ISO 27001 Getting Started | Everything you need to know | ISO 27001 Basics

Summary

The video script offers an in-depth exploration of the governance risk and compliance framework, focusing on the implementation of ISO 27001. It emphasizes the importance of senior management buy-in and establishing a management review team to ensure policies and procedures are aligned with business risks. The speaker compares ISO 27001 with other standards like SOC 2 and PCI DSS, highlighting the differences in audit approaches—point in time versus continuous auditing, and risk-based versus rule-based frameworks. The script also provides practical advice on engaging with certification bodies and managing client expectations throughout the certification process, including costs and timelines.

Takeaways

• 📈 Senior Management Buy-in: The importance of having top-level leadership support for any governance, risk, and compliance framework, including ISO 27001, cannot be overstated.
• 🔑 Management Review Team: A key component of the framework is the establishment of a management review team that ensures policies and procedures are implemented and followed across the organization.
• 🛡️ Risk-Based Approach: ISO 27001 is a risk-based model, meaning that controls are tailored to the specific risks and business needs, rather than a one-size-fits-all rule-based approach.
• 🔒 Policies and Procedures: Clear distinction is made between policies (what the organization does) and procedures (how it is done), which are based on risk and subject to regular audits.
• 🔍 Internal Audits: Organizations must perform internal audits at least annually, focusing on the most risky aspects of the business to ensure compliance with policies and procedures.
• 🚫 Incident Management: Incidents, or deviations from policy or procedure, are expected and managed as part of the continual improvement process.
• 🔄 Continual Improvement: The script emphasizes the need for ongoing assessment and enhancement of policies and procedures to adapt to new risks and challenges.
• 🌐 International Standard: ISO 27001 is an internationally recognized standard for information security management, making it a valuable asset for global businesses.
• 💰 Cost Considerations: The costs associated with ISO 27001 certification can vary widely based on the size of the organization and the certification body chosen.
• ⏱️ Timelines for Certification: The process of achieving ISO 27001 certification can take up to 12 weeks or more, depending on the certification body's availability and the organization's preparedness.
• 🔑 Accurate Documentation: It is crucial to document current practices accurately, as auditors will verify these against the documented procedures, with discrepancies potentially leading to audit failures.

Q & A

What is the primary purpose of implementing ISO 27001?

ISO 27001 is typically implemented due to commercial requirements, as it provides a framework for information security management systems (ISMS) and helps ensure that an organization's information assets are adequately protected.

Why is senior management buy-in crucial for the success of an ISO 27001 implementation?

Senior management buy-in is essential because it sets the direction for the organization and ensures a culture of top-down leadership. Without it, there can be struggles with political, budgetary, and resource allocation issues, which are critical for successful implementation.

What is the role of a management review team in the context of ISO 27001?

A management review team oversees and approves policies and procedures, ensuring that tasks related to the ISMS are completed effectively. It represents different areas of the business and is responsible for continual improvement and addressing any deviations or incidents.

How does the concept of 'policies' differ from 'procedures' in the script's context?

Policies are statements of what an organization does, set by the leadership, while procedures are statements of how tasks are carried out within the organization. There is a conceptual separation where policies define the 'what' and procedures define the 'how'.

What is the significance of risk-based versus rule-based approaches in the context of ISO 27001?

ISO 27001 adopts a risk-based approach, which means that the controls are tailored to the specific risks and risk appetite of the business. This contrasts with rule-based systems like PCI DSS, which have specific, mandatory controls that must be implemented regardless of the business's risk profile.

How does the script differentiate between an incident and an audit?

An incident is a deviation from a policy or procedure, such as a security breach or a system outage. An audit, on the other hand, is a systematic review of policies and procedures to ensure they are being followed and are effective, based on risk.

What is the importance of continual improvement in the ISO 27001 framework?

Continual improvement is a core concept in ISO 27001, emphasizing the need for an organization to constantly evaluate and enhance its ISMS. This process is managed by the management review team and involves addressing risks, audit findings, and incidents.

How does the script describe the process of external audits in relation to ISO 27001?

External audits are conducted by accredited certification bodies and can occur as part of the certification process, customer onboarding, or regulatory requirements. They assess the organization's compliance with ISO 27001 standards.

What are the key differences between ISO 27001, SOC 2, and PCI DSS as discussed in the script?

ISO 27001 is an international risk-based standard for ISMS. SOC 2 is an auditing procedure that assesses service organizations, with Type I being a point-in-time audit and Type II being a continuous audit over a defined period. PCI DSS is a rule-based standard specifically focused on entities that store, process, or transmit cardholder data.

Why does the script suggest starting with ISO 27001 before pursuing other standards like SOC 2 or PCI DSS?

The script suggests starting with ISO 27001 because it provides a foundational management system that can be built upon. Other standards like SOC 2 and PCI DSS often require controls that are already covered by ISO 27001, making it a more efficient starting point.

Outlines

00:00

📚 Introduction to Governance, Risk, and Compliance

The speaker introduces the concept of governance, risk, and compliance (GRC) and explains how ISO 27001 fits into this framework. The discussion highlights the importance of senior management buy-in for a successful implementation of ISO 27001. It emphasizes establishing a top-down leadership culture and the challenges that arise without executive support. The speaker also outlines the structure for a management review team, which is crucial for ensuring that tasks are completed and that policies and procedures are overseen and approved. The talk also touches on the separation of policies and procedures, with policies being high-level statements of what the organization does, and procedures detailing how it is done.

05:01

🔒 The Importance of Policy and Procedure Distinction

This paragraph delves deeper into the distinction between policies and procedures. Policies are defined as high-level statements set by leadership, dictating what the organization does, such as implementing antivirus on every machine. Procedures, on the other hand, are detailed instructions on how to execute these policies, like setting up automatic scans and defining protocols for alerts. The speaker stresses the need for clear separation to allow for better documentation and management. Additionally, the paragraph discusses the importance of these documents in meeting client demands and due diligence processes, as well as the risk-based approach of ISO 27001, which allows organizations to implement controls appropriate to their specific risks and business needs.

10:04

👀 Auditing and Incident Management in ISO 27001

The speaker discusses the auditing process and incident management within the context of ISO 27001. Policies and procedures are subject to regular audits to ensure they are effective and aligned with the organization's risk profile. The auditing process is based on risk, with more critical areas being audited more frequently. Incidents are defined as deviations from policy or procedure, and they are an expected part of the continual improvement process. The management review team plays a key role in addressing incidents and driving the process of continual improvement, which is a core aspect of ISO 27001. The speaker also mentions the importance of having a risk-based approach to controls and the flexibility it provides compared to rule-based systems.

15:05

🛠️ Continual Improvement and External Audits in ISO 27001

Continual improvement is a key component of ISO 27001, and this paragraph explains how it is managed and reported by the management review team. The speaker describes the process of identifying, assessing, and treating risks, as well as the role of internal audits in this process. Incidents that occur are also addressed by the management review team, which makes decisions on necessary actions, such as resource allocation or policy updates. External audits are also discussed, highlighting the different contexts in which they may occur, such as part of a certification process or as a requirement from a new customer. The speaker emphasizes the cyclical nature of updating, auditing, and improving policies and procedures.

20:06

🏗️ Building a Structured Approach to Compliance

The speaker provides an overview of how to build a structured approach to compliance, starting with ISO 27001 as the foundational management system. The paragraph explains the concept of 'bolting on' additional standards and frameworks, such as GDPR and PCI DSS, to the base ISO 27001 framework. This approach allows for a comprehensive and scalable compliance structure that can adapt to various regulatory requirements. The speaker also discusses the importance of common modules and the benefits of starting with ISO 27001 before moving on to other standards.

25:07

📈 Understanding Different Audit Frameworks and Standards

This paragraph explores various audit frameworks and standards, such as ISO 27001, SOC 2, and PCI DSS. The speaker explains the differences between these standards, including their geographical focus, the nature of their audit processes (point in time vs. continual), and their management structure. The discussion also touches on the complexity and cost implications of implementing and certifying these standards, with a particular focus on the rigorous and costly process associated with SOC 2 Type 2 audits compared to the more structured and generally less expensive ISO 27001 certification.

30:07

💰 Costs and Processes Associated with ISO 27001 Certification

The speaker discusses the costs and processes involved in obtaining ISO 27001 certification. They mention that certification costs can vary depending on the size of the business and the certification body chosen. The paragraph outlines the importance of getting multiple quotes and highlights the potential for significant cost differences between certification bodies. The speaker also emphasizes the need for transparency in ongoing audit fees and warns against hidden fees or unnecessary services. The paragraph concludes with advice on setting realistic expectations for the certification timeline and the process involved in achieving certification.

35:07

⏱️ Timeline and Expectation Management for ISO 27001 Certification

The speaker provides insight into the timeline and expectation management for clients pursuing ISO 27001 certification. They explain that the certification process can take up to 12 weeks but is dependent on the certification body's availability and the client's ability to implement and evidence the required controls. The speaker advises setting a realistic timeline of about three months for implementation and emphasizes the importance of managing client expectations regarding the time it takes to receive the actual certificate. They also suggest strategies for安抚 clients who may be requesting the certification, such as showing commitment dates and engagement letters from the certification body as proof of progress.

40:08

🛡️ The Role of Advocacy in the Certification Process

In this final paragraph, the speaker reflects on their role as an advocate for their clients during the certification process. They discuss the importance of countering key red flags and ensuring that clients are well-represented and informed. The speaker also hints at a future discussion about the roles involved in an engagement and audit, the perspectives of different stakeholders, and the realities of the situation. They aim to provide insights that can help manage the complexities of the certification process.

Keywords

💡Governance Risk and Compliance (GRC)

Governance Risk and Compliance refers to the framework that organizations use to ensure they operate in a manner that is compliant with laws and regulations, manages risk effectively, and is accountable to stakeholders. In the script, GRC is the overarching theme, with the discussion focusing on how ISO 27001 fits into this framework, emphasizing the importance of senior management buy-in and a top-down approach to leadership for successful implementation.

💡ISO 27001

ISO 27001 is an international standard for information security management systems (ISMS). It provides a systematic approach to managing an organization's sensitive information in a secure manner. The script discusses how ISO 27001 is implemented within the GRC framework and how it serves as a foundation for other standards and frameworks, such as GDPR and PCI DSS.

💡Management Review Team

A Management Review Team is a group within an organization that oversees and approves policies and procedures. In the context of the script, this team is crucial for ensuring that the organization's actions align with its policies, and it plays a key role in the continual improvement process, which is central to the ISO 27001 standard.

💡Policies and Procedures

Policies and procedures are the documented rules and steps that govern an organization's operations. Policies state what the organization aims to achieve, while procedures detail how to achieve it. The script explains the importance of separating policies and procedures and how they are applied to staff and third parties within the organization.

💡Risk-Based vs. Rule-Based

The script distinguishes between risk-based and rule-based approaches to implementing standards. Risk-based approaches, like ISO 27001, involve determining appropriate controls based on an organization's specific risks and risk appetite. In contrast, rule-based systems, such as PCI DSS, have predefined controls that must be met without flexibility. Understanding this distinction is crucial for organizations when choosing which standards to implement.

💡Internal Audit

An internal audit is a process where an organization examines and evaluates its own policies, procedures, and operations to ensure they are effective and compliant with regulations. The script mentions that internal audits are based on risk and are a critical part of the continual improvement process under ISO 27001.

💡Continual Improvement

Continual improvement is the ongoing process of enhancing an organization's performance and operations. In the script, it is highlighted as a key component of the ISO 27001 standard, with the management review team playing a central role in overseeing and managing this process.

💡Incident Management

Incident management refers to the process of identifying, reporting, and addressing deviations from policies or procedures, known as incidents. The script explains that incidents are expected and form part of the continual improvement cycle, where they are reported to and managed by the management review team.

💡External Audit

An external audit involves an independent third party reviewing an organization's systems, processes, and documentation to verify compliance with standards like ISO 27001. The script discusses the process of engaging with external auditors and the importance of preparing for these audits as part of the certification process.

💡Certification Body

A certification body is an organization that provides official certification to companies that meet specific standards, such as ISO 27001. The script mentions the importance of selecting an accredited certification body and getting quotes from different bodies to ensure a fair and transparent process.

💡Stage 1 and Stage 2 Audit

The certification process for ISO 27001 typically involves two stages. Stage 1 focuses on evaluating the documentation and initial implementation of the ISMS, while Stage 2 involves a more in-depth audit of the actual implementation and operation of the controls. The script explains the importance of both stages in achieving certification.

Highlights

Governor's risk and compliance framework integration with ISO 27001 for effective information security management.

Importance of senior management buy-in for successful implementation of ISO 27001.

Establishing a management review team for oversight and approval of policies and procedures.

Conceptual separation of policies and procedures for clarity and effectiveness.

Risk-based approach of ISO 27001 allowing flexibility in control implementation based on business needs.

Difference between risk-based and rule-based systems exemplified by ISO 27001 and PCI DSS.

Internal audit processes and their significance in maintaining and improving policies and procedures.

Incident management as a deviation from policy or procedure and its role in continual improvement.

Management review team's responsibility in addressing continual improvement and resource allocation.

External audits' role in the certification process and their impact on client engagements.

Foundational role of ISO 27001 in the governance framework and its compatibility with other standards.

Bolt-on approach to integrating additional standards like GDPR and PCI DSS on top of ISO 27001.

Comparative analysis of ISO 27001, SOC 2, and PCI DSS in terms of implementation complexity and cost.

Advantages of starting with ISO 27001 before pursuing SOC 2 or PCI DSS certifications.

Cost implications and the importance of obtaining multiple quotes for certification audits.

The certification process timeline, including stages 1 and 2 audits, and annual continuing assessments.

Strategic approach to dealing with clients expecting rapid certification and setting realistic expectations.

Recommendation to use an accredited certification body and the benefits of comparing different providers.

Transcripts

so what you're going to see here is the

um

this is how i see governor's risk and

compliance working and this is how 27001

sits into that governance risk and

compliance framework

so

when we're doing a

27001

implementation

normally

people are going to be doing it because

they've been uh driven by a commercial

requirement we'll come back to that as

well so what they want to understand is

how does 27001

fit

what we have when we develop a

governance risk and confront compliance

framework is we're doing it in more

generally

so we are going to implement specifics

in for 27 0001 but we are going to try

and put something in that's a little bit

more general i'll do that so i can see

be awkward when you record it because

it's going to be recording you recording

me recording you but anyway

so uh so yeah so we're going to put in

something that's a little bit more

general so this will apply no matter

what standard you're implementing you

know and technically it would apply if

you were doing a data protection

implementation you know you're going to

be doing 9001 pci dss stock one sort two

whatever it is it's going to be

so what all of the standards and all of

the frameworks i'm looking for is that

senior management buy-in so what we have

is at the top level we've got senior

management and senior management needs

to set the direction of the organization

there are things that that we can do

we'll talk about role

uh in a little while but there are

things that we can do to help to

evidence that

but what you're hoping for is that when

you go into an organization there is a

culture of top-down leadership that

there is top-down buy-in

you are going to struggle in any

organization where your engagement is

either sea level or even below

so if the demand or the requirement is

coming from like a pro a product manager

a development manager a network manager

and even head of ops you know on his own

or her own then you are going to

struggle with it and and it's mainly

around politics it's going to be around

budget it's around getting buy-in and

resources to do what it is that that

needs to be done

so in very very practical terms you need

that senior management buy-in

and leadership from the top if i'm

engaging on a project i want at least

one of those

uh senior members uh sitting in in my

management meetings and we'll talk about

them as well as it goes for a bit

so senior management at the top sets the

direction underneath that we're going to

implement the concept of a management

review team now some companies have this

already this terminology will come up

time and time again

depending on the size of it there may be

an existing structure that you can

hijack and that you can jump off of the

back of

even in those environments even in

larger organizations i'm still mind

minded to create what i call a

management review team okay

so what the management review team is is

it ensures that things get done

now when i build the management review

team i'm going to share with you all of

the templates and documents as we go

through

when i when i set up a management review

team i want on that management review

team a representative of each area of

the business ideally so i'm looking for

somebody from hr i'm looking for that

one senior leadership manager that's

going to buy in i'm looking for

representation from it

if i've got a software development

function i want somebody from software

development call center ops whatever it

is so the size of the organization

now in a smaller organization it might

only be two of you and that's mine too

right you know but we just got to have

this we've got to have this structure

now the standard is going to call to

that as well so it's going to say right

i i need you to demonstrate certain

things i need you to demonstrate clearly

buying and this is one of the ways of

the way that we do it and we want to

demonstrate in communication we want you

to demonstrate things like continual

improvement so there are a number of

things that that need to happen that

this management review team is going to

satisfy and again we haven't even really

got to a standard yet right but in those

in those principles so we've got this

management review team

so what do they do

so they oversee

and they approve

policies and procedures

at the end of the day that is on the

left-hand side of this cycle that is

what that management review team is

doing depending on the size of the

organization they may be doing the doing

so they may be writing it and then they

may be improving it that's fine that's

fine but there's a conceptual separation

that the management review team oversees

and approves policies and procedures

in our world or in my world from a

practical perspective i separate out for

client policy and procedure

a policy is a statement of what we do

a procedure is a statement of how we do

it

and i separate those now what you find

when you go on a client is you're going

to find a mix

so if they try to do it themselves or

depending on where they're coming from

you might have some that's policy

statement uh mixed in with some process

statement uh and it can be a little bit

messy

okay a couple of reasons why i want to

do that the policies about what we do if

you think about it in from a

hierarchical point of view is going to

be set by the leadership right the

management they say what do we do well

we do antivirus on every machine

antivirus you know reports up to central

management

uh

is set to you know auto

disinfect like we want antibiotic we

want decentralized managed um antivirus

so it's a statement of what we do it

doesn't say we use symantec we log on we

download definition files every 24 hours

we set auto scan to run at 7 30 in the

morning if an alert comes it goes to bob

in it at this email address bobbin it

then does this and raises a ticket with

it it's a complete separation now

what that allows us to do as i say is we

can give bob

the uh sorry the the framework for him

to record what he does and we can give

the managers the framework to record a

high level what we do bob is doing how

we do it

what you're also going to find is that

pretty much every client that your

client engages with wants policies

so what they're going to say to your

client is i want a data protection

policy i want a clear desk policy i want

a working from home bring your own

device change management software

development

policy

so what we want to be able to do is

we're going to build our policy suite in

such a way

that it

makes their life easier right

it'll kind of make clients life a little

bit a little bit easier but it's all

about making the the

the requesters life easier so if they

say if you've got software development

on policy costs we have here you go bang

and it's written in a way that looks

like a software development policy they

can understand it

and they can respond to it

so we've got these policies that say say

what we do what we haven't then included

in it is all this personal information

right there's all bob's email addresses

in there

you know if we had a business continuity

policy and it said all right this is our

emergency call tree in the policy i

can't share that as part of a due

diligence on boarding

so we've got these policies what we do

we've got procedures within our

organization about how we go about doing

it

and when we've got policies and

procedures we apply those to staff and

third parties on the left hand side

so we can't expect staff employees

human beings

to do the right thing if we don't tell

them what it is that we expect them to

do yeah so it's part of that

communication framework so it's this

governance risk and compliance

so we've got our policies and we're

going to apply them to staff and staff

and third parties are going to operate

them and hopefully everything is going

hunky-dory

now our policies and procedures

good good for your knowledge

with your knowledge are based on risk

okay so policies and procedures are

based on risk

we're going to take a step back for a

moment

when it comes to

implementing a

standard

there are typically two approaches

risk-based and rule-based

27001

is a risk-based model

and i like it for that reason so what

27001 says is when it comes to controls

you are going to operate the controls

that are appropriate to your business

based on your businesses risk

to a level

that is appropriate to your business and

your business is risk appetite

so it could be the situation that you

don't have certain controls in your

organization

it could be that you have controls in

your organization that other people

would deem to be not sufficient

okay so i'll give you an example

27001 as one of its controls says your

password management system

it doesn't say what that password

management system is you define it so

you could say our password

password management system it's one

character long we never change it

right it's our risk it's our risk

redeemed it's our risk

now i can show you how you would have to

manage and report that and how you'd

have to control that but the theory

stands

you also have

rule-based systems right rule-based

systems are cyber essentials pci dss

to some extent sock what a rule-based

system says is you will have this

control to this level and if you don't

you will fail

there is no no ifs no buts no no no

nothing around it right

so it is within the rounds of

possibility in a risk-based system to

have quite a weak control framework

uh and still certify and pass whereas in

a rule-based system you're going to be

governed by whatever the rule is it's

yes or no black or white tick or fail

but either way i say our policies and

procedures are based on risk

so what what it is that we do as a

business is based on our businesses risk

appetite and how we do it is going to be

based on risk as well

when we have policies and procedures

they are subject to audit they're going

to get checked and they're going to get

checked a lot right

so as a

function

we have to perform internal audits on

our organization at least annually

when we deep dive into some of these

areas you'll see some of the caveats but

i'll touch on it now

if an auditor asks you a question how

have you devised your internal audit

plan the answer is always

based on risk

now the reality may not be that and

again we'll touch on that later

but what they want to see in an internal

audit plan is that the things that are

the most risky to your business have

been audited probably more than once

okay

right so you're going to audit based on

risk if i know you know i don't know if

i'm in a high transaction environment

for financial services

you know and

what could be capacity management maybe

you know was an issue then that might be

an area that i ordered every month just

to keep an eye on it and make sure that

all the controls are working so we've

got policies got procedures based on

risk risk is defined the level that

we're going to implement them and then

we're going to audit them

we're going to internally audit them

you can internally

or you can internally audit

with your with your own staff with your

own self like the head of it could

internally order it it's got limited

value to it what we would say is part of

our implementation is ideally you want

somebody with a level of independence

either somebody in the business whose

job it isn't normally

like to operate that process and

procedure but in our best case scenario

bringing in a consultant like us

when we've got these policies and

procedures that staff are operating in

the middle what you can see is they've

got incidents

now what is an incident an e an incident

is a deviation from a policy or a

procedure

so

in like the audits terms call it a

non-conformity right so what do i mean

by an incident it could be that a policy

says um what we do and actually we found

not to do it

uh or a procedure says something and

we've not followed the steps within the

procedure

so

typical incidents right people leaving a

laptop on a train that's an incident

you know um an outage of your system for

30 minutes that's an incident you know

it's a deviation from the norm

uh

i had a call

yesterday with a client they had

outsourced

uh account provisioning

to a

support company an it support company

and they discovered that the it support

company had been cloning

rather than creating ids from scratch

and they've been cloning senior managers

ids

and allocating them to new starters and

you start as therefore had all the

access rights of the senior manager

and this has been going on for some time

deviation from the norm right

so we've got things will go wrong and

that's fine we expect that right there's

always going to be things that go wrong

so i can find

uh i'm going to perform my risk

assessment i'm going to do my internal

audit and incidents and things are going

to go wrong that bit in the middle

leads into your continual improvement so

we're gonna we're gonna drive a process

now of continual improvement

so 27001 doesn't necessarily expect you

to have everything right day one and

actually baked into it is a process of

continually improving

now we can look further down the line at

the benchmark of what would be expected

for a certification even though it could

be quite low but the concept is we've

got continual improvement

so a continual improvement

is reported to and managed by the

management review team

and again i'll show you the templates

that make that up

so what do i mean by that so if i've

gone through my risk identification and

i've highlighted that there is a risk um

you know there could be a we're going to

open a new office there's no reception

in the office

uh and there's no entry controls so i've

identified a new risk so i've got to do

something about it

so through risk management and risk

treatment and risk treatment i'm either

going to accept the risk

i'm going to reduce it mitigate it

offset it so i'm going to do something

with that risk but the body that makes

that decision is the management review

team the management review team is the

one that reports it so it is the one

that oversees it

when i go through my internal audit and

i go against the controls and i find

that something is wrong or is not

operating effectively then i'm gonna

have to

make a recommendation and something's

gonna have to happen

that goes into the management review

team an incident occurs it could be a

one-off or it may require something

and that something could be

people

it could require time

it might be people need training or

educating i might need tooling i might

need technology

you know there's whatever it is there's

going to be something that needs a

decision to be made and it's the

management review team that would

approve that

so through the processes that i'll show

you and the reporting and all the

templates and how it works

ultimately it's the management review

team that says yes

you can have the resource to do whatever

it is that you need to do we'll plan it

we'll track it we'll manage it or we

accept the risk

and again we've got different levels of

authority on who can approve what levels

of risk but that's roughly the structure

of how it works so you've got this cycle

this continual round and round update

your policies update your procedures

then audit them they didn't quite work

continually improve them update them

roll them out audit them again audit

them again audit them again on and on it

goes

when it comes to your audits

one of the first things is when we come

off of this is i'll talk you through the

process of how 27001 works

but you are going to get externally

audited now external audits for clients

happen in a number of different ways

right they can happen as part of a

certification process

they can happen as part of a onboarding

a new customer

so typically you're going to see

questionnaires requests for certificates

but they can also come and audit you and

review you

um and obviously worst case scenario is

going to come in and audit you as well

but you know hopefully you never get to

that point

so let's look at the framework so that's

how the management of it all hangs

together

so if i look at what does the governor's

framework the top two remain the same

you think of it as an inverted

pyramiding effects but i like to work

bottom up top down but you see where

we're going so the top two remain the

same management is still set in the

direction the management review team is

still ensuring it gets done

what we're looking at now is where does

27001 logically fit within this

structure

and

for me and

through my experiences 27001 forms the

foundation

it is the base level management system

as an organization that i would be

encouraging any any client to go for

first

so there's some debate in uh you know

out there i've got clients that come to

me and they go oh i want to do sop 2

right we want to do sop 2 first

again we can have that discussion but i

would always discourage that and say

let's go 27001 first

if 27001 is on your roadmap let's do it

first then build on it because pretty

much every other standard that you've

got that's out there builds on 27001 as

a framework

so your bolt-ons when we build our

structure you're going to be able to

bolt on gdpr

pci dss

sock

and the way that we're going to do that

and the way that we would encourage to

do that is to build these common modules

i want to create a risk management

approach template structure that is

sufficient to support gdpr and to

support pci and actually it support the

wider business

and i you know many engagements i go on

business will say actually your risk

register is better than the one we use

for the company let's take that and

apply that to the wider business

so we want to build supplier management

in a way that it satisfies all

requirements

policies operating procedures etc

what i mean by the bolt-on section is

and again for knowledge really is that

if something like 27001 says

you need a password management system

based on risk

it could be one character long it could

be no characters long it doesn't care

pci comes along and says oh by the way

your password management system will be

28 billion characters long with all of

this level of complexity in it

you know what oh well that's okay right

it's what it's just like tweak to

whatever an ad setting on a group

whatever you know but we're building up

on that we're building upon that

foundation

gdpr as well so we will have a look at

where that fits but the principles six

maintain adequate security 27001

satisfies a lot of that but there may be

some additional steps that we want to

take just to enhance it a little bit

for

special category data or whatever it is

that the gdpr is

his driving is down

so that's kind of

high level

how it hangs together and that's high

level

where the 27001

fits in within that structure

there's all things you already knew

anything that any questions that you

don't cover

no questions all make sense

perfect

perfect

so hopefully that's just recorded me and

you now which is fine

so in terms of today let's talk about

standards

let's talk about if you were advising

client okay client says oh i want stop

two

we can do more deep dives into

the sort two as well further down the

line

and but they say in general right i'm

looking at doing i'm looking at doing

this top two

pci

so let's understand where these uh

frameworks fit fit within that structure

27001 as we say international standard

for information security management an

international standard

driven by the bsi the british standards

institute an iso standard that is

aligned from a management perspective

with things like 9001 22301 business

continuity so the management structure

actually side of it

you're going to see on more than one

occasion if you're going to a more

complex client you know if i go into one

that's doing 9001 i'm like well you'll

be already having a management structure

you've already got continuum improvement

these things that we can bolt on

together

it is to say it's the baseline right

it's the minimum level

risk-based system minimum level

the main requirement and driver for it

tends to be out of the uk from my

experience so it's very uk and european

centric

if your client is operating within

europe 27 01 is probably the one again

the one they're going to be pushed for

as you start to move across some more

into the americas the americas would be

driven more by a requirement for sock

and it is typically a stock 2

requirement that they have

and you get that of uh you get that out

of australia as well

depending on the size of the

organization that's requesting it

they're probably going to ask for both

so i've got clients in financial

services you know you start working with

the large banks before they're asking

they're just they're asking for both

just straight out of the back

so let's look at or let's look at orders

of magnitude

yes both stand uh both standards can

operate to any organization i deal a lot

though with startups 27 0001 you can

implement pretty well for a startup sort

2 would be a little bit more complex

so

if i look at what does sock 2 do

sock 2 is driven from an accounting

uh practice right so it's an account in

structural framework really and it

actually sits within a broad or a audit

uh accounting audit

process

when it comes to sock there are two

types

there's a sock one audit

and a sock two audit

and we'll cover this again don't worry

but it's just conceptually so the

client's saying to you i want to stop

toward it what does that mean

so you've got an accounting standard

with an accounting audit that goes at

the back of it that can do one of two

things a sock one or a stock two to

start with

a stock one

audit typically is of an organization

that does something that can materially

or fundamentally impact

the financial reporting of that

organization fundamentally it's going to

impact on the accounting reporting of

that organization

soc2

is usually applied to businesses as a

general

control set it's just a general set of

controls

you then have within socked two types of

audit

27001 is a point in time audit

so when we do our order it just looks at

basically the information that it can

see at the time

a sock

one two

but type one audit is a point in time

audit so you get a point in time audit

you're good to go

a sock to audit is a continual audit

for a defined period of time

typically your client is going to take

12 months so what that means is when

they audit it they can say right show me

evidence that it works in january in

february in march in april give me a

sample from november right the rigor

that's associated with it just

absolutely goes goes through the roof

so

differences between different audits

point in time audit point your time

audit and or a continuing order

27001 is a structured framework

right it's got 114 controls in it

dropping to 90 whatever dependent when

it goes when it comes out in its next

iteration

and

sock is not a defined framework

allegedly

so what the sock

requires you to do is for you to define

your controls

and then they will audit you against the

controls that you've defined

typically

it's not quite actually the real world

right because what happens is when you

engage with these uh third-party audit

companies they've got their own portals

and tools and they ask you for

documentation and it's all the standard

stuff right so there is some work to do

to like define controls but ultimately

what they're looking at

is the stuff that we look at day in day

out

but if i look at it conceptually to the

client and client i'm saying look you've

got stock two over here it doesn't have

a set of controls with it you've got

twenty seven thousand one over here it

does so let's implement twenty seven

thousand one eighty percent of what

we're going to need is going to be

delivered by twenty seven thousand and

one and then we'll bolt on the extra

that we need and the extra little bit of

rigor if and when you want to do sop2

no issue

okay

so that's the difference between those

two

pci dss that fits in follows the various

signal stretches about 344 controls

depending on which

level of business you are you do

self-assessment or you do your report on

compliance

we can go through all of that but

fundamentally pci dss is a control set

and depending on what kind of business

you are is what business uh which of

those controls apply is rule-based yes

or no pass or fail um and again that

applies to anything that stores

processes or transmits data

sorry cardholder data yeah

and so again the level of rigor that

goes with that can be quite high start

with 27 0001 build on what you want as

you go through it

if we look at costs

client says i want twenty seven thousand

one

twenty seven thousand one to certify

to get the certificate

is going to range anywhere

between maybe

four

to maybe 12 grand maybe

again it depends on the size of the

business right

so what will happen is when you go for

your 27 0001

certification

they follow a structured format

and it spits out a number of audit days

at the end of it

small organization like me it was three

days i've got a small organization that

are based out of brazil that i'm taking

through at the moment one is aries

they're six people software development

no on-prem

all in the cloud three-day audit yeah

tomorrow i start a stage one audit for a

large uk charity it's a three-day stage

one and a 12-day stage two

massive right

so there is variation in it

but you can get a feel for it that it's

not really

technically it's not not that expensive

so you know a couple of couple of people

in a room if you were to go for it

you're probably going to be looking

around about three and a half four grand

something like that

if i go into the world of sock

depending on what i'm doing my sock one

order it can start at 18 grand just to

take the test

right

and that's for a type one

so again i'm like client right you want

to go for stock two it's complicated

there's no controls we're gonna have to

define them all and it's gonna cost you

probably three times as much as the

twenty seven thousand and one

should we walk before we run run

right let's go down this row and then

and then we'll get to the sock

okay to do a type 2 order bit

you can be in tens of thousands of

pounds

so i've got a uk-based financial company

that's forced to do a top 2 type 2 at

the moment and for them just to take the

test it's 42 000 pounds a year just to

take the test

and they pay me less than that to do the

work

but that's fine

so you you know your your type 2 audits

arranging you know probably late 20s

early 30s all the way up to

40s mid you know mid 40s now there are

influences and factors on that and again

we can discuss those i can guide you

through it but i'm just giving you

orders of magnitude okay when you're

getting a pci dss clearly they'll charge

what they want right 10 again 30 40

ranges to take just to take place

so for me my framework is 27001 build

upon and build upon top of that

let's look at how the

27001

process

works

okay

so what we're going to need to do is

we're going to need to

be

getting our client an accredited

certification many people people out

there that do certifications what you're

looking for is an accredited body

certification

i'm not going to call out the ones that

pretend that they are on or not but

you've got to do your due diligence and

find out

who are the ones that can

so if you look at it from the uk

to get an accredited certification

you're looking at

british standards institute you've got

sgs

um bsi

sgs cfa center for assessment

uh bad british assessment bureau

um

the one that i use a lot and i can make

you an introduction to is approachable

right so the approachable guys

um are absolutely spot on but i i use

approachable

you can google it there are other ones

out lrqa etc but they tend to be they

tend to be the big ones

if you were going to engage with client

i always recommend to client even though

i know they're going to go with

approachable is get three quotes yeah

make make them do the work so you go

there's got the bsi probably got a cfa

and then go approachable and get three

quotes back i can show you

at some point the level of difference

that comes back is it's not that

standard either right

so they're going to send back their fees

and there's some confusion with you that

you've got to work through that once

you've seen a few of them you know what

to look for like

you can see what they're missing right

and you know what's going to hit your

client further down the line because it

isn't straightforward as this is the

price

the way they cut it it can be confusing

so we're going to go we're going to go

to the certification body um

and we're gonna make sure that they're

accredited the accreditation body in the

uk is ucas so it's a ucas accredited

certification body

and you can look on the

ucas website and it will tell you which

ones are underneath that

some of the some of those bodies can

issue certificates elsewhere so i use

approachable they're doing my buenos

air's client they do my america's client

and they do their australia client okay

so at the end of the day as long as it's

an accredited certificate

it kind of doesn't matter

to help your client if you end up with

an international client by using the uk

as a rule and especially using

approachable it will be cheaper

okay

so american auditors for twenty seven

thousand and one can be up to three

times the price of the uk like their day

rates are huge they over egg it it's

just like it yeah it's crazy it's crazy

so i would always take a client get

three quotes definitely

um

and even if i was going to say if i was

in america i'd say get to america in one

one uk and then let's just compare it so

that they can see it we're not telling

them we're not in bed with anybody i

just know what the answer is but i'm

going to help you

to come up with that answer yeah

so i get my i get my credit

certification buddy they then send out a

letter to your client

that says right these are how many staff

have you got how many offices have you

got et cetera

that is the thing that dictates the

number of days so they're trying to

scope it so if you have physical offices

in scope then they will physically visit

those offices it's going to cost you

money right

the more staff you've got again i think

because these guys have got 200 it's

like 11 days

and i'm even me i'm going but it doesn't

make sense because the process is the

process right is it relevant of how many

people

like we're just going to be sat

twiddling our phones for 10 days anyway

that's not the story

so then they're going to quote it and

then they're going to come back on you

things to look out for in quotes

right there's going to be a

stage 1 and a stage 2 audit

that makes up the certification process

the stage one audit is the one that's

one or two days it's the smaller of the

two audits

the stage one audit looks at do you have

documentation in place

primarily

is the information security management

system evidenced as being implemented

operating effectively and does it look

like you've done some documentation on

your annex a controls but it's

predominantly looking at the information

security management system

the stage two audit

is

pretty much fundamentally a walkthrough

of the annex a controls with a show me

the auditor

can only ever audit

what we tell them

right

so when we're going to go through our

process over the coming weeks and we say

about documenting procedures

we always tell client document what you

do

not what you think i want to hear

right

document the reality of your world right

now because what the audit is going to

do is go show me that piece of paper and

then they're going to read it and go it

says here that you get to work at nine

o'clock and then you go

yeah i normally get in at 10. you go

right well you failed

like why why did you write down you're

getting at nine when you don't you know

you don't come in until ten why didn't

you put that you come in at ten

so that's what they're gonna do in stage

two they're gonna go through line by

line what it is that you say you do so

that you can evidence and prove

so they're going to quote you for your

certificate on your stage one and your

stage two

when we do our certificate it goes on

this three year cycle

so we have an annual cost now with the

certification body to do a continuing an

assessment audit

a cav

or a continuing audit

what that means is that every year

they're going to come back and do a

subset of those controls

for a small organization

typically a day a day and a half two

days you know if i had a six day audit

i'd probably expect my calf to be around

about two days

in reality and they're going to choose

the controls that they order based on

risk that's what they're going to tell

you but they haven't they've got a

standard template and it'll be whatever

it is that they're going to award it in

that year

so they'll just do they'll just do a

kicking of the tires and making sure

that things are running but they're

going to charge you for it right

so the fees that you're looking out for

are what are my continuing audit fees

some certification bodies won't tell you

that when you sign up to take the

certificate they'll say oh we'll let you

know when you've got your certificate

but not you right because then they've

got you over about you're in then so you

want to know transparency is what is my

annual ongoing audit fee

so once you know that you've got a good

grasp then pretty much of where you're

going to be landing for your client some

of them will include that some of them

will exclude that

some of them will add services that you

don't need the bsi horrendous for it oh

we're going to give you access to this

portal and this system and we're going

to do this management and we're going to

charge you a 10 project fee and we're

going and you're like whoa

by the time you you know every time

you've gone through it again you're in

that 15 grand mark for what i can get

through approachable for probably six

seven eight i mean it's layering on

what you need though you need the stage

one stage two certification audit

and you need the cav

and then you're asking them and you're

looking out for hidden fees

when we engage with a third party to do

the 27001 order it can take up to 12

weeks

but really you're just at the mercy of

their availability

so they've got auditors

their availability is going to dictate

it

if like me you can end up in a good

relationship with the certification body

of your choice then you're going to be

in a position then where eventually that

things will be a little bit easier so

you get if you get cancellation can i go

to the top of the list you know work

well with these people then they'll work

well back with you it isn't about like

getting any special favors but it's just

about smoothing the wheels a little bit

so sometimes you can fast track your

client a little bit through if you're a

bit more flexible uh flexible with it

but if set the expectation client is

always like how long is it going to get

how long is it going to take me

i'm going to say again it's going to

depend on the certification body

then it's going to depend on your

ability to implement an evidence the

annex a controls

let's say three months let's set three

months is a realistic timeline to do

that

his client then comes back and says can

we do it in 10 days can we do it a month

ago yes we can

but once we start to look at what is

involved in it it's dependent on them to

write all these procedures down and

evidence that they're doing what they're

doing so i can do my bit no problem but

you've got to be able to keep up with me

so we've got that certification process

the certificate won't again it depends

on how lazy they are you know you might

not get the certificate back for maybe

four or six weeks after you've taken the

last audit

so again clients expectation in january

i'm going to have a bit of paper by the

end of january not going to happen even

if it's march before we do the

certificate to do this two stages of

order could be april before you even get

the piece of paper

so that's worth knowing

what i do with a client is

say normally if you have a conversation

so client says we need it go back to the

person that's requesting it and say if i

get an engagement letter from the

certification body

that shows that i've paid my

upfront bill

and i show you my commitment dates

and i

explain to you that i brought in high

table or whoever

and show you i'm on the journey will

that be enough

and

nine times out of ten it will right most

if a customer is engaging with your

client normally it's because they want

their services so if they can show that

they're going in the right direction

they can show they've got the dates

they've got a letter-headed letter from

the certification body everything's

booked in they can see yep you spent

money on consultants we can see you

doing the right thing then they might

let it slide and say okay we can wait

till april for a bit of paper because we

can see that you're on that journey yeah

so again that's

just

based on experience really

you can feed back to people uh

and let them know

yeah i mean i've done like i do a lot of

work with the hsc here which is the

equivalent of the nhs

part of my job is is

reviewing it security questionnaires

yeah we always get you know yeah we are

on the road to iso certification

it's like okay show me

yeah because i can have fun oh i've got

long blonde uh

yeah yeah ferrari but

no you do you do you do the right thing

and again we can

stuff that you already know but again

it's worth chewing the

like indicators at this at this point

i'm looking at it as being an advocate

of my client i can flip it to the other

side because again i externally audit

people and then you can go these are the

key red flags and then as we go through

the process you can see

how to counter the key red flags to be

the advocate of your customer

it is you know it is what it is right

that's how it depends what it depends

where you want to fit

so in terms of today i want to overload

with knowledge right so what we've gone

through we've gone through this is again

just some base principles this is how a

governance risk and compliance framework

looks like some of the reasoning about

why we need the management buy-in the

structure that would sit under it and

then that role of continual improvement

we've touched on the types of different

standards that are out there and the

different approaches that they take

point in time audit continual audit risk

based audit versus rule-based

audit and we've touched on the process

and the engagement of how we will

deliver 27001 certification for client

and from the certification point of view

we had a look at the difference between

uk and non-uk costs

um and timelines

three quotes as an approach and now

you've got the if you haven't spoke to

them before approachable or my go-to

and you've got that as well in terms of

some practical things that you could do

if you ever got to the point where you

were going to certify

out of everything we've covered today is

there anything else is there anything

that's come up as question or no it all

makes sense you know the government's

framework it makes sense

um

it's really handy to know in term the

timeline stuff is really handy to know

the costs stuff is really handy to know

um

you know i haven't come across

approachable but you know

i've come across

bsi in terms of them

some of their quotations for data

protection stuff here

it's over the top right yeah it's over

the top so what yeah i mean it's up at

the top and to be fair when you're

getting a sock too i have i have some

conversation with the sort of audio it's

supply and demand and i'm like what is

it that you're going to do they come to

me

right so my client every year 10 days of

order 10 days of audit that's i've audit

audit and then it's pre-audit that

happens before that and i'm like okay so

what you're going to do can you upload

all this document into a portal i'm like

okay but what are you gonna do like i

know what you're gonna do why are you

charging my client 40 000 pounds

right for what is that best five days

worth at best yeah

and the answer is because we can and you

go well that's fine too

so if you look at the stretcher i mean

we're going off on a little bit of a

deviate deviation i think i've probably

spent a little bit of time with it on

your neck on the next chord really which

is what is your role right so what is

what are the roles that are at play

in fact let's pick that up next time

what are the roles that are at play in

terms of an engagement and an audit

and then what is everybody's perspective

and then what is the reality of what is

going on and then how do you manage that

so let's have a look at we'll have a

look at that next time i'll give you

because you know anyway but it'll give

you some insights into that

super