DISC InfoSec blog

This post is the continuation of our previous post on this topic Human Resources Security and ISO 27001, where we discussed some HR misconceptions and ISO 27001 controls related to pre-employment, in this post we will address the importance of ISO 27001 controls during employment.

Control 8.2 states that the organization should make sure employees, contractors and vendors are well aware of information security controls related to HR and how these controls relate to them and more specifically what are they responsible and liable for when security threats materialized. The users who have assigned responsibilities to manage the Information Security Management System (ISMS) are aware of the threats and vulnerabilities related to their assigned controls.

Control 8.2.1 requires management to ensure that everyone in an organization if following the security policies and procedures in their area of responsibility. This control also ensures that staff are properly trained and briefed on their responsibilities before they are granted an access to classified information.

Control 8.2.2 is related to information security awareness and training, which is basically an extension of previous control. All employees who are responsible of maintaining, managing and improving of ISMS must receive appropriate awareness training. Make sure you keep the records of all these training for the auditors to verify later.

Here are the general areas which should be included in the awareness training:

• General ISMS awareness – importance of maintain and improving ISMS
• Asset classification and information assets within the scope
• How to report an incident and difference between event and an incident
• User access controls and procedures
• Business continuity and procedures
• Related legal compliance
• Internal audit and certification audit schedule

Related articles

• Human Resources Security and ISO 27001 (deurainfosec.com)
• ISO 27001 Information Security Incident Management (deurainfosec.com)
• Staff awareness training – an essential component of ISO27001 (deurainfosec.com)
• PECB obtains ANSI / ISO 17024 accreditation for its ISO 27001 certification scheme (prnewswire.com)
• 5 reasons why vsRisk v1.6 is the definitive risk assessment tool (deurainfosec.com)

Information Security Wordle: RFC2196 - Site Security Handbook (Photo credit: purpleslog)

1. Business managers of the organizations will make informed decisions regarding potential risk and should be able demonstrate compliance with standards and regulations such as SOX, GLBA, HIPAA, DPA to their critical information on regular basis.

2. An ISMS is a defensive mechanism to any APT (advanced persistent threat) to minimize the impact from these external threats of various cybercrime.

3. Informed information security decisions will be made based on risk assessment to implement technical, management, administrative and operational controls, which is the most cost effective way of reducing risk. Highest priority risks are tackled first to attain best ROI in information security.

4. Information security is not an IT responsibility; In general everybody in an organization is responsible for protecting information assets and more specifically business manager. The business manager may delegate their responsibility.

5. Organization will improve credibility and trust among internal stakeholder and external vendors. The credibility and trust are the key factors to win a business.

6. ISMS raises awareness throughout the business for information security risks, involve all employees throughout an organization and therefore lower the overall risk to the organization.

Related articles

• Achieve Best Practice & Win New Business with International IT Standards (deurainfosec.com)
• Great ISMS mindmap / diagram (spaceforit.com)
• Download the full version of the ITIL and/or ISO27001 toolkit today! (deurainfosec.com)
• Google Apps earns ISO 27001 certification (net-security.org)

Boardrooms are finally waking up to the importance of cyber security. In the digital age, winning new business, protecting your own assets and ensuring customer confidence are all dependent upon cyber security. And there is one international standard which can help you achieve all of this, ISO27001.

But what do you really know about the ISO27001 Standard?
ISO27001 is the international best practice standard for an information security management system (ISMS). An ISMS is a systematic approach to managing all your confidential and sensitive information so that it remains secure, whilst maintaining its availability, confidentiality and integrity.
An ISMS encompasses people, processes and IT systems and ensures your security efforts and coherent, effective and proportionate. ISO27001 provides the requirements to help you design a best in class ISMS.

If you are new to ISO27001 you can read more information and download a free white paper on cyber security and ISO27001 here >>>

Download a copy of ISO 27001 ISMS Requirements

London Pensions Fund Authority (LPFA) achieves ISO27001 and ISO14001 certifications six months ahead of deadline

The London Pensions Fund Authority (LPFA), based at Royal Mint Court, London, is today announcing a remarkable achievement in standards compliance. A leader in the provision of pension administration for the Local Government Pension Scheme, and with its own pension fund worth £4.1bn, LPFA is leading the way in the City of London by recently becoming certified to the ISO27001 Information Security and ISO14001 Environmental Management System standards – six months ahead of project schedule, and with a near-perfect score.

These prestigious awards are the culmination of a fast-track project supported by professional services firm IT Governance, a leader in international standards compliance and best practice, serving clients in the UK public and private sectors.

In the highly competitive global market for pension fund administration, cost-effectiveness and efficiency are vital components for success. LPFA is, therefore, a cost-conscious and well-run organisation, but also one that is aware of its responsibilities when it comes to protecting the security of data and taking a leadership position in improving the organisation’s environmental impact. For these reasons, the LPFA Board adopted international standards and achieved compliance with the ISO27001 Information Security and ISO14001 Environmental Management Standards.

For LPFA, Les Higgs, LPFA’s Programme and ICT Manager, comments: “Our thanks go to IT Governance, whose consultant, Nick Orchiston, enabled us to achieve certification in record time, and – on a personal note – to Lauren McHugh, who has worked so diligently to inform and successfully engage our colleagues at LPFA. The results speak for themselves: after rigorous assessment, the BSI auditor found only three minor non-conformities in the implementation of two weighty international standards. They certificated LPFA to ISO27001 and ISO14001 standards on our first attempt, six months ahead of our project completion date.”

Mike Taylor, LPFA’s Chief Executive, said: “I am delighted that LPFA has managed to achieve ISO accreditation six months ahead of deadline. Key elements, such as enhanced data security and environmental considerations, have become part of life across the whole organisation. This accreditation should give confidence to all Fund members and clients that their information is in good hands. The process had total commitment from the project team, IT Governance and all staff, and it was this that led to a successful implementation.”

“For IT Governance, Steve Watkins, Director, Training & Consultancy, said: “ISO27001 compliance, when approached correctly, provides clear commercial benefits. The risk-based approach means that it is the sensitive information – for example, personal information, bank details, contracts and other confidential material – which is appropriately protected, thereby minimising the risk of reputational damage and providing reassurance to clients, whilst also ensuring the information is available as and when it is needed. Further, certification to ISO27001 demonstrates to clients, staff and stakeholders that the organisation has a systematic approach to managing the security of information, considering the implications of people, processes and technology. We believe that by adopting this standard and seeking accredited certification, financial companies can demonstrate their commitment to respecting clients’ sensitive data.”

The certification pathway to ISO27001 involved extensive risk management evaluation, business resilience planning and ensuring data security standards set by client companies are met and exceeded by delivering industry-leading IT protocols. LPFA will be independently inspected every six months to ensure it is up to speed with the latest data protection and industry requirements – with strong and effective measures to help to protect confidential data and prevent fraud.

The ISO14001 Environmental Management System has helped LPFA to be more environmentally friendly, providing managers with guidance on how to measure consumption and reduce waste. An effective programme to reduce, re-use and recycle has produced top and bottom line benefits by making tangible cost savings, reducing environmental impact and enhancing the organisation’s environmental credentials, winning more business: a fact demonstrated by LPFA’s success in securing commercial tenders as a result of the organisation’s certification in 2011.

IT Governance offers an integrated professional services approach to standards adoption, project development and compliance. The UK-based company provides consultancy advice, coaching and mentoring, knowledge transfer, training programmes and an extensive range of documentation toolkits, software, e-learning and self-help publications designed to speed up compliance projects.

Checkout a comprehensive ISO 27001 ISMS Toolkits from IT Governance