ISO 27001 FAQs 

Having helped numerous companies achieve and maintain the ISO 27001 standard, the Securious team gets asked lots of questions about it. Here are some of the most common, but if we haven’t answered your question in this article, just send it to us via email at info@securious.co.uk.

What is ISO 27001?

• ISO 27001 is the international standard for Information Security. It provides a framework for an information security management system. 
• This enables organisations to manage the security of assets like financial information, intellectual property, employee details or information entrusted by third parties.

Who is it for?

• ISO 27001 is a great tool for organisations of any size and in any sector to use to keep their information assets more secure. 
• It allows the business to demonstrate that it complies with current international best practice and that it is effectively securing information assets and managing the risks around them. 
• It also ensures that the organisation constantly improves its systems and processes to fit evolving needs.

Why would I want ISO 27001?

• It also allows you to prove you have a system in place to continually review and improve your information security. This improves credibility with customers, business partners and staff. 
• It can help you bid for contracts with larger organisations that require the certification and minimise the evidence required for a larger organisation to complete their due diligence. 
• You can use it as a tool to help manage GDPR compliance.
• It can also help you to identify your information assets and their value, so you can make informed decisions to mitigate risks and ensure efficient spending.

What is an ISO 27001 certification body?

• An ISO 27001 certification body is an accredited organisation that conducts assessments and issues certifications for ISMS in accordance with the ISO 27001 standard. 

What is the difference between ISO 27001 and ISO 27002?

• ISO 27001 provides the framework for an ISMS while ISO 27002 provides guidelines and best practices for implementing controls to protect your information.

How long does it take to get the ISO 27001 certification?

• We have managed to implement ISO 27001 within a 12 week process for some clients. 
• However generally an implementation takes around 3-6 months (sometimes longer depending on resource availability and scope of the organisation).

How much does it cost to get ISO 27001 certification?

• We tailor our ISO 27001 consultancy service to your individual needs and circumstances, so please get in touch and we’ll provide you with a quote based on your situation and requirements.
• Alternatively, we’ve pioneered the Securious ISO 27001 Academy. We work with businesses in a series of online workshops, for just £2,895 +VAT which includes all the necessary templates.

Who can issue ISO 27001 certification?

• ISO 27001 certification is issued by third-party certification bodies that are trained and experienced in assessing and certifying an organisation’s information security management system (ISMS) against the ISO 27001 standard.

Does ISO 27001 cover GDPR?

• ISO 27001 doesn’t specifically cover the GDPR (General Data Protection Regulation). 
• However, organisations that are subject to GDPR and wish to demonstrate compliance with the regulation may find ISO 27001 can help them meet some of the requirements. 

Is there ISO 27001 training for individuals? 

• Individuals can obtain various certifications, such as ISO 27001 Lead Implementer and ISO 27001 Lead Auditor, which demonstrate their knowledge and understanding of the standard and their ability to implement and audit an ISMS. 
• These certifications are offered by various certifying bodies.

Is there a legal requirement to comply or be certified with ISO 27001?

• There is no legal requirement to comply with or be certified to ISO 27001.

What do I need to maintain my ISO 27001 certification?

• Operate the ISMS as documented. Most importantly take a risk-centric approach to managing information security risk.
• Verify the controls you have in place are implemented effectively and update as required by changes in risk.
• Maintain your documentation (e.g., your Policies and Procedures) to reflect your working practices and environment. 
• Monitor and measure the expected outcomes of your risk planning and act accordingly
• Improve your Information Security year over year in a measurable way. Continuous improvement is a requirement of the standard.
• Conduct ISMS Internal Audits to demonstrate that management is committed to ensuring the effectiveness of the ISMS.
• Undergo an annual surveillance (or re-certification) audit by the certification body each year to maintain your certificate.

What is an ISMS?

• An Information Security Management System (ISMS) is a systematic approach to ensuring that critical risks to information assets are reduced to a level consistent with management’s objectives. 
• In essence, it is a comprehensive process for managing information security.

Does operating to ISO 27001 slow everyday operations?

• The additional work effort to produce and maintain the documentation tends to be more than offset by the time saved by reductions in security incidents and third-party audits.

Does ISO 27001 certification expire?

• The certification does expire, typically after three years from the date of certification. The expiration date is usually stated on the certificate itself. However, the ISMS must be managed and maintained throughout that period. Auditors from the certification body will conduct annual surveillance visits while the certification is valid.

Does ISO 27001 cover disaster recovery?

• ISO 27001 covers disaster recovery as part of its requirements for information security management systems (ISMS).

Does ISO 27001 cover business continuity?

• ISO 27001 covers business continuity as part of its requirements for information security management systems (ISMS).

Is ISO 27001 a UK standard?

• It is an internationally recognized standard for information security management.

Is ISO 27001 a standard or a framework?

• ISO 27001 is a standard, not a framework. It specifies a set of requirements for an information security management system (ISMS). The standard provides a framework for establishing, implementing, maintaining, and continually improving an ISMS.

When will ISO 27001 be updated?

• On October 25, ISO 27001:2022 was released, replacing the version from 2013. 

What changes to ISO 27001 are coming in the new updates?

• Clauses have been reduced to simplify control
• Security Controls are now grouped into 4 main Clauses (Organizational, People, Physical, and Technological) instead of the previous 14.
• ‘Attributes’ can be utilized for easier reference and navigation.
• The security controls contained in Annex A have decreased from 114 to 93.
• New Organizational and Physical controls have been introduced and some older controls merged, reducing the overall number of controls.

What is the ISO 27001 Academy?

The Securious Academy for ISO 27001 breaks ISO 27001 down into six digestible steps – easy, bite-sized chunks that build on each other. It’s designed to take the pain away from achieving and maintaining ISO 27001 and makes it far more cost-effective than alternative approaches.

Over 6 sessions, each business will gain an understanding of the standard, its application and implementation, while building an information security management system manual – the core document required for ISO 27001. The following will be covered in the six two-hour workshops.

• What is ISO 27001 and how can this assist with GDPR compliance
• Leadership requirements and support for ISO 27001
• Planning and asset management
• Introduction to risk assessment
• Introduction to risk treatment
• Introduction to performance evaluation

Learn more here.

Need help with ISO 27001?

Here at Securious, we help numerous organisations achieve and then maintain ISO 27001 accreditation.

To learn how we can help with your specific situation, please call now on +44 (0) 1392 247 110, email info@securious.co.uk or fill in the contact form below

To see more of our ISO 27001 resources, click here.