How ISO 27001 certification can help secure your business’s information

The ISO 27001 information security standard has existed since 2005. Developed by the International Organization for Standardization (ISO) in conjunction with the International Electrotechnical Commission (IEC), it enables companies to plan and implement an approach to managing the security of their information systems.

“Recently, the demand for ISO 27001 certification has been exploding,” observes Isabelle Ledoux, Senior Business Advisor, BDC Advisory Services. This upsurge in interest by businesses for information security coincides with a series of information management system breaches and high-profile cyberattacks on large and small organizations.

“Businesses are realizing that they can no longer neglect information security,” says Ledoux, who assists entrepreneurs who wish to obtain 27001 certification.

What is the purpose of ISO 27001 standards?

Implementing security standards helps you manage the security of your most sensitive assets, such as:

• Financial data
• Documents concerning intellectual property
• Personal data
• All the information you need to run your business smoothly

The most common risks to data security are phishing attempts and ransomware. In the first case, hackers steal your usernames and passwords using fraudulent emails that look legitimate. Ransomware is software that blocks access to data and hardware. Hackers demand a ransom for you to regain access to your data.

ISO 27001 certification requires the company put in place mechanisms to ensure information security and to develop a continuity plan that details how it will maintain operations in the event of a cyberattack. What are the potential risks? What to do first? “We rank the risks, starting with those that have the largest impact on the company,” explains Isabelle Ledoux.

“It doesn’t prevent you from being hacked,” she acknowledges. “But it targets good practices and establishes solid contingency plans.”

5 steps to obtain ISO 27001 certification

1. Assess what is already in place

“Before we even start the certification process, we begin by taking stock,” notes the business advisor. “We assess what’s already in place.” A series of audits ensures that processes and systems are working.

“Unless you have the internal expertise, we recommend that businesses consult experts who are familiar with the standard’s requirements,” says Ledoux.

2. Establish the scope of the certification

Next, your company must establish the scope of the certification. A document containing more than 100 questions allows you to define risks, establish priorities and re-evaluate certain processes.

Obtaining certification makes it possible to redefine the broad outlines of existing mechanisms and identify the interactions among processes. It looks at all external and internal security threats and links them to your business objectives and key performance indicators.

Your business needs to be resilient on all IT security front. “Imagine protecting customer data while leaving your IT infrastructure open to ransomware,” says Ledoux. “With ISO 27001, this type of scenario would not even arise because it requires you to protect your business and your customers.”

Once it is obtained, the certification must be maintained. To do this, the business needs to demonstrate the effectiveness of controls, including through annual internal audits, vulnerability assessments and penetration tests.

3. Establish your management framework

More specifically, certification provides an IT security management framework for the entire organization. It covers practices, sound management and the establishment of responsible behaviours that are documented, repeatable and can be continuously improved. From private data processing to confidential information, including personal data, transactions, technical drawings, business plans, banking information and legal documents, ISO 27001 covers all aspects of information.

For example, the certification defines the security standards to be adopted when an employee leaves the company. It establishes guidelines for recovering their materials, terminating their access, managing passwords and preventing malicious acts.

4. Train your team

In order for all this to happen and for your company to benefit from ISO 27001 certification, you must also rely on qualified internal resources. That is why certification cannot be achieved without comprehensive and in-depth training of your staff who will be responsible for information security and compliance. ISO 27001 is a general standard, and with the right training of your key employees, it can be adapted to your company.

5. Get your company certified

Only an external agency can certify your company. There are multiple accredited registrars. Your company must make a three-year commitment to the certification agency of your choice. BDC Advisory Services can help you demystify the submissions and assist you in your certification process.

An advantage for selling abroad

“When you are 27001 certified, you are in a good position for international standards,” concludes Isabelle Ledoux. “Europe, Japan and the United States all have different standards.”

There are about 30 confidentiality laws around the world.

New government confidentiality regulations introduced in recent years, such as the European Union’s General Data Protection Regulation (GDPR) and the California Consumer Privacy Act, are forcing companies to act.

More and more organizations in the supply chain are requiring ISO 27001 registration, and in some countries, such as Japan and India, it is even a legal requirement.