ISO 27001 Getting Started | Everything you need to know | ISO 27001 Basics
Summary
TLDRThe video script offers an in-depth exploration of the governance risk and compliance framework, focusing on the implementation of ISO 27001. It emphasizes the importance of senior management buy-in and establishing a management review team to ensure policies and procedures are aligned with business risks. The speaker compares ISO 27001 with other standards like SOC 2 and PCI DSS, highlighting the differences in audit approachesโpoint in time versus continuous auditing, and risk-based versus rule-based frameworks. The script also provides practical advice on engaging with certification bodies and managing client expectations throughout the certification process, including costs and timelines.
Takeaways
- ๐ Senior Management Buy-in: The importance of having top-level leadership support for any governance, risk, and compliance framework, including ISO 27001, cannot be overstated.
- ๐ Management Review Team: A key component of the framework is the establishment of a management review team that ensures policies and procedures are implemented and followed across the organization.
- ๐ก๏ธ Risk-Based Approach: ISO 27001 is a risk-based model, meaning that controls are tailored to the specific risks and business needs, rather than a one-size-fits-all rule-based approach.
- ๐ Policies and Procedures: Clear distinction is made between policies (what the organization does) and procedures (how it is done), which are based on risk and subject to regular audits.
- ๐ Internal Audits: Organizations must perform internal audits at least annually, focusing on the most risky aspects of the business to ensure compliance with policies and procedures.
- ๐ซ Incident Management: Incidents, or deviations from policy or procedure, are expected and managed as part of the continual improvement process.
- ๐ Continual Improvement: The script emphasizes the need for ongoing assessment and enhancement of policies and procedures to adapt to new risks and challenges.
- ๐ International Standard: ISO 27001 is an internationally recognized standard for information security management, making it a valuable asset for global businesses.
- ๐ฐ Cost Considerations: The costs associated with ISO 27001 certification can vary widely based on the size of the organization and the certification body chosen.
- โฑ๏ธ Timelines for Certification: The process of achieving ISO 27001 certification can take up to 12 weeks or more, depending on the certification body's availability and the organization's preparedness.
- ๐ Accurate Documentation: It is crucial to document current practices accurately, as auditors will verify these against the documented procedures, with discrepancies potentially leading to audit failures.
Q & A
What is the primary purpose of implementing ISO 27001?
-ISO 27001 is typically implemented due to commercial requirements, as it provides a framework for information security management systems (ISMS) and helps ensure that an organization's information assets are adequately protected.
Why is senior management buy-in crucial for the success of an ISO 27001 implementation?
-Senior management buy-in is essential because it sets the direction for the organization and ensures a culture of top-down leadership. Without it, there can be struggles with political, budgetary, and resource allocation issues, which are critical for successful implementation.
What is the role of a management review team in the context of ISO 27001?
-A management review team oversees and approves policies and procedures, ensuring that tasks related to the ISMS are completed effectively. It represents different areas of the business and is responsible for continual improvement and addressing any deviations or incidents.
How does the concept of 'policies' differ from 'procedures' in the script's context?
-Policies are statements of what an organization does, set by the leadership, while procedures are statements of how tasks are carried out within the organization. There is a conceptual separation where policies define the 'what' and procedures define the 'how'.
What is the significance of risk-based versus rule-based approaches in the context of ISO 27001?
-ISO 27001 adopts a risk-based approach, which means that the controls are tailored to the specific risks and risk appetite of the business. This contrasts with rule-based systems like PCI DSS, which have specific, mandatory controls that must be implemented regardless of the business's risk profile.
How does the script differentiate between an incident and an audit?
-An incident is a deviation from a policy or procedure, such as a security breach or a system outage. An audit, on the other hand, is a systematic review of policies and procedures to ensure they are being followed and are effective, based on risk.
What is the importance of continual improvement in the ISO 27001 framework?
-Continual improvement is a core concept in ISO 27001, emphasizing the need for an organization to constantly evaluate and enhance its ISMS. This process is managed by the management review team and involves addressing risks, audit findings, and incidents.
How does the script describe the process of external audits in relation to ISO 27001?
-External audits are conducted by accredited certification bodies and can occur as part of the certification process, customer onboarding, or regulatory requirements. They assess the organization's compliance with ISO 27001 standards.
What are the key differences between ISO 27001, SOC 2, and PCI DSS as discussed in the script?
-ISO 27001 is an international risk-based standard for ISMS. SOC 2 is an auditing procedure that assesses service organizations, with Type I being a point-in-time audit and Type II being a continuous audit over a defined period. PCI DSS is a rule-based standard specifically focused on entities that store, process, or transmit cardholder data.
Why does the script suggest starting with ISO 27001 before pursuing other standards like SOC 2 or PCI DSS?
-The script suggests starting with ISO 27001 because it provides a foundational management system that can be built upon. Other standards like SOC 2 and PCI DSS often require controls that are already covered by ISO 27001, making it a more efficient starting point.
Outlines
๐ Introduction to Governance, Risk, and Compliance
The speaker introduces the concept of governance, risk, and compliance (GRC) and explains how ISO 27001 fits into this framework. The discussion highlights the importance of senior management buy-in for a successful implementation of ISO 27001. It emphasizes establishing a top-down leadership culture and the challenges that arise without executive support. The speaker also outlines the structure for a management review team, which is crucial for ensuring that tasks are completed and that policies and procedures are overseen and approved. The talk also touches on the separation of policies and procedures, with policies being high-level statements of what the organization does, and procedures detailing how it is done.
๐ The Importance of Policy and Procedure Distinction
This paragraph delves deeper into the distinction between policies and procedures. Policies are defined as high-level statements set by leadership, dictating what the organization does, such as implementing antivirus on every machine. Procedures, on the other hand, are detailed instructions on how to execute these policies, like setting up automatic scans and defining protocols for alerts. The speaker stresses the need for clear separation to allow for better documentation and management. Additionally, the paragraph discusses the importance of these documents in meeting client demands and due diligence processes, as well as the risk-based approach of ISO 27001, which allows organizations to implement controls appropriate to their specific risks and business needs.
๐ Auditing and Incident Management in ISO 27001
The speaker discusses the auditing process and incident management within the context of ISO 27001. Policies and procedures are subject to regular audits to ensure they are effective and aligned with the organization's risk profile. The auditing process is based on risk, with more critical areas being audited more frequently. Incidents are defined as deviations from policy or procedure, and they are an expected part of the continual improvement process. The management review team plays a key role in addressing incidents and driving the process of continual improvement, which is a core aspect of ISO 27001. The speaker also mentions the importance of having a risk-based approach to controls and the flexibility it provides compared to rule-based systems.
๐ ๏ธ Continual Improvement and External Audits in ISO 27001
Continual improvement is a key component of ISO 27001, and this paragraph explains how it is managed and reported by the management review team. The speaker describes the process of identifying, assessing, and treating risks, as well as the role of internal audits in this process. Incidents that occur are also addressed by the management review team, which makes decisions on necessary actions, such as resource allocation or policy updates. External audits are also discussed, highlighting the different contexts in which they may occur, such as part of a certification process or as a requirement from a new customer. The speaker emphasizes the cyclical nature of updating, auditing, and improving policies and procedures.
๐๏ธ Building a Structured Approach to Compliance
The speaker provides an overview of how to build a structured approach to compliance, starting with ISO 27001 as the foundational management system. The paragraph explains the concept of 'bolting on' additional standards and frameworks, such as GDPR and PCI DSS, to the base ISO 27001 framework. This approach allows for a comprehensive and scalable compliance structure that can adapt to various regulatory requirements. The speaker also discusses the importance of common modules and the benefits of starting with ISO 27001 before moving on to other standards.
๐ Understanding Different Audit Frameworks and Standards
This paragraph explores various audit frameworks and standards, such as ISO 27001, SOC 2, and PCI DSS. The speaker explains the differences between these standards, including their geographical focus, the nature of their audit processes (point in time vs. continual), and their management structure. The discussion also touches on the complexity and cost implications of implementing and certifying these standards, with a particular focus on the rigorous and costly process associated with SOC 2 Type 2 audits compared to the more structured and generally less expensive ISO 27001 certification.
๐ฐ Costs and Processes Associated with ISO 27001 Certification
The speaker discusses the costs and processes involved in obtaining ISO 27001 certification. They mention that certification costs can vary depending on the size of the business and the certification body chosen. The paragraph outlines the importance of getting multiple quotes and highlights the potential for significant cost differences between certification bodies. The speaker also emphasizes the need for transparency in ongoing audit fees and warns against hidden fees or unnecessary services. The paragraph concludes with advice on setting realistic expectations for the certification timeline and the process involved in achieving certification.
โฑ๏ธ Timeline and Expectation Management for ISO 27001 Certification
The speaker provides insight into the timeline and expectation management for clients pursuing ISO 27001 certification. They explain that the certification process can take up to 12 weeks but is dependent on the certification body's availability and the client's ability to implement and evidence the required controls. The speaker advises setting a realistic timeline of about three months for implementation and emphasizes the importance of managing client expectations regarding the time it takes to receive the actual certificate. They also suggest strategies forๅฎๆ clients who may be requesting the certification, such as showing commitment dates and engagement letters from the certification body as proof of progress.
๐ก๏ธ The Role of Advocacy in the Certification Process
In this final paragraph, the speaker reflects on their role as an advocate for their clients during the certification process. They discuss the importance of countering key red flags and ensuring that clients are well-represented and informed. The speaker also hints at a future discussion about the roles involved in an engagement and audit, the perspectives of different stakeholders, and the realities of the situation. They aim to provide insights that can help manage the complexities of the certification process.
Mindmap
Keywords
๐กGovernance Risk and Compliance (GRC)
๐กISO 27001
๐กManagement Review Team
๐กPolicies and Procedures
๐กRisk-Based vs. Rule-Based
๐กInternal Audit
๐กContinual Improvement
๐กIncident Management
๐กExternal Audit
๐กCertification Body
๐กStage 1 and Stage 2 Audit
Highlights
Governor's risk and compliance framework integration with ISO 27001 for effective information security management.
Importance of senior management buy-in for successful implementation of ISO 27001.
Establishing a management review team for oversight and approval of policies and procedures.
Conceptual separation of policies and procedures for clarity and effectiveness.
Risk-based approach of ISO 27001 allowing flexibility in control implementation based on business needs.
Difference between risk-based and rule-based systems exemplified by ISO 27001 and PCI DSS.
Internal audit processes and their significance in maintaining and improving policies and procedures.
Incident management as a deviation from policy or procedure and its role in continual improvement.
Management review team's responsibility in addressing continual improvement and resource allocation.
External audits' role in the certification process and their impact on client engagements.
Foundational role of ISO 27001 in the governance framework and its compatibility with other standards.
Bolt-on approach to integrating additional standards like GDPR and PCI DSS on top of ISO 27001.
Comparative analysis of ISO 27001, SOC 2, and PCI DSS in terms of implementation complexity and cost.
Advantages of starting with ISO 27001 before pursuing SOC 2 or PCI DSS certifications.
Cost implications and the importance of obtaining multiple quotes for certification audits.
The certification process timeline, including stages 1 and 2 audits, and annual continuing assessments.
Strategic approach to dealing with clients expecting rapid certification and setting realistic expectations.
Recommendation to use an accredited certification body and the benefits of comparing different providers.
Transcripts
so what you're going to see here is the
um
this is how i see governor's risk and
compliance working and this is how 27001
sits into that governance risk and
compliance framework
so
when we're doing a
27001
implementation
normally
people are going to be doing it because
they've been uh driven by a commercial
requirement we'll come back to that as
well so what they want to understand is
how does 27001
fit
what we have when we develop a
governance risk and confront compliance
framework is we're doing it in more
generally
so we are going to implement specifics
in for 27 0001 but we are going to try
and put something in that's a little bit
more general i'll do that so i can see
be awkward when you record it because
it's going to be recording you recording
me recording you but anyway
so uh so yeah so we're going to put in
something that's a little bit more
general so this will apply no matter
what standard you're implementing you
know and technically it would apply if
you were doing a data protection
implementation you know you're going to
be doing 9001 pci dss stock one sort two
whatever it is it's going to be
so what all of the standards and all of
the frameworks i'm looking for is that
senior management buy-in so what we have
is at the top level we've got senior
management and senior management needs
to set the direction of the organization
there are things that that we can do
we'll talk about role
uh in a little while but there are
things that we can do to help to
evidence that
but what you're hoping for is that when
you go into an organization there is a
culture of top-down leadership that
there is top-down buy-in
you are going to struggle in any
organization where your engagement is
either sea level or even below
so if the demand or the requirement is
coming from like a pro a product manager
a development manager a network manager
and even head of ops you know on his own
or her own then you are going to
struggle with it and and it's mainly
around politics it's going to be around
budget it's around getting buy-in and
resources to do what it is that that
needs to be done
so in very very practical terms you need
that senior management buy-in
and leadership from the top if i'm
engaging on a project i want at least
one of those
uh senior members uh sitting in in my
management meetings and we'll talk about
them as well as it goes for a bit
so senior management at the top sets the
direction underneath that we're going to
implement the concept of a management
review team now some companies have this
already this terminology will come up
time and time again
depending on the size of it there may be
an existing structure that you can
hijack and that you can jump off of the
back of
even in those environments even in
larger organizations i'm still mind
minded to create what i call a
management review team okay
so what the management review team is is
it ensures that things get done
now when i build the management review
team i'm going to share with you all of
the templates and documents as we go
through
when i when i set up a management review
team i want on that management review
team a representative of each area of
the business ideally so i'm looking for
somebody from hr i'm looking for that
one senior leadership manager that's
going to buy in i'm looking for
representation from it
if i've got a software development
function i want somebody from software
development call center ops whatever it
is so the size of the organization
now in a smaller organization it might
only be two of you and that's mine too
right you know but we just got to have
this we've got to have this structure
now the standard is going to call to
that as well so it's going to say right
i i need you to demonstrate certain
things i need you to demonstrate clearly
buying and this is one of the ways of
the way that we do it and we want to
demonstrate in communication we want you
to demonstrate things like continual
improvement so there are a number of
things that that need to happen that
this management review team is going to
satisfy and again we haven't even really
got to a standard yet right but in those
in those principles so we've got this
management review team
so what do they do
so they oversee
and they approve
policies and procedures
at the end of the day that is on the
left-hand side of this cycle that is
what that management review team is
doing depending on the size of the
organization they may be doing the doing
so they may be writing it and then they
may be improving it that's fine that's
fine but there's a conceptual separation
that the management review team oversees
and approves policies and procedures
in our world or in my world from a
practical perspective i separate out for
client policy and procedure
a policy is a statement of what we do
a procedure is a statement of how we do
it
and i separate those now what you find
when you go on a client is you're going
to find a mix
so if they try to do it themselves or
depending on where they're coming from
you might have some that's policy
statement uh mixed in with some process
statement uh and it can be a little bit
messy
okay a couple of reasons why i want to
do that the policies about what we do if
you think about it in from a
hierarchical point of view is going to
be set by the leadership right the
management they say what do we do well
we do antivirus on every machine
antivirus you know reports up to central
management
uh
is set to you know auto
disinfect like we want antibiotic we
want decentralized managed um antivirus
so it's a statement of what we do it
doesn't say we use symantec we log on we
download definition files every 24 hours
we set auto scan to run at 7 30 in the
morning if an alert comes it goes to bob
in it at this email address bobbin it
then does this and raises a ticket with
it it's a complete separation now
what that allows us to do as i say is we
can give bob
the uh sorry the the framework for him
to record what he does and we can give
the managers the framework to record a
high level what we do bob is doing how
we do it
what you're also going to find is that
pretty much every client that your
client engages with wants policies
so what they're going to say to your
client is i want a data protection
policy i want a clear desk policy i want
a working from home bring your own
device change management software
development
policy
so what we want to be able to do is
we're going to build our policy suite in
such a way
that it
makes their life easier right
it'll kind of make clients life a little
bit a little bit easier but it's all
about making the the
the requesters life easier so if they
say if you've got software development
on policy costs we have here you go bang
and it's written in a way that looks
like a software development policy they
can understand it
and they can respond to it
so we've got these policies that say say
what we do what we haven't then included
in it is all this personal information
right there's all bob's email addresses
in there
you know if we had a business continuity
policy and it said all right this is our
emergency call tree in the policy i
can't share that as part of a due
diligence on boarding
so we've got these policies what we do
we've got procedures within our
organization about how we go about doing
it
and when we've got policies and
procedures we apply those to staff and
third parties on the left hand side
so we can't expect staff employees
human beings
to do the right thing if we don't tell
them what it is that we expect them to
do yeah so it's part of that
communication framework so it's this
governance risk and compliance
so we've got our policies and we're
going to apply them to staff and staff
and third parties are going to operate
them and hopefully everything is going
hunky-dory
now our policies and procedures
good good for your knowledge
with your knowledge are based on risk
okay so policies and procedures are
based on risk
we're going to take a step back for a
moment
when it comes to
implementing a
standard
there are typically two approaches
risk-based and rule-based
27001
is a risk-based model
and i like it for that reason so what
27001 says is when it comes to controls
you are going to operate the controls
that are appropriate to your business
based on your businesses risk
to a level
that is appropriate to your business and
your business is risk appetite
so it could be the situation that you
don't have certain controls in your
organization
it could be that you have controls in
your organization that other people
would deem to be not sufficient
okay so i'll give you an example
27001 as one of its controls says your
password management system
it doesn't say what that password
management system is you define it so
you could say our password
password management system it's one
character long we never change it
right it's our risk it's our risk
redeemed it's our risk
now i can show you how you would have to
manage and report that and how you'd
have to control that but the theory
stands
you also have
rule-based systems right rule-based
systems are cyber essentials pci dss
to some extent sock what a rule-based
system says is you will have this
control to this level and if you don't
you will fail
there is no no ifs no buts no no no
nothing around it right
so it is within the rounds of
possibility in a risk-based system to
have quite a weak control framework
uh and still certify and pass whereas in
a rule-based system you're going to be
governed by whatever the rule is it's
yes or no black or white tick or fail
but either way i say our policies and
procedures are based on risk
so what what it is that we do as a
business is based on our businesses risk
appetite and how we do it is going to be
based on risk as well
when we have policies and procedures
they are subject to audit they're going
to get checked and they're going to get
checked a lot right
so as a
function
we have to perform internal audits on
our organization at least annually
when we deep dive into some of these
areas you'll see some of the caveats but
i'll touch on it now
if an auditor asks you a question how
have you devised your internal audit
plan the answer is always
based on risk
now the reality may not be that and
again we'll touch on that later
but what they want to see in an internal
audit plan is that the things that are
the most risky to your business have
been audited probably more than once
okay
right so you're going to audit based on
risk if i know you know i don't know if
i'm in a high transaction environment
for financial services
you know and
what could be capacity management maybe
you know was an issue then that might be
an area that i ordered every month just
to keep an eye on it and make sure that
all the controls are working so we've
got policies got procedures based on
risk risk is defined the level that
we're going to implement them and then
we're going to audit them
we're going to internally audit them
you can internally
or you can internally audit
with your with your own staff with your
own self like the head of it could
internally order it it's got limited
value to it what we would say is part of
our implementation is ideally you want
somebody with a level of independence
either somebody in the business whose
job it isn't normally
like to operate that process and
procedure but in our best case scenario
bringing in a consultant like us
when we've got these policies and
procedures that staff are operating in
the middle what you can see is they've
got incidents
now what is an incident an e an incident
is a deviation from a policy or a
procedure
so
in like the audits terms call it a
non-conformity right so what do i mean
by an incident it could be that a policy
says um what we do and actually we found
not to do it
uh or a procedure says something and
we've not followed the steps within the
procedure
so
typical incidents right people leaving a
laptop on a train that's an incident
you know um an outage of your system for
30 minutes that's an incident you know
it's a deviation from the norm
uh
i had a call
yesterday with a client they had
outsourced
uh account provisioning
to a
support company an it support company
and they discovered that the it support
company had been cloning
rather than creating ids from scratch
and they've been cloning senior managers
ids
and allocating them to new starters and
you start as therefore had all the
access rights of the senior manager
and this has been going on for some time
deviation from the norm right
so we've got things will go wrong and
that's fine we expect that right there's
always going to be things that go wrong
so i can find
uh i'm going to perform my risk
assessment i'm going to do my internal
audit and incidents and things are going
to go wrong that bit in the middle
leads into your continual improvement so
we're gonna we're gonna drive a process
now of continual improvement
so 27001 doesn't necessarily expect you
to have everything right day one and
actually baked into it is a process of
continually improving
now we can look further down the line at
the benchmark of what would be expected
for a certification even though it could
be quite low but the concept is we've
got continual improvement
so a continual improvement
is reported to and managed by the
management review team
and again i'll show you the templates
that make that up
so what do i mean by that so if i've
gone through my risk identification and
i've highlighted that there is a risk um
you know there could be a we're going to
open a new office there's no reception
in the office
uh and there's no entry controls so i've
identified a new risk so i've got to do
something about it
so through risk management and risk
treatment and risk treatment i'm either
going to accept the risk
i'm going to reduce it mitigate it
offset it so i'm going to do something
with that risk but the body that makes
that decision is the management review
team the management review team is the
one that reports it so it is the one
that oversees it
when i go through my internal audit and
i go against the controls and i find
that something is wrong or is not
operating effectively then i'm gonna
have to
make a recommendation and something's
gonna have to happen
that goes into the management review
team an incident occurs it could be a
one-off or it may require something
and that something could be
people
it could require time
it might be people need training or
educating i might need tooling i might
need technology
you know there's whatever it is there's
going to be something that needs a
decision to be made and it's the
management review team that would
approve that
so through the processes that i'll show
you and the reporting and all the
templates and how it works
ultimately it's the management review
team that says yes
you can have the resource to do whatever
it is that you need to do we'll plan it
we'll track it we'll manage it or we
accept the risk
and again we've got different levels of
authority on who can approve what levels
of risk but that's roughly the structure
of how it works so you've got this cycle
this continual round and round update
your policies update your procedures
then audit them they didn't quite work
continually improve them update them
roll them out audit them again audit
them again audit them again on and on it
goes
when it comes to your audits
one of the first things is when we come
off of this is i'll talk you through the
process of how 27001 works
but you are going to get externally
audited now external audits for clients
happen in a number of different ways
right they can happen as part of a
certification process
they can happen as part of a onboarding
a new customer
so typically you're going to see
questionnaires requests for certificates
but they can also come and audit you and
review you
um and obviously worst case scenario is
going to come in and audit you as well
but you know hopefully you never get to
that point
so let's look at the framework so that's
how the management of it all hangs
together
so if i look at what does the governor's
framework the top two remain the same
you think of it as an inverted
pyramiding effects but i like to work
bottom up top down but you see where
we're going so the top two remain the
same management is still set in the
direction the management review team is
still ensuring it gets done
what we're looking at now is where does
27001 logically fit within this
structure
and
for me and
through my experiences 27001 forms the
foundation
it is the base level management system
as an organization that i would be
encouraging any any client to go for
first
so there's some debate in uh you know
out there i've got clients that come to
me and they go oh i want to do sop 2
right we want to do sop 2 first
again we can have that discussion but i
would always discourage that and say
let's go 27001 first
if 27001 is on your roadmap let's do it
first then build on it because pretty
much every other standard that you've
got that's out there builds on 27001 as
a framework
so your bolt-ons when we build our
structure you're going to be able to
bolt on gdpr
pci dss
sock
and the way that we're going to do that
and the way that we would encourage to
do that is to build these common modules
i want to create a risk management
approach template structure that is
sufficient to support gdpr and to
support pci and actually it support the
wider business
and i you know many engagements i go on
business will say actually your risk
register is better than the one we use
for the company let's take that and
apply that to the wider business
so we want to build supplier management
in a way that it satisfies all
requirements
policies operating procedures etc
what i mean by the bolt-on section is
and again for knowledge really is that
if something like 27001 says
you need a password management system
based on risk
it could be one character long it could
be no characters long it doesn't care
pci comes along and says oh by the way
your password management system will be
28 billion characters long with all of
this level of complexity in it
you know what oh well that's okay right
it's what it's just like tweak to
whatever an ad setting on a group
whatever you know but we're building up
on that we're building upon that
foundation
gdpr as well so we will have a look at
where that fits but the principles six
maintain adequate security 27001
satisfies a lot of that but there may be
some additional steps that we want to
take just to enhance it a little bit
for
special category data or whatever it is
that the gdpr is
his driving is down
so that's kind of
high level
how it hangs together and that's high
level
where the 27001
fits in within that structure
there's all things you already knew
anything that any questions that you
don't cover
no questions all make sense
perfect
perfect
so hopefully that's just recorded me and
you now which is fine
so in terms of today let's talk about
standards
let's talk about if you were advising
client okay client says oh i want stop
two
we can do more deep dives into
the sort two as well further down the
line
and but they say in general right i'm
looking at doing i'm looking at doing
this top two
pci
so let's understand where these uh
frameworks fit fit within that structure
27001 as we say international standard
for information security management an
international standard
driven by the bsi the british standards
institute an iso standard that is
aligned from a management perspective
with things like 9001 22301 business
continuity so the management structure
actually side of it
you're going to see on more than one
occasion if you're going to a more
complex client you know if i go into one
that's doing 9001 i'm like well you'll
be already having a management structure
you've already got continuum improvement
these things that we can bolt on
together
it is to say it's the baseline right
it's the minimum level
risk-based system minimum level
the main requirement and driver for it
tends to be out of the uk from my
experience so it's very uk and european
centric
if your client is operating within
europe 27 01 is probably the one again
the one they're going to be pushed for
as you start to move across some more
into the americas the americas would be
driven more by a requirement for sock
and it is typically a stock 2
requirement that they have
and you get that of uh you get that out
of australia as well
depending on the size of the
organization that's requesting it
they're probably going to ask for both
so i've got clients in financial
services you know you start working with
the large banks before they're asking
they're just they're asking for both
just straight out of the back
so let's look at or let's look at orders
of magnitude
yes both stand uh both standards can
operate to any organization i deal a lot
though with startups 27 0001 you can
implement pretty well for a startup sort
2 would be a little bit more complex
so
if i look at what does sock 2 do
sock 2 is driven from an accounting
uh practice right so it's an account in
structural framework really and it
actually sits within a broad or a audit
uh accounting audit
process
when it comes to sock there are two
types
there's a sock one audit
and a sock two audit
and we'll cover this again don't worry
but it's just conceptually so the
client's saying to you i want to stop
toward it what does that mean
so you've got an accounting standard
with an accounting audit that goes at
the back of it that can do one of two
things a sock one or a stock two to
start with
a stock one
audit typically is of an organization
that does something that can materially
or fundamentally impact
the financial reporting of that
organization fundamentally it's going to
impact on the accounting reporting of
that organization
soc2
is usually applied to businesses as a
general
control set it's just a general set of
controls
you then have within socked two types of
audit
27001 is a point in time audit
so when we do our order it just looks at
basically the information that it can
see at the time
a sock
one two
but type one audit is a point in time
audit so you get a point in time audit
you're good to go
a sock to audit is a continual audit
for a defined period of time
typically your client is going to take
12 months so what that means is when
they audit it they can say right show me
evidence that it works in january in
february in march in april give me a
sample from november right the rigor
that's associated with it just
absolutely goes goes through the roof
so
differences between different audits
point in time audit point your time
audit and or a continuing order
27001 is a structured framework
right it's got 114 controls in it
dropping to 90 whatever dependent when
it goes when it comes out in its next
iteration
and
sock is not a defined framework
allegedly
so what the sock
requires you to do is for you to define
your controls
and then they will audit you against the
controls that you've defined
typically
it's not quite actually the real world
right because what happens is when you
engage with these uh third-party audit
companies they've got their own portals
and tools and they ask you for
documentation and it's all the standard
stuff right so there is some work to do
to like define controls but ultimately
what they're looking at
is the stuff that we look at day in day
out
but if i look at it conceptually to the
client and client i'm saying look you've
got stock two over here it doesn't have
a set of controls with it you've got
twenty seven thousand one over here it
does so let's implement twenty seven
thousand one eighty percent of what
we're going to need is going to be
delivered by twenty seven thousand and
one and then we'll bolt on the extra
that we need and the extra little bit of
rigor if and when you want to do sop2
no issue
okay
so that's the difference between those
two
pci dss that fits in follows the various
signal stretches about 344 controls
depending on which
level of business you are you do
self-assessment or you do your report on
compliance
we can go through all of that but
fundamentally pci dss is a control set
and depending on what kind of business
you are is what business uh which of
those controls apply is rule-based yes
or no pass or fail um and again that
applies to anything that stores
processes or transmits data
sorry cardholder data yeah
and so again the level of rigor that
goes with that can be quite high start
with 27 0001 build on what you want as
you go through it
if we look at costs
client says i want twenty seven thousand
one
twenty seven thousand one to certify
to get the certificate
is going to range anywhere
between maybe
four
to maybe 12 grand maybe
again it depends on the size of the
business right
so what will happen is when you go for
your 27 0001
certification
they follow a structured format
and it spits out a number of audit days
at the end of it
small organization like me it was three
days i've got a small organization that
are based out of brazil that i'm taking
through at the moment one is aries
they're six people software development
no on-prem
all in the cloud three-day audit yeah
tomorrow i start a stage one audit for a
large uk charity it's a three-day stage
one and a 12-day stage two
massive right
so there is variation in it
but you can get a feel for it that it's
not really
technically it's not not that expensive
so you know a couple of couple of people
in a room if you were to go for it
you're probably going to be looking
around about three and a half four grand
something like that
if i go into the world of sock
depending on what i'm doing my sock one
order it can start at 18 grand just to
take the test
right
and that's for a type one
so again i'm like client right you want
to go for stock two it's complicated
there's no controls we're gonna have to
define them all and it's gonna cost you
probably three times as much as the
twenty seven thousand and one
should we walk before we run run
right let's go down this row and then
and then we'll get to the sock
okay to do a type 2 order bit
you can be in tens of thousands of
pounds
so i've got a uk-based financial company
that's forced to do a top 2 type 2 at
the moment and for them just to take the
test it's 42 000 pounds a year just to
take the test
and they pay me less than that to do the
work
but that's fine
so you you know your your type 2 audits
arranging you know probably late 20s
early 30s all the way up to
40s mid you know mid 40s now there are
influences and factors on that and again
we can discuss those i can guide you
through it but i'm just giving you
orders of magnitude okay when you're
getting a pci dss clearly they'll charge
what they want right 10 again 30 40
ranges to take just to take place
so for me my framework is 27001 build
upon and build upon top of that
let's look at how the
27001
process
works
okay
so what we're going to need to do is
we're going to need to
be
getting our client an accredited
certification many people people out
there that do certifications what you're
looking for is an accredited body
certification
i'm not going to call out the ones that
pretend that they are on or not but
you've got to do your due diligence and
find out
who are the ones that can
so if you look at it from the uk
to get an accredited certification
you're looking at
british standards institute you've got
sgs
um bsi
sgs cfa center for assessment
uh bad british assessment bureau
um
the one that i use a lot and i can make
you an introduction to is approachable
right so the approachable guys
um are absolutely spot on but i i use
approachable
you can google it there are other ones
out lrqa etc but they tend to be they
tend to be the big ones
if you were going to engage with client
i always recommend to client even though
i know they're going to go with
approachable is get three quotes yeah
make make them do the work so you go
there's got the bsi probably got a cfa
and then go approachable and get three
quotes back i can show you
at some point the level of difference
that comes back is it's not that
standard either right
so they're going to send back their fees
and there's some confusion with you that
you've got to work through that once
you've seen a few of them you know what
to look for like
you can see what they're missing right
and you know what's going to hit your
client further down the line because it
isn't straightforward as this is the
price
the way they cut it it can be confusing
so we're going to go we're going to go
to the certification body um
and we're gonna make sure that they're
accredited the accreditation body in the
uk is ucas so it's a ucas accredited
certification body
and you can look on the
ucas website and it will tell you which
ones are underneath that
some of the some of those bodies can
issue certificates elsewhere so i use
approachable they're doing my buenos
air's client they do my america's client
and they do their australia client okay
so at the end of the day as long as it's
an accredited certificate
it kind of doesn't matter
to help your client if you end up with
an international client by using the uk
as a rule and especially using
approachable it will be cheaper
okay
so american auditors for twenty seven
thousand and one can be up to three
times the price of the uk like their day
rates are huge they over egg it it's
just like it yeah it's crazy it's crazy
so i would always take a client get
three quotes definitely
um
and even if i was going to say if i was
in america i'd say get to america in one
one uk and then let's just compare it so
that they can see it we're not telling
them we're not in bed with anybody i
just know what the answer is but i'm
going to help you
to come up with that answer yeah
so i get my i get my credit
certification buddy they then send out a
letter to your client
that says right these are how many staff
have you got how many offices have you
got et cetera
that is the thing that dictates the
number of days so they're trying to
scope it so if you have physical offices
in scope then they will physically visit
those offices it's going to cost you
money right
the more staff you've got again i think
because these guys have got 200 it's
like 11 days
and i'm even me i'm going but it doesn't
make sense because the process is the
process right is it relevant of how many
people
like we're just going to be sat
twiddling our phones for 10 days anyway
that's not the story
so then they're going to quote it and
then they're going to come back on you
things to look out for in quotes
right there's going to be a
stage 1 and a stage 2 audit
that makes up the certification process
the stage one audit is the one that's
one or two days it's the smaller of the
two audits
the stage one audit looks at do you have
documentation in place
primarily
is the information security management
system evidenced as being implemented
operating effectively and does it look
like you've done some documentation on
your annex a controls but it's
predominantly looking at the information
security management system
the stage two audit
is
pretty much fundamentally a walkthrough
of the annex a controls with a show me
the auditor
can only ever audit
what we tell them
right
so when we're going to go through our
process over the coming weeks and we say
about documenting procedures
we always tell client document what you
do
not what you think i want to hear
right
document the reality of your world right
now because what the audit is going to
do is go show me that piece of paper and
then they're going to read it and go it
says here that you get to work at nine
o'clock and then you go
yeah i normally get in at 10. you go
right well you failed
like why why did you write down you're
getting at nine when you don't you know
you don't come in until ten why didn't
you put that you come in at ten
so that's what they're gonna do in stage
two they're gonna go through line by
line what it is that you say you do so
that you can evidence and prove
so they're going to quote you for your
certificate on your stage one and your
stage two
when we do our certificate it goes on
this three year cycle
so we have an annual cost now with the
certification body to do a continuing an
assessment audit
a cav
or a continuing audit
what that means is that every year
they're going to come back and do a
subset of those controls
for a small organization
typically a day a day and a half two
days you know if i had a six day audit
i'd probably expect my calf to be around
about two days
in reality and they're going to choose
the controls that they order based on
risk that's what they're going to tell
you but they haven't they've got a
standard template and it'll be whatever
it is that they're going to award it in
that year
so they'll just do they'll just do a
kicking of the tires and making sure
that things are running but they're
going to charge you for it right
so the fees that you're looking out for
are what are my continuing audit fees
some certification bodies won't tell you
that when you sign up to take the
certificate they'll say oh we'll let you
know when you've got your certificate
but not you right because then they've
got you over about you're in then so you
want to know transparency is what is my
annual ongoing audit fee
so once you know that you've got a good
grasp then pretty much of where you're
going to be landing for your client some
of them will include that some of them
will exclude that
some of them will add services that you
don't need the bsi horrendous for it oh
we're going to give you access to this
portal and this system and we're going
to do this management and we're going to
charge you a 10 project fee and we're
going and you're like whoa
by the time you you know every time
you've gone through it again you're in
that 15 grand mark for what i can get
through approachable for probably six
seven eight i mean it's layering on
what you need though you need the stage
one stage two certification audit
and you need the cav
and then you're asking them and you're
looking out for hidden fees
when we engage with a third party to do
the 27001 order it can take up to 12
weeks
but really you're just at the mercy of
their availability
so they've got auditors
their availability is going to dictate
it
if like me you can end up in a good
relationship with the certification body
of your choice then you're going to be
in a position then where eventually that
things will be a little bit easier so
you get if you get cancellation can i go
to the top of the list you know work
well with these people then they'll work
well back with you it isn't about like
getting any special favors but it's just
about smoothing the wheels a little bit
so sometimes you can fast track your
client a little bit through if you're a
bit more flexible uh flexible with it
but if set the expectation client is
always like how long is it going to get
how long is it going to take me
i'm going to say again it's going to
depend on the certification body
then it's going to depend on your
ability to implement an evidence the
annex a controls
let's say three months let's set three
months is a realistic timeline to do
that
his client then comes back and says can
we do it in 10 days can we do it a month
ago yes we can
but once we start to look at what is
involved in it it's dependent on them to
write all these procedures down and
evidence that they're doing what they're
doing so i can do my bit no problem but
you've got to be able to keep up with me
so we've got that certification process
the certificate won't again it depends
on how lazy they are you know you might
not get the certificate back for maybe
four or six weeks after you've taken the
last audit
so again clients expectation in january
i'm going to have a bit of paper by the
end of january not going to happen even
if it's march before we do the
certificate to do this two stages of
order could be april before you even get
the piece of paper
so that's worth knowing
what i do with a client is
say normally if you have a conversation
so client says we need it go back to the
person that's requesting it and say if i
get an engagement letter from the
certification body
that shows that i've paid my
upfront bill
and i show you my commitment dates
and i
explain to you that i brought in high
table or whoever
and show you i'm on the journey will
that be enough
and
nine times out of ten it will right most
if a customer is engaging with your
client normally it's because they want
their services so if they can show that
they're going in the right direction
they can show they've got the dates
they've got a letter-headed letter from
the certification body everything's
booked in they can see yep you spent
money on consultants we can see you
doing the right thing then they might
let it slide and say okay we can wait
till april for a bit of paper because we
can see that you're on that journey yeah
so again that's
just
based on experience really
you can feed back to people uh
and let them know
yeah i mean i've done like i do a lot of
work with the hsc here which is the
equivalent of the nhs
part of my job is is
reviewing it security questionnaires
yeah we always get you know yeah we are
on the road to iso certification
it's like okay show me
yeah because i can have fun oh i've got
long blonde uh
yeah yeah ferrari but
no you do you do you do the right thing
and again we can
stuff that you already know but again
it's worth chewing the
like indicators at this at this point
i'm looking at it as being an advocate
of my client i can flip it to the other
side because again i externally audit
people and then you can go these are the
key red flags and then as we go through
the process you can see
how to counter the key red flags to be
the advocate of your customer
it is you know it is what it is right
that's how it depends what it depends
where you want to fit
so in terms of today i want to overload
with knowledge right so what we've gone
through we've gone through this is again
just some base principles this is how a
governance risk and compliance framework
looks like some of the reasoning about
why we need the management buy-in the
structure that would sit under it and
then that role of continual improvement
we've touched on the types of different
standards that are out there and the
different approaches that they take
point in time audit continual audit risk
based audit versus rule-based
audit and we've touched on the process
and the engagement of how we will
deliver 27001 certification for client
and from the certification point of view
we had a look at the difference between
uk and non-uk costs
um and timelines
three quotes as an approach and now
you've got the if you haven't spoke to
them before approachable or my go-to
and you've got that as well in terms of
some practical things that you could do
if you ever got to the point where you
were going to certify
out of everything we've covered today is
there anything else is there anything
that's come up as question or no it all
makes sense you know the government's
framework it makes sense
um
it's really handy to know in term the
timeline stuff is really handy to know
the costs stuff is really handy to know
um
you know i haven't come across
approachable but you know
i've come across
bsi in terms of them
some of their quotations for data
protection stuff here
it's over the top right yeah it's over
the top so what yeah i mean it's up at
the top and to be fair when you're
getting a sock too i have i have some
conversation with the sort of audio it's
supply and demand and i'm like what is
it that you're going to do they come to
me
right so my client every year 10 days of
order 10 days of audit that's i've audit
audit and then it's pre-audit that
happens before that and i'm like okay so
what you're going to do can you upload
all this document into a portal i'm like
okay but what are you gonna do like i
know what you're gonna do why are you
charging my client 40 000 pounds
right for what is that best five days
worth at best yeah
and the answer is because we can and you
go well that's fine too
so if you look at the stretcher i mean
we're going off on a little bit of a
deviate deviation i think i've probably
spent a little bit of time with it on
your neck on the next chord really which
is what is your role right so what is
what are the roles that are at play
in fact let's pick that up next time
what are the roles that are at play in
terms of an engagement and an audit
and then what is everybody's perspective
and then what is the reality of what is
going on and then how do you manage that
so let's have a look at we'll have a
look at that next time i'll give you
because you know anyway but it'll give
you some insights into that
super
Browse More Related Video
Introduction to risk management frameworks
ISO 27001 - ENTENDA DE VEZ!
How to implement ISO 27001 Walkthrough - Part 1
How to implement ISO 27001 Annex A 5.1 Policies for Information Security
SERTIFIKASI ISO 9001? BERIKUT HAL YANG PERLU DIPERSIAPKAN! | BISNIS | DCONSULTING
IT Security Governance Overview