What is ISO 27001?

Key things you should know about ISO 27001

• It is a business standard (not an IT standard)
• It provides a complete approach to information security
• It’s based on the principle of continuous improvement
• It’s a risk based Standard
• The actual standard comprises 2 parts

Reasons for implementing ISO 27001

• Quite simply, it is one of the most cost-effective means of protecting your information, i.e. the mandatory risk assessment allows you to make informed decisions about what controls/ measures to implement and avoid unnecessary ones!
• ISO 27001 takes a holistic view to identifying all types of information including digital, hard copy, personal, company, financial etc as well as taking a holistic view to assessing threats from cyber to poorly trained or unaware staff or ineffective procedures and processes
• It embeds good practices into your organisation and enhances your culture
• It provides reassurance to your clients and other key stakeholders that you take information security seriously, particularly when you handle their data. Certification provides a significant extra level of reassurance
• The information security management system (ISMS) central to ISO 27001 allows you to constantly adapt to the changing business and threat landscape. The focus on continual improvement, monitoring, auditing and correcting ensures controls are constantly updated and work effectively
• It helps not just in minimising the risk of security breaches but helps you manage incidents and recover more quickly.
• Ultimately, ISO 27001 helps protect your reputation and adds value to your business.

So, why you should partner with URM

Here are a few reasons:

Experience and expertise – We are able to ensure that you gain maximum benefit from implementing ISO 27001 by virtue of our experience, i.e. we have assisted over 400 organisations to achieve certification to the Standard. Our senior consultants have extensive experience as both subject matter experts working at a senior level within a business and in their role as consultants advising organisations on best practice to understand what works and what doesn’t and what´s the best approach to take.

Risk specialists – Without strong risk management, you are literally making decisions in the dark on which information security controls need to be prioritised and implemented. URM can assist you in developing your risk management capabilities through consultancy, our purpose designed risk assessment tool (Abriska) and through our training courses.

With the training, you will not only be able to develop your risk management skills but are also gain a practitioner certificate to demonstrate your competence.

Knowledge transfer approach – Central to our consultative approach is the goal to help you become totally self-sufficient, i.e. for you to develop your in-house expertise and competencies. Our consultants are heavily involved in delivering public training courses so come armed with the knowledge transfer skills for you to learn not just what to do but why and how.

Assurances – Our consultancy services come not only with a 100% certification guarantee but with the assurance that any implemented ISMS will be tailored, appropriate and sustainable. Any major nonconformity attributable to work completed by URM will be corrected free of charge.  A wide range of case studies is available on our website and references are available on request.

Flexible and tailored approach – We pride ourselves in tailoring our ISO 27001 consultancy services around your specific requirements, which may be full lifecycle consultancy where we take the lead and provide knowledge transfer to a light touch approach which includes mentoring or reviewing outputs.

With the latter, URM may assist with specific activities such as conducting risk assessments, developing policies and procedures, delivering awareness sessions and conducting audits.  Our services can be totally tailored to factors such as internal resource availability, timescales, and budgets.

Business-led Approach – Your ISMS needs to be just that, yours.  Not something that sits on a shelf or you put effort into when an external assessor is coming but something that is truly business as usual.

Our goal with any ISO 27001 implementation is to achieve the optimum balance, where the mandatory management system requirements of the Standard are being met whilst ensuring that your ISMS reflects your organisation and is tailored to your size, culture, and objectives.

We always aim to ensure that anything we develop or recommend is appropriate and pragmatic and adds value to your business and that you do not become a ‘slave to the Standard’ i.e. doing something because the Standard says so as opposed to maximising an existing internal process or method of working.