Difference Between Certified and Compliant ISO 27001 ISMS

|
|
PUBLISHED on
27 Jul
2022

Table of Contents

There is some confusion about the difference between having an information security management system (ISMS) which is certified to ISO 27001 and one which is compliant or aligned to the Standard.  

There are many articles and opinions on whether an organisation should certify its ISMS or align it against the Standard.  A commonly held view is that “we will save money by aligning to ISO 27001 and avoid the unnecessary hassle and burden of certification”.

This view, in URM’s opinion, is flawed in that there is a significant risk that aligning will actually incur more time and money and, more significantly, you will miss the benefits and business opportunities presented by certification.

Compliant or aligned management system

Complying with the requirements of ISO 27001 implies that an organisation is using the Standard as a guiding model for its ISMS and its information security governance.  Such a statement has some validity, as there is an indication that the organisation has put thought into its approach.  However, when scrutinised/investigated, we find this approach often falls short in a number of areas, e.g., scope and continual improvement.  When you state that you are compliant, who is that according to – the organisation itself?

If so, you won’t gain the kudos attached to a specialist and independent third party assessing the effectiveness of your ISMS, e.g., assessors with greater impartiality, less conflict of interest and who bring industry knowledge/insight and a fresh perspective.

Certified management system

A certified management system is independently assessed and is subject to a three-year auditing cycle to demonstrate ongoing commitment and continual improvement.  A key aspect of certification body audits is the focus on continual improvement and revisiting corrective action plans from previous audits to address any identified issues.

You can be sure that one of the first items an external assessor will be checking is whether all actions have been completed and, if not, justification as to why they haven’t been completed, supported ideally by a risk assessment and a risk acceptance at an appropriate level.  Would you get such rigour with an internal compliance approach?  It’s unlikely and, in our opinion, crystallizes the difference between compliance and certification.

When we talk about certification, there is a very important differentiation to make, i.e., certification carried out by bodies which are accredited by the United Kingdom Accreditation Service (UKAS) and those that aren’t.  A UKAS accredited certification body (CB) goes through a stringent assessment at the outset and is assessed on an annual basis through reviews of sample reports.

So, if you are going to be independently certified, ensure you’re certified by a CB who is subject to the same rigorous approach as you are!  And yes, certification is challenging, as is anything with an element of external or third-party assessment.  Yes, it expects you to justify the approach you have taken and provide evidence to demonstrate that.

Yes, it expects you to know whether your approach is effective and whether what you have done is delivering the intended outcome.  But when you step back, isn’t that a good thing?  How else can you provide effective assurance to your key stakeholders other than with an independent, rigorous, third-party assessment?

Do you need any help with ISO 27001 certificate?

URM can help you achieve ISO 27001 certification
Thumbnail of the Blog Illustration
Information Security
Published on
20/7/2022
What Are the Critical Steps When Implementing an Effective Information Security Management System?

URM assisted over 350 organisations achieve ISO 27001 certification, here are the critical steps when implementing an effective information security system.

Read more
Thumbnail of the Blog Illustration
Information Security
Published on
20/7/2022
10 Top Tips for Keeping Information Secure When Homeworking

In this blog, we aim to provide 10 top tips to enable you to keep important information assets safe and secure whilst working remotely.

Read more
Thumbnail of the Blog Illustration
ISO 27001:2022 Transition
Published on
7/11/2023
Transitioning to ISO 27001:2022

If your organisation is looking to transition to ISO 27001:2022, URM’s blog provides practical and invaluable guidance on meeting the new requirements.

Read more
It was really interesting and well delivered, thank you.
Webinar 'ISO 27001:2022 – What’s new?'
contact US

Let us help you

Let us help you in your compliance journey by completing the form and letting us know how we can best support you.