With over 19,500 certificates issued worldwide according to ISO survey figures (2012), and a year-on-year growth, it is perhaps safe to say that ISO 27001 is the most widely adopted information security best practice framework.
IT Governance’s Chief Information Officer Neil Acworth shares his view on how ISO27001 benefits his company and his department.
What are your key responsibilities as a CIO at IT Governance?
My role is to define the strategy that delivers an information services platform capable of supporting a rapidly expanding global business. On a day to day basis this covers oversight of the software development process both internally and through our subsidiary, Vigilant Software; I’m the Information Security Manager with responsibility for the implementation and maintenance of our ISO27001 certification and PCI-DSS compliance; I’m also Head of Technical Operations meaning I have the final say on everything relating to IT operations. Mostly though, it’s my job to ensure that we’re providing the services the business needs while maintaining security.
IT Governance is an ISO 27001 certified organisation – what does this mean for the company and for your job as a CIO?
What it means for the company is that customers can have confidence that we’re managing both information systems and information itself according to best practice security principles. It’s also critical that the wider business has confidence in the services that allow it to operate. For both parties, ISO27001 certification demonstrates that an accredited third party has validated our processes.
For me, at its heart ISO27001 is a management system. It gives me clear guidance on what we should be doing according to internationally recognised best practice; we’re not reinventing the wheel with every decision. Security as defined by ISO27001 is not just about ensuring that information remains confidential but also that it’s correct and available to people who need it, when they need it. Primarily, ISO27001 gives me a framework with which to manage information services and the assets that underpin them.
For employees there is clarity around what’s expected from them from an information security perspective and what level of service they can expect from us.
What challenges does ISO27001 help you solve?
One of the most significant benefits is that the CEO and the rest of the management team can see and understand the benefits of ISO27001 and they’re happy to give me their backing; I don’t have to start from scratch explaining how I’d like to run things. They’re happy that we’re doing things the right way and it’s easier for me to get things done because they’ve already bought in to the principles.
It also simplifies a lot of the operational decision making that goes on without creating too much bureaucracy. If something new comes up it’s a simple matter to work out where it should fit into the system; I can shape our ISO27001 implementation to provide just enough process, where it’s needed and then have the confidence that the processes are being followed. If they’re not right, we change them.
Another challenge is keeping on top of all the elements of information security, 27001 provides a checklist of all the things we need to consider to maintain a secure environment. It’s about so much more than just firewalls and anti-virus. It ensures that you’re looking at things holistically, that you don’t miss things like 3rd party vetting or document disposal because you’re focussed on IT management.
What specific skills and knowledge does the CIO need to work in an ISO 27001 environment?
ISO 27001 makes life simpler because it gives you the framework. You still need to be able to tailor the implementation to suit your needs and follow the guidance provided. It’s a very methodical process.
In terms of knowledge, it’s recommended that anyone who takes on an ISO 27001 implementation project has a good understanding of ISO 27001. This knowledge can be applied through ISO27001 training.
Does ISO27001 help improve the communication between your department and the board and how?
I’m very lucky because my board are obviously champions of ISO27001. In the unlikely event I was to move elsewhere I’d use it again because it provides a context for decision making. Its risk-based approach means that critical decisions relating to security are made within the context of the likely impact on the business, the conversation moves on from “Why are we paying for ‘X’?” to “These are the risks to our business, are you happy to accept them?”.
For more information on information security and ISO 27001 visit: www.itgovernance.co.uk/information-security-critical-issues.aspx
