implement an ISMS according to ISO 27001 and covers everything from gaining management approval to planning your ISMS project.
While ISO 27001 is an internationally recognized set of certification standards, ISO 27002 and ISO 27003 are bolstering “how-to” support guidelines; the “how” to ISO 27001’s “what.” Note that accreditation is only possible for ISO standards ending in “1.”
What are ISO 27001 Requirements?
ISO 27001 requirements consist of two sections: clauses and controls.
Clauses
ISO 27001 clauses outline recommended processes for building out an ISMS. These 10 clauses specify requirements around:
- information security policies
- organizational roles
- leadership and commitment
They Include:
- Terms and definitions
- Process approach impact
- Plan-Do-Check-Act cycle
- Context of the organization
- Leadership
- Planning
- Support
- Operation
- Performance evaluation
- Improvement
Controls
ISO 27001 controls help organizations protect their information and information processing facilities by preventing unauthorized physical access, damage, and interference. Located in Annex A, these 93 controls are divided into four areas:
- People (8 controls)
- Organizational (37 controls)
- Technological (34 controls)
- Physical (14 controls)
The most recent version of ISO 27001 incorporates 11 new controls:
- Threat intelligence (A.5.7)
- Information security for use of cloud services (A.5.23)
- ICT readiness for business continuity (A.5.30)
- Physical security monitoring (A.7.4)
- Configuration management (A.8.9)
- Information deletion (A.8.10)
- Data masking (A.8.11)
- Data leakage prevention (A.8.12)
- Monitoring activities (A.8.16)
- Web filtering (A.8.23)
- Secure coding (A.8.28)
The Benefits of ISO 27001 Compliance
The greatest benefit of aligning with ISO 27001 standards is knowing your information assets are protected against modern cyber threats by internationally recognized security standards. Other benefits include:
- A strong brand reputation. Customers may not know you comply with ISO 2701 requirements, but they will know you haven’t been in the headlines for a data breach.
- A competitive advantage over organizations that are not ISO 2701 certified. This is particularly significant when selecting supply chain partners, as ISO 27001 compliance, while not mandatory, demonstrates an enhanced level of cybersecurity vigilance.
- Audit protection as you can ensure your sensitive data and its systems are protected by international information security management standards that are bound by the CIA triad.
- Compliance with ongoing industry, legal, contractual, and regulatory requirements.
- An improved risk management posture that can accelerate your cyber maturity, future-proof your information systems, and help you gain a more transparent view of your cyber readiness.
- A head start on other widely recognized security standards such as the GDPR, the CIS Controls, and NIST CSF. The ISO 27000 Series shares common threads with all three.
7 Steps to Achieving ISO 27001 Certification
Organizations are required to pass a series of external audits to achieve the internationally recognized ISO 27001 certification. The three-year certification window for ISO 27001:2022 ends on October 31, 2025. Companies moving from the 2013 standards will need to transition fully by then. Here are seven steps to help you prepare for a successful audit, along with what you need to know at each phase of the certification process:
Phase 1: Settle on Basics
Who is project managing? Will you hire an ISO 27001 consultant? What are some important milestones? Who are the stakeholders? This goes without saying, but at least one representative from every affected department should be involved, and you need a C-suite champion.
Phase 2: Define the scope of your ISO 27001 certification
Your ISMS can protect all the data in your business, or only a small part. Decide what you want yours to do, and then build accordingly. You may also want to consider which product or service your customers would most want to see protected by your ISO certification.
Phase 3: Baseline and Gap Assessment
Determine the current state of your security fortifications. How far away are you from your ISO 27001 goals? You can use an in-house team or outsource ISO 27000 assessment services.
Phase 4: Policies and Controls
Now that you know both your weak spots and your available resources, align on which risks must be addressed and which can be tolerated. Allocate resources accordingly. You’ll also need to produce a Statement of Applicability outlining which ISO 27001 controls are relevant to your organization, and a Risk Treatment Plan to outline how your organization will respond to identified threats.
Phase 5: Train Employees
Employees must be trained on information security, per ISO 27001 requirements. A Security Awareness Training (SAT) program can help get your workforce on the same page and ensure future success and cooperation with new ISO 27000 SOPs.
Phase 6: Assemble the Evidence
Prepare for your certification audit by collecting all the relevant paperwork and documentation. Organize evidence of your ISO 27001-compliant efforts and be prepared to prove the effectiveness of your policies.
Phase 7: Complete an ISO 27001 Compliance Audit
A certified ISO 27000 auditor will determine whether your ISMS is built to ISO 27001 security standards. In Stage 1, documentation will be reviewed. During Stage 2, security controls and business processes will come under scrutiny.
A passed audit will result in your ISO 27001 certification, valid for three years.
How Fortra’s Data Classification Suite Supports ISO 27001 Compliance
Under ISO 27001 requirements, organizations must properly organize their data prior to protecting it, as specified in the following controls:
- 5.12 Classification of Information | Information must be classified to preserve confidentiality, integrity, and availability.
- 5.13 Labelling of Information | Information must be labelled according to classification.
How you classify and label data determines how your policies will protect that data in the future. For that reason, data classification and labelling are the fundamental precursors to information security. This step cannot be wrong. With data entering your organization at all times, you must also be able to scale and develop a system for sorting and assigning information into the right categories on a regular, consistent basis. This takes integration, visibility, and a program of policies that will form the foundation of all future information security projects, ISO 27000-related and otherwise.
Fortra's Data Classification Suite helps organizations systematically manage and protect their information assets, ensuring they meet the comprehensive requirements of ISO 27001. With Fortra, your team can better identify, classify, and secure sensitive data pursuant to ISO 27001 standards. By implementing the fundamentals of data classification, you will be able to build a secure, scalable information security management system, and lay the groundwork for maintaining adherence to domestic and international compliance standards both now and in the years to come.
For more information, talk to one of our Fortra experts today.
Using Data Classification To Support ISO 27001 Compliance
Learn more about why data classification is an essential part of an information security system and how Fortra’s Data Classification Suite can help your organization in ISO 27001 certification.
