ISO/IEC 27001 Information security management

What is ISO/IEC 27001?

ISO 27001 is an international management standard on information security. The standard is a management tool that helps your company protect valuable information, including personal data, in a secure and reliable way. ISO 27001 formulates requirements of risk management, process documentation and the division of responsibility regarding information security, etc. 

The purpose of ISO/IEC 27001 is to get an effective management tool for information security that fits companies’ specific needs. Moreover, is it to ensure maintenance of effectivity through a process of continuous improvements. This means that information security is continuously updated so the company can manage challenges in a business world under constant change.

Buy the standard ISO 27001

You can buy the standard DS/EN ISO/IEC 27001:2017 in our webshop.

General Data Protection Regulation (GDPR)

The new General Data Protection Regulation was passed by the UN with effect on May 25, 2018 and is to be included in the UN countries’ own legislation, however with room for supplementing national legislation.

The new UN requirements overlap with the requirements in the ISO/IEC 27001 standard on information security in several areas. The new data regulation sets stricter requirements for the treatment and protection of personal data. With these standards, you and your company will be well prepared for complying with the new requirements.

Get professional guidance

We assist private as well as public companies and organizations. Get guidance to identify your current situation for information security or get knowledge about development and improvement opportunities for existing systems.

Contact Anders Linde, chief consultant at Danish Standard, via e-mail ali@ds.dk, or on phone +45 39966329. Anders has more than eight years of experience using and implementing ISO/IEC for information security. Anders has provided guidance for the Danish Defence, the Courts of Denmark, the City of Copenhagen among others.

Are you aware of your company’s risks?

ISO/IEC 27001 provides requirements for establishing, implementing, maintaining and continuing improvements of an information security management system (ISMS). The implementation of an ISMS is a strategic decision for an organization. It is important that the management system is part of and is integrated with the organization’s processes and overall management structure. Additionally, the system should take account for the information security in the planning of processes, information systems and controls.

Today, all public companies are obliged to follow the principles in the ISO/IEC 27001 standard. Moreover, the standard is a good reference point for managing requirements in the new General Data Protection Regulation that became effective in May 2018.

Legislation and requirements concerning information security

Some laws and regulations are common for most countries, e.g.:

• Legislation on data protection and data security
• Legislation on copyrights, patents, trademarks and digital rights
• Legislation on computer misuse or hacking
• Legislation on use of electronic signature (especially important for security of online payments)

Many new laws and regulations include requirements for information security that a company must comply with. Some professional insurance companies now require documentation to keep track of information security before offering insurance coverage.

Recommendations for working with ISO 27001

1. Establish an IT-security committee comprised of business-people and IT-representatives. It is important that the representation is not solely of a technical nature, as IT and information security is about pointing out faults and deficiencies at the IT department or its suppliers. Moreover, it is decisive that top management show support – preferably by holding the position as chair of the Steering Committee. The committee’s most valuable task is first to specify and then manage Information Security Governance in the company. E.g. deciding on a strategy and vision and specifying the organization and the resources to be allocated to the area.
2. Avoid trying to reinvent the wheel – use the standards that already exist (DS/ISO and ISF Standard of Good Practice). They are all carefully considered and tested in thousands of places. You can always adjust them to fit your company.
3. Hire a person whose primary job is information security. Studies indicate that companies, following this recommendation, experience significantly fewer serious occurrences. A sense of ownership and clearly defined roles are fundamental.
4. Create awareness around the subject. It is important to promote good practices and ethics among the users, e.g. in relation to the use of internet, social media, managing sensitive personal data both in small and greater numbers.
5. Allocate the necessary resources that match the company’s size and maturity. One single person cannot solve an IT-security problem in a company of 10,000+ employees, though it may be enough to solve the problem in a small company.