Iso 27001

Quality management Presentation
ISO 27001
Presenters:
Zuzanna Łopatka
Inês Branco
Umut Barkın Köz
Abel Negash
Zaki Med Zeghouane
1. INTRODUCTION
When it comes to keeping information assets secure, organizations can rely on the ISO/IEC 27000 family.
ISO/IEC 27001 is widely known, providing requirements for an information security management system (ISMS),
though there are more than a dozen standards in the ISO/IEC 27000 family. Using them enables organizations of any kind
to manage the security of assets such as financial information, intellectual property, employee details, or information
entrusted by third parties.
1.1 Scope
This International Standard specifies the requirements for establishing, implementing, maintaining and continually
improving an information security management system within the context of the organization. This International Standard
also includes requirements for the assessment and treatment of information security risks tailored to the needs of the
organization. The requirements set out in this International Standard are generic and are intended to be applicable to all
organizations, regardless of type, size or nature. Excluding any of the requirements specified in Clauses 4 to 10 is not
acceptable when an organization claims conformity to this International Standard.
2. Basic Requirements for ISO 27001
The requirements from sections 4 through 10 can be summarized as follows:
A. Clause 4: Context of the organization

❏ One prerequisite of implementing an Information Security Management System successfully is understanding the
context of the organization. External and internal issues, as well as interested parties, need to be identified and
considered. Requirements may include regulatory issues, but they may also go far beyond.
A. Clause 5: Leadership
The fifth chapter focuses on the responsibility of higher management and policy in general. Specifically, higher
management must:
❖ make sure information security policies and objectives are established and aligned with the strategy of the
organization and integrated in their processes;
❖ develop and promote security culture under every aspect by issuing regulations, rules, guidelines, and through
constant awareness building of all human resources, understand the fundamental importance of confidentiality,
integrity, and data availability of information acquired, developing rules, regulations, and guidelines and adopting
the most modern data protection techniques;
❏ Understanding the Needs and Expectations of Interested Parties
Clause 4.2 of the requirements for ISO 27001 is about ‘Understanding the needs and
expectations of your organization's interested parties’.
❏ Determining the Scope of the Information Security Management System

Clause 4.3 of the ISO 27001 standard involves setting the scope of your Information Security
Management System. This is a crucial part of the ISMS as it will tell stakeholders, including
senior management, customers, auditors and staff, what areas of your business are covered by
your ISMS. You should be able to quickly and simply describe or show your scope to an
auditor.
❏ Information Security Management System
This clause of ISO 27001 is a simple stated requirement and easily addressed if you are
doing everything else right! It deals with how the organisation implements, maintains and
continually improves the information security management system
❏ Risk assessment and risk treatment methodology

This document sets out how you identify risks to information security, and your approach to
mitigating those risks and addressing them when they occur. You do not need to list the
potential risks in this document
Definition of security roles and responsibilities
➔ This document outlines the tasks and responsibilities of each role which has a
part to play in information security. You do not need to include full job
descriptions, and these roles do not have to be held by employees whose sole
responsibility is information security. For example, a sales manager might have
access to the customer database, and so has a security role in ensuring that their
access is kept protected and out of the hands of an unauthorised individual.
3. ISO 27001 In Construction
 It provides data and controls that can move a construction company’s employees
toward best practices.
❖ It reduces risks and increases the efficiency of business processes.
❖ Helps you get competitive contracts & win tenders – Obtaining an ISO 27001
certification can help you demonstrate that you meet all of the requirements
stipulated by the government and other customers for winning major projects.
❖ Improves customer satisfaction – Good customer service is the key to increasing
customer loyalty and gaining repeat business
4. Certification Options
Certifying your business to ISO standards improves your chances of winning government
contracts and tenders because compliance with these standards is often mandatory for
construction companies looking to win these deals.
I. ISO 9001 : This Standard sets out the criteria for a quality management system and
gives companies and organizations the tools needed to design an effective system for
managing business processes and ensuring customer satisfaction.
II. ISO 14001 – This Standard defines the requirements for an environmental management
system and provides a framework for identifying and controlling environmental issues
and reducing their impact.
III. OHSAS 18001 – The Occupational Health and Safety Assessment Series (OHSAS) is an
international occupational health and safety management system designed to benchmark
against international best practice and help organizations minimize the risk of workplace
accidents and injuries.
Iv. SA 8000 – Social Accountability International has developed a certification scheme for
companies that want to meet international standards of socially responsible business
practices.
5. Advantages of Iso 27001
❖ Greater competition in the market

❖ Greater credibility and trust of customers by guaranteeing data security
❖ Improving and protecting the reputation of the company or brand in the market
❖ Better protection of company assets and interests
❖ Ensuring compliance with legal requirements
❖ Savings, e.g.:
- avoiding penalties and damages (meeting legal requirements and expectations
of customers, contractors and business partners)
- limiting the amount of the insurance premium due to the certificate
- avoiding financial losses resulting from the impact of information on
competition
6. Disadvantages of Iso 27001
No certification is perfect and certainly there are some areas that Iso doesn't cover.
❖ It provides a framework for management security but not a standard for security
itself.
❖ It takes a risk assessment based approach. Therefore the organization decides the
level of security needed, not the ISO 27001
❖ Another problem is that organizations can scope the standard to their entire
business. The branding associated with this Iso doesn’t identify the scope.
7. Conclusions
Despite finding many disadvantages of the ISO 27001 system, the number of advantages outweighs the number of
disadvantages. Certainly, this standard is not the most accurate and would still require corrections, but the use of the
standard is a safer option for the company and brings positive effects, such as market position, customer trust or savings.

Iso 27001

Uploaded by

Copyright:

Available Formats

Iso 27001

Uploaded by

Document Information

Original Description:

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Iso 27001

Uploaded by

Copyright:

Available Formats

Quality management Presentation

A. Clause 4: Context of the organization

❏ Determining the Scope of the Information Security Management System

❏ Risk assessment and risk treatment methodology

❖ Greater competition in the market

You might also like