ISO 27001 Getting Started | Everything you need to know | ISO 27001 Basics

Stuart Barker
18 Feb 202243:33

Summary

TLDRThe video script offers an in-depth exploration of the governance risk and compliance framework, focusing on the implementation of ISO 27001. It emphasizes the importance of senior management buy-in and establishing a management review team to ensure policies and procedures are aligned with business risks. The speaker compares ISO 27001 with other standards like SOC 2 and PCI DSS, highlighting the differences in audit approachesโ€”point in time versus continuous auditing, and risk-based versus rule-based frameworks. The script also provides practical advice on engaging with certification bodies and managing client expectations throughout the certification process, including costs and timelines.

Takeaways

  • ๐Ÿ“ˆ Senior Management Buy-in: The importance of having top-level leadership support for any governance, risk, and compliance framework, including ISO 27001, cannot be overstated.
  • ๐Ÿ”‘ Management Review Team: A key component of the framework is the establishment of a management review team that ensures policies and procedures are implemented and followed across the organization.
  • ๐Ÿ›ก๏ธ Risk-Based Approach: ISO 27001 is a risk-based model, meaning that controls are tailored to the specific risks and business needs, rather than a one-size-fits-all rule-based approach.
  • ๐Ÿ”’ Policies and Procedures: Clear distinction is made between policies (what the organization does) and procedures (how it is done), which are based on risk and subject to regular audits.
  • ๐Ÿ” Internal Audits: Organizations must perform internal audits at least annually, focusing on the most risky aspects of the business to ensure compliance with policies and procedures.
  • ๐Ÿšซ Incident Management: Incidents, or deviations from policy or procedure, are expected and managed as part of the continual improvement process.
  • ๐Ÿ”„ Continual Improvement: The script emphasizes the need for ongoing assessment and enhancement of policies and procedures to adapt to new risks and challenges.
  • ๐ŸŒ International Standard: ISO 27001 is an internationally recognized standard for information security management, making it a valuable asset for global businesses.
  • ๐Ÿ’ฐ Cost Considerations: The costs associated with ISO 27001 certification can vary widely based on the size of the organization and the certification body chosen.
  • โฑ๏ธ Timelines for Certification: The process of achieving ISO 27001 certification can take up to 12 weeks or more, depending on the certification body's availability and the organization's preparedness.
  • ๐Ÿ”‘ Accurate Documentation: It is crucial to document current practices accurately, as auditors will verify these against the documented procedures, with discrepancies potentially leading to audit failures.

Q & A

  • What is the primary purpose of implementing ISO 27001?

    -ISO 27001 is typically implemented due to commercial requirements, as it provides a framework for information security management systems (ISMS) and helps ensure that an organization's information assets are adequately protected.

  • Why is senior management buy-in crucial for the success of an ISO 27001 implementation?

    -Senior management buy-in is essential because it sets the direction for the organization and ensures a culture of top-down leadership. Without it, there can be struggles with political, budgetary, and resource allocation issues, which are critical for successful implementation.

  • What is the role of a management review team in the context of ISO 27001?

    -A management review team oversees and approves policies and procedures, ensuring that tasks related to the ISMS are completed effectively. It represents different areas of the business and is responsible for continual improvement and addressing any deviations or incidents.

  • How does the concept of 'policies' differ from 'procedures' in the script's context?

    -Policies are statements of what an organization does, set by the leadership, while procedures are statements of how tasks are carried out within the organization. There is a conceptual separation where policies define the 'what' and procedures define the 'how'.

  • What is the significance of risk-based versus rule-based approaches in the context of ISO 27001?

    -ISO 27001 adopts a risk-based approach, which means that the controls are tailored to the specific risks and risk appetite of the business. This contrasts with rule-based systems like PCI DSS, which have specific, mandatory controls that must be implemented regardless of the business's risk profile.

  • How does the script differentiate between an incident and an audit?

    -An incident is a deviation from a policy or procedure, such as a security breach or a system outage. An audit, on the other hand, is a systematic review of policies and procedures to ensure they are being followed and are effective, based on risk.

  • What is the importance of continual improvement in the ISO 27001 framework?

    -Continual improvement is a core concept in ISO 27001, emphasizing the need for an organization to constantly evaluate and enhance its ISMS. This process is managed by the management review team and involves addressing risks, audit findings, and incidents.

  • How does the script describe the process of external audits in relation to ISO 27001?

    -External audits are conducted by accredited certification bodies and can occur as part of the certification process, customer onboarding, or regulatory requirements. They assess the organization's compliance with ISO 27001 standards.

  • What are the key differences between ISO 27001, SOC 2, and PCI DSS as discussed in the script?

    -ISO 27001 is an international risk-based standard for ISMS. SOC 2 is an auditing procedure that assesses service organizations, with Type I being a point-in-time audit and Type II being a continuous audit over a defined period. PCI DSS is a rule-based standard specifically focused on entities that store, process, or transmit cardholder data.

  • Why does the script suggest starting with ISO 27001 before pursuing other standards like SOC 2 or PCI DSS?

    -The script suggests starting with ISO 27001 because it provides a foundational management system that can be built upon. Other standards like SOC 2 and PCI DSS often require controls that are already covered by ISO 27001, making it a more efficient starting point.

Outlines

00:00

๐Ÿ“š Introduction to Governance, Risk, and Compliance

The speaker introduces the concept of governance, risk, and compliance (GRC) and explains how ISO 27001 fits into this framework. The discussion highlights the importance of senior management buy-in for a successful implementation of ISO 27001. It emphasizes establishing a top-down leadership culture and the challenges that arise without executive support. The speaker also outlines the structure for a management review team, which is crucial for ensuring that tasks are completed and that policies and procedures are overseen and approved. The talk also touches on the separation of policies and procedures, with policies being high-level statements of what the organization does, and procedures detailing how it is done.

05:01

๐Ÿ”’ The Importance of Policy and Procedure Distinction

This paragraph delves deeper into the distinction between policies and procedures. Policies are defined as high-level statements set by leadership, dictating what the organization does, such as implementing antivirus on every machine. Procedures, on the other hand, are detailed instructions on how to execute these policies, like setting up automatic scans and defining protocols for alerts. The speaker stresses the need for clear separation to allow for better documentation and management. Additionally, the paragraph discusses the importance of these documents in meeting client demands and due diligence processes, as well as the risk-based approach of ISO 27001, which allows organizations to implement controls appropriate to their specific risks and business needs.

10:04

๐Ÿ‘€ Auditing and Incident Management in ISO 27001

The speaker discusses the auditing process and incident management within the context of ISO 27001. Policies and procedures are subject to regular audits to ensure they are effective and aligned with the organization's risk profile. The auditing process is based on risk, with more critical areas being audited more frequently. Incidents are defined as deviations from policy or procedure, and they are an expected part of the continual improvement process. The management review team plays a key role in addressing incidents and driving the process of continual improvement, which is a core aspect of ISO 27001. The speaker also mentions the importance of having a risk-based approach to controls and the flexibility it provides compared to rule-based systems.

15:05

๐Ÿ› ๏ธ Continual Improvement and External Audits in ISO 27001

Continual improvement is a key component of ISO 27001, and this paragraph explains how it is managed and reported by the management review team. The speaker describes the process of identifying, assessing, and treating risks, as well as the role of internal audits in this process. Incidents that occur are also addressed by the management review team, which makes decisions on necessary actions, such as resource allocation or policy updates. External audits are also discussed, highlighting the different contexts in which they may occur, such as part of a certification process or as a requirement from a new customer. The speaker emphasizes the cyclical nature of updating, auditing, and improving policies and procedures.

20:06

๐Ÿ—๏ธ Building a Structured Approach to Compliance

The speaker provides an overview of how to build a structured approach to compliance, starting with ISO 27001 as the foundational management system. The paragraph explains the concept of 'bolting on' additional standards and frameworks, such as GDPR and PCI DSS, to the base ISO 27001 framework. This approach allows for a comprehensive and scalable compliance structure that can adapt to various regulatory requirements. The speaker also discusses the importance of common modules and the benefits of starting with ISO 27001 before moving on to other standards.

25:07

๐Ÿ“ˆ Understanding Different Audit Frameworks and Standards

This paragraph explores various audit frameworks and standards, such as ISO 27001, SOC 2, and PCI DSS. The speaker explains the differences between these standards, including their geographical focus, the nature of their audit processes (point in time vs. continual), and their management structure. The discussion also touches on the complexity and cost implications of implementing and certifying these standards, with a particular focus on the rigorous and costly process associated with SOC 2 Type 2 audits compared to the more structured and generally less expensive ISO 27001 certification.

30:07

๐Ÿ’ฐ Costs and Processes Associated with ISO 27001 Certification

The speaker discusses the costs and processes involved in obtaining ISO 27001 certification. They mention that certification costs can vary depending on the size of the business and the certification body chosen. The paragraph outlines the importance of getting multiple quotes and highlights the potential for significant cost differences between certification bodies. The speaker also emphasizes the need for transparency in ongoing audit fees and warns against hidden fees or unnecessary services. The paragraph concludes with advice on setting realistic expectations for the certification timeline and the process involved in achieving certification.

35:07

โฑ๏ธ Timeline and Expectation Management for ISO 27001 Certification

The speaker provides insight into the timeline and expectation management for clients pursuing ISO 27001 certification. They explain that the certification process can take up to 12 weeks but is dependent on the certification body's availability and the client's ability to implement and evidence the required controls. The speaker advises setting a realistic timeline of about three months for implementation and emphasizes the importance of managing client expectations regarding the time it takes to receive the actual certificate. They also suggest strategies forๅฎ‰ๆŠš clients who may be requesting the certification, such as showing commitment dates and engagement letters from the certification body as proof of progress.

40:08

๐Ÿ›ก๏ธ The Role of Advocacy in the Certification Process

In this final paragraph, the speaker reflects on their role as an advocate for their clients during the certification process. They discuss the importance of countering key red flags and ensuring that clients are well-represented and informed. The speaker also hints at a future discussion about the roles involved in an engagement and audit, the perspectives of different stakeholders, and the realities of the situation. They aim to provide insights that can help manage the complexities of the certification process.

Mindmap

Keywords

๐Ÿ’กGovernance Risk and Compliance (GRC)

Governance Risk and Compliance refers to the framework that organizations use to ensure they operate in a manner that is compliant with laws and regulations, manages risk effectively, and is accountable to stakeholders. In the script, GRC is the overarching theme, with the discussion focusing on how ISO 27001 fits into this framework, emphasizing the importance of senior management buy-in and a top-down approach to leadership for successful implementation.

๐Ÿ’กISO 27001

ISO 27001 is an international standard for information security management systems (ISMS). It provides a systematic approach to managing an organization's sensitive information in a secure manner. The script discusses how ISO 27001 is implemented within the GRC framework and how it serves as a foundation for other standards and frameworks, such as GDPR and PCI DSS.

๐Ÿ’กManagement Review Team

A Management Review Team is a group within an organization that oversees and approves policies and procedures. In the context of the script, this team is crucial for ensuring that the organization's actions align with its policies, and it plays a key role in the continual improvement process, which is central to the ISO 27001 standard.

๐Ÿ’กPolicies and Procedures

Policies and procedures are the documented rules and steps that govern an organization's operations. Policies state what the organization aims to achieve, while procedures detail how to achieve it. The script explains the importance of separating policies and procedures and how they are applied to staff and third parties within the organization.

๐Ÿ’กRisk-Based vs. Rule-Based

The script distinguishes between risk-based and rule-based approaches to implementing standards. Risk-based approaches, like ISO 27001, involve determining appropriate controls based on an organization's specific risks and risk appetite. In contrast, rule-based systems, such as PCI DSS, have predefined controls that must be met without flexibility. Understanding this distinction is crucial for organizations when choosing which standards to implement.

๐Ÿ’กInternal Audit

An internal audit is a process where an organization examines and evaluates its own policies, procedures, and operations to ensure they are effective and compliant with regulations. The script mentions that internal audits are based on risk and are a critical part of the continual improvement process under ISO 27001.

๐Ÿ’กContinual Improvement

Continual improvement is the ongoing process of enhancing an organization's performance and operations. In the script, it is highlighted as a key component of the ISO 27001 standard, with the management review team playing a central role in overseeing and managing this process.

๐Ÿ’กIncident Management

Incident management refers to the process of identifying, reporting, and addressing deviations from policies or procedures, known as incidents. The script explains that incidents are expected and form part of the continual improvement cycle, where they are reported to and managed by the management review team.

๐Ÿ’กExternal Audit

An external audit involves an independent third party reviewing an organization's systems, processes, and documentation to verify compliance with standards like ISO 27001. The script discusses the process of engaging with external auditors and the importance of preparing for these audits as part of the certification process.

๐Ÿ’กCertification Body

A certification body is an organization that provides official certification to companies that meet specific standards, such as ISO 27001. The script mentions the importance of selecting an accredited certification body and getting quotes from different bodies to ensure a fair and transparent process.

๐Ÿ’กStage 1 and Stage 2 Audit

The certification process for ISO 27001 typically involves two stages. Stage 1 focuses on evaluating the documentation and initial implementation of the ISMS, while Stage 2 involves a more in-depth audit of the actual implementation and operation of the controls. The script explains the importance of both stages in achieving certification.

Highlights

Governor's risk and compliance framework integration with ISO 27001 for effective information security management.

Importance of senior management buy-in for successful implementation of ISO 27001.

Establishing a management review team for oversight and approval of policies and procedures.

Conceptual separation of policies and procedures for clarity and effectiveness.

Risk-based approach of ISO 27001 allowing flexibility in control implementation based on business needs.

Difference between risk-based and rule-based systems exemplified by ISO 27001 and PCI DSS.

Internal audit processes and their significance in maintaining and improving policies and procedures.

Incident management as a deviation from policy or procedure and its role in continual improvement.

Management review team's responsibility in addressing continual improvement and resource allocation.

External audits' role in the certification process and their impact on client engagements.

Foundational role of ISO 27001 in the governance framework and its compatibility with other standards.

Bolt-on approach to integrating additional standards like GDPR and PCI DSS on top of ISO 27001.

Comparative analysis of ISO 27001, SOC 2, and PCI DSS in terms of implementation complexity and cost.

Advantages of starting with ISO 27001 before pursuing SOC 2 or PCI DSS certifications.

Cost implications and the importance of obtaining multiple quotes for certification audits.

The certification process timeline, including stages 1 and 2 audits, and annual continuing assessments.

Strategic approach to dealing with clients expecting rapid certification and setting realistic expectations.

Recommendation to use an accredited certification body and the benefits of comparing different providers.

Transcripts

play00:00

so what you're going to see here is the

play00:01

um

play00:02

this is how i see governor's risk and

play00:04

compliance working and this is how 27001

play00:07

sits into that governance risk and

play00:08

compliance framework

play00:10

so

play00:11

when we're doing a

play00:13

27001

play00:16

implementation

play00:18

normally

play00:19

people are going to be doing it because

play00:21

they've been uh driven by a commercial

play00:23

requirement we'll come back to that as

play00:25

well so what they want to understand is

play00:27

how does 27001

play00:29

fit

play00:30

what we have when we develop a

play00:32

governance risk and confront compliance

play00:33

framework is we're doing it in more

play00:36

generally

play00:37

so we are going to implement specifics

play00:40

in for 27 0001 but we are going to try

play00:42

and put something in that's a little bit

play00:44

more general i'll do that so i can see

play00:46

be awkward when you record it because

play00:47

it's going to be recording you recording

play00:49

me recording you but anyway

play00:51

so uh so yeah so we're going to put in

play00:53

something that's a little bit more

play00:54

general so this will apply no matter

play00:56

what standard you're implementing you

play00:58

know and technically it would apply if

play00:59

you were doing a data protection

play01:01

implementation you know you're going to

play01:03

be doing 9001 pci dss stock one sort two

play01:05

whatever it is it's going to be

play01:07

so what all of the standards and all of

play01:08

the frameworks i'm looking for is that

play01:10

senior management buy-in so what we have

play01:13

is at the top level we've got senior

play01:14

management and senior management needs

play01:16

to set the direction of the organization

play01:19

there are things that that we can do

play01:21

we'll talk about role

play01:23

uh in a little while but there are

play01:25

things that we can do to help to

play01:26

evidence that

play01:28

but what you're hoping for is that when

play01:29

you go into an organization there is a

play01:31

culture of top-down leadership that

play01:34

there is top-down buy-in

play01:36

you are going to struggle in any

play01:38

organization where your engagement is

play01:40

either sea level or even below

play01:42

so if the demand or the requirement is

play01:45

coming from like a pro a product manager

play01:47

a development manager a network manager

play01:50

and even head of ops you know on his own

play01:53

or her own then you are going to

play01:55

struggle with it and and it's mainly

play01:57

around politics it's going to be around

play01:59

budget it's around getting buy-in and

play02:01

resources to do what it is that that

play02:03

needs to be done

play02:04

so in very very practical terms you need

play02:06

that senior management buy-in

play02:08

and leadership from the top if i'm

play02:10

engaging on a project i want at least

play02:12

one of those

play02:14

uh senior members uh sitting in in my

play02:17

management meetings and we'll talk about

play02:19

them as well as it goes for a bit

play02:21

so senior management at the top sets the

play02:23

direction underneath that we're going to

play02:24

implement the concept of a management

play02:26

review team now some companies have this

play02:28

already this terminology will come up

play02:30

time and time again

play02:32

depending on the size of it there may be

play02:33

an existing structure that you can

play02:36

hijack and that you can jump off of the

play02:39

back of

play02:41

even in those environments even in

play02:43

larger organizations i'm still mind

play02:45

minded to create what i call a

play02:47

management review team okay

play02:49

so what the management review team is is

play02:51

it ensures that things get done

play02:53

now when i build the management review

play02:55

team i'm going to share with you all of

play02:57

the templates and documents as we go

play02:58

through

play02:59

when i when i set up a management review

play03:01

team i want on that management review

play03:03

team a representative of each area of

play03:06

the business ideally so i'm looking for

play03:08

somebody from hr i'm looking for that

play03:11

one senior leadership manager that's

play03:12

going to buy in i'm looking for

play03:14

representation from it

play03:17

if i've got a software development

play03:18

function i want somebody from software

play03:20

development call center ops whatever it

play03:22

is so the size of the organization

play03:24

now in a smaller organization it might

play03:26

only be two of you and that's mine too

play03:28

right you know but we just got to have

play03:30

this we've got to have this structure

play03:33

now the standard is going to call to

play03:35

that as well so it's going to say right

play03:37

i i need you to demonstrate certain

play03:39

things i need you to demonstrate clearly

play03:41

buying and this is one of the ways of

play03:43

the way that we do it and we want to

play03:45

demonstrate in communication we want you

play03:47

to demonstrate things like continual

play03:48

improvement so there are a number of

play03:50

things that that need to happen that

play03:53

this management review team is going to

play03:54

satisfy and again we haven't even really

play03:57

got to a standard yet right but in those

play03:59

in those principles so we've got this

play04:01

management review team

play04:02

so what do they do

play04:04

so they oversee

play04:06

and they approve

play04:08

policies and procedures

play04:10

at the end of the day that is on the

play04:11

left-hand side of this cycle that is

play04:13

what that management review team is

play04:14

doing depending on the size of the

play04:16

organization they may be doing the doing

play04:18

so they may be writing it and then they

play04:20

may be improving it that's fine that's

play04:22

fine but there's a conceptual separation

play04:25

that the management review team oversees

play04:28

and approves policies and procedures

play04:31

in our world or in my world from a

play04:33

practical perspective i separate out for

play04:36

client policy and procedure

play04:39

a policy is a statement of what we do

play04:44

a procedure is a statement of how we do

play04:48

it

play04:48

and i separate those now what you find

play04:50

when you go on a client is you're going

play04:52

to find a mix

play04:53

so if they try to do it themselves or

play04:55

depending on where they're coming from

play04:56

you might have some that's policy

play04:58

statement uh mixed in with some process

play05:01

statement uh and it can be a little bit

play05:03

messy

play05:04

okay a couple of reasons why i want to

play05:06

do that the policies about what we do if

play05:10

you think about it in from a

play05:11

hierarchical point of view is going to

play05:13

be set by the leadership right the

play05:14

management they say what do we do well

play05:16

we do antivirus on every machine

play05:19

antivirus you know reports up to central

play05:21

management

play05:23

uh

play05:24

is set to you know auto

play05:27

disinfect like we want antibiotic we

play05:29

want decentralized managed um antivirus

play05:33

so it's a statement of what we do it

play05:35

doesn't say we use symantec we log on we

play05:39

download definition files every 24 hours

play05:42

we set auto scan to run at 7 30 in the

play05:44

morning if an alert comes it goes to bob

play05:46

in it at this email address bobbin it

play05:49

then does this and raises a ticket with

play05:51

it it's a complete separation now

play05:55

what that allows us to do as i say is we

play05:57

can give bob

play05:58

the uh sorry the the framework for him

play06:00

to record what he does and we can give

play06:03

the managers the framework to record a

play06:05

high level what we do bob is doing how

play06:07

we do it

play06:09

what you're also going to find is that

play06:10

pretty much every client that your

play06:12

client engages with wants policies

play06:15

so what they're going to say to your

play06:16

client is i want a data protection

play06:18

policy i want a clear desk policy i want

play06:21

a working from home bring your own

play06:22

device change management software

play06:24

development

play06:25

policy

play06:26

so what we want to be able to do is

play06:28

we're going to build our policy suite in

play06:30

such a way

play06:31

that it

play06:33

makes their life easier right

play06:36

it'll kind of make clients life a little

play06:37

bit a little bit easier but it's all

play06:39

about making the the

play06:41

the requesters life easier so if they

play06:43

say if you've got software development

play06:44

on policy costs we have here you go bang

play06:46

and it's written in a way that looks

play06:47

like a software development policy they

play06:48

can understand it

play06:50

and they can respond to it

play06:52

so we've got these policies that say say

play06:54

what we do what we haven't then included

play06:56

in it is all this personal information

play06:58

right there's all bob's email addresses

play06:59

in there

play07:00

you know if we had a business continuity

play07:02

policy and it said all right this is our

play07:04

emergency call tree in the policy i

play07:06

can't share that as part of a due

play07:08

diligence on boarding

play07:12

so we've got these policies what we do

play07:15

we've got procedures within our

play07:17

organization about how we go about doing

play07:19

it

play07:20

and when we've got policies and

play07:21

procedures we apply those to staff and

play07:24

third parties on the left hand side

play07:27

so we can't expect staff employees

play07:30

human beings

play07:32

to do the right thing if we don't tell

play07:34

them what it is that we expect them to

play07:36

do yeah so it's part of that

play07:38

communication framework so it's this

play07:40

governance risk and compliance

play07:42

so we've got our policies and we're

play07:44

going to apply them to staff and staff

play07:47

and third parties are going to operate

play07:48

them and hopefully everything is going

play07:50

hunky-dory

play07:52

now our policies and procedures

play07:55

good good for your knowledge

play07:57

with your knowledge are based on risk

play08:00

okay so policies and procedures are

play08:01

based on risk

play08:05

we're going to take a step back for a

play08:07

moment

play08:08

when it comes to

play08:09

implementing a

play08:11

standard

play08:13

there are typically two approaches

play08:15

risk-based and rule-based

play08:19

27001

play08:21

is a risk-based model

play08:23

and i like it for that reason so what

play08:26

27001 says is when it comes to controls

play08:32

you are going to operate the controls

play08:35

that are appropriate to your business

play08:37

based on your businesses risk

play08:39

to a level

play08:41

that is appropriate to your business and

play08:42

your business is risk appetite

play08:45

so it could be the situation that you

play08:46

don't have certain controls in your

play08:48

organization

play08:50

it could be that you have controls in

play08:51

your organization that other people

play08:53

would deem to be not sufficient

play08:56

okay so i'll give you an example

play08:59

27001 as one of its controls says your

play09:02

password management system

play09:04

it doesn't say what that password

play09:06

management system is you define it so

play09:08

you could say our password

play09:10

password management system it's one

play09:12

character long we never change it

play09:15

right it's our risk it's our risk

play09:17

redeemed it's our risk

play09:19

now i can show you how you would have to

play09:20

manage and report that and how you'd

play09:23

have to control that but the theory

play09:24

stands

play09:26

you also have

play09:27

rule-based systems right rule-based

play09:30

systems are cyber essentials pci dss

play09:34

to some extent sock what a rule-based

play09:37

system says is you will have this

play09:38

control to this level and if you don't

play09:40

you will fail

play09:42

there is no no ifs no buts no no no

play09:44

nothing around it right

play09:46

so it is within the rounds of

play09:48

possibility in a risk-based system to

play09:50

have quite a weak control framework

play09:53

uh and still certify and pass whereas in

play09:56

a rule-based system you're going to be

play09:59

governed by whatever the rule is it's

play10:00

yes or no black or white tick or fail

play10:03

but either way i say our policies and

play10:06

procedures are based on risk

play10:08

so what what it is that we do as a

play10:10

business is based on our businesses risk

play10:12

appetite and how we do it is going to be

play10:14

based on risk as well

play10:18

when we have policies and procedures

play10:20

they are subject to audit they're going

play10:22

to get checked and they're going to get

play10:24

checked a lot right

play10:26

so as a

play10:28

function

play10:29

we have to perform internal audits on

play10:31

our organization at least annually

play10:35

when we deep dive into some of these

play10:36

areas you'll see some of the caveats but

play10:38

i'll touch on it now

play10:40

if an auditor asks you a question how

play10:42

have you devised your internal audit

play10:44

plan the answer is always

play10:47

based on risk

play10:49

now the reality may not be that and

play10:51

again we'll touch on that later

play10:53

but what they want to see in an internal

play10:55

audit plan is that the things that are

play10:57

the most risky to your business have

play10:59

been audited probably more than once

play11:02

okay

play11:03

right so you're going to audit based on

play11:04

risk if i know you know i don't know if

play11:07

i'm in a high transaction environment

play11:09

for financial services

play11:11

you know and

play11:13

what could be capacity management maybe

play11:16

you know was an issue then that might be

play11:17

an area that i ordered every month just

play11:19

to keep an eye on it and make sure that

play11:21

all the controls are working so we've

play11:23

got policies got procedures based on

play11:24

risk risk is defined the level that

play11:26

we're going to implement them and then

play11:27

we're going to audit them

play11:28

we're going to internally audit them

play11:31

you can internally

play11:32

or you can internally audit

play11:35

with your with your own staff with your

play11:37

own self like the head of it could

play11:39

internally order it it's got limited

play11:41

value to it what we would say is part of

play11:43

our implementation is ideally you want

play11:45

somebody with a level of independence

play11:48

either somebody in the business whose

play11:50

job it isn't normally

play11:52

like to operate that process and

play11:54

procedure but in our best case scenario

play11:56

bringing in a consultant like us

play12:01

when we've got these policies and

play12:02

procedures that staff are operating in

play12:04

the middle what you can see is they've

play12:06

got incidents

play12:07

now what is an incident an e an incident

play12:09

is a deviation from a policy or a

play12:11

procedure

play12:13

so

play12:14

in like the audits terms call it a

play12:16

non-conformity right so what do i mean

play12:18

by an incident it could be that a policy

play12:20

says um what we do and actually we found

play12:24

not to do it

play12:25

uh or a procedure says something and

play12:28

we've not followed the steps within the

play12:30

procedure

play12:31

so

play12:32

typical incidents right people leaving a

play12:35

laptop on a train that's an incident

play12:37

you know um an outage of your system for

play12:40

30 minutes that's an incident you know

play12:42

it's a deviation from the norm

play12:45

uh

play12:46

i had a call

play12:48

yesterday with a client they had

play12:49

outsourced

play12:51

uh account provisioning

play12:53

to a

play12:55

support company an it support company

play12:57

and they discovered that the it support

play12:58

company had been cloning

play13:00

rather than creating ids from scratch

play13:03

and they've been cloning senior managers

play13:05

ids

play13:07

and allocating them to new starters and

play13:09

you start as therefore had all the

play13:10

access rights of the senior manager

play13:13

and this has been going on for some time

play13:14

deviation from the norm right

play13:17

so we've got things will go wrong and

play13:19

that's fine we expect that right there's

play13:21

always going to be things that go wrong

play13:23

so i can find

play13:24

uh i'm going to perform my risk

play13:26

assessment i'm going to do my internal

play13:27

audit and incidents and things are going

play13:28

to go wrong that bit in the middle

play13:31

leads into your continual improvement so

play13:34

we're gonna we're gonna drive a process

play13:36

now of continual improvement

play13:39

so 27001 doesn't necessarily expect you

play13:43

to have everything right day one and

play13:46

actually baked into it is a process of

play13:49

continually improving

play13:51

now we can look further down the line at

play13:53

the benchmark of what would be expected

play13:56

for a certification even though it could

play13:57

be quite low but the concept is we've

play14:00

got continual improvement

play14:02

so a continual improvement

play14:04

is reported to and managed by the

play14:07

management review team

play14:09

and again i'll show you the templates

play14:11

that make that up

play14:12

so what do i mean by that so if i've

play14:14

gone through my risk identification and

play14:16

i've highlighted that there is a risk um

play14:20

you know there could be a we're going to

play14:22

open a new office there's no reception

play14:23

in the office

play14:25

uh and there's no entry controls so i've

play14:27

identified a new risk so i've got to do

play14:29

something about it

play14:30

so through risk management and risk

play14:32

treatment and risk treatment i'm either

play14:34

going to accept the risk

play14:36

i'm going to reduce it mitigate it

play14:38

offset it so i'm going to do something

play14:40

with that risk but the body that makes

play14:42

that decision is the management review

play14:44

team the management review team is the

play14:46

one that reports it so it is the one

play14:48

that oversees it

play14:50

when i go through my internal audit and

play14:52

i go against the controls and i find

play14:54

that something is wrong or is not

play14:56

operating effectively then i'm gonna

play14:58

have to

play14:59

make a recommendation and something's

play15:01

gonna have to happen

play15:03

that goes into the management review

play15:04

team an incident occurs it could be a

play15:07

one-off or it may require something

play15:11

and that something could be

play15:13

people

play15:14

it could require time

play15:16

it might be people need training or

play15:18

educating i might need tooling i might

play15:21

need technology

play15:22

you know there's whatever it is there's

play15:23

going to be something that needs a

play15:24

decision to be made and it's the

play15:26

management review team that would

play15:27

approve that

play15:28

so through the processes that i'll show

play15:31

you and the reporting and all the

play15:32

templates and how it works

play15:34

ultimately it's the management review

play15:36

team that says yes

play15:37

you can have the resource to do whatever

play15:39

it is that you need to do we'll plan it

play15:40

we'll track it we'll manage it or we

play15:42

accept the risk

play15:44

and again we've got different levels of

play15:47

authority on who can approve what levels

play15:49

of risk but that's roughly the structure

play15:51

of how it works so you've got this cycle

play15:54

this continual round and round update

play15:56

your policies update your procedures

play15:58

then audit them they didn't quite work

play15:59

continually improve them update them

play16:01

roll them out audit them again audit

play16:04

them again audit them again on and on it

play16:06

goes

play16:08

when it comes to your audits

play16:10

one of the first things is when we come

play16:11

off of this is i'll talk you through the

play16:13

process of how 27001 works

play16:16

but you are going to get externally

play16:18

audited now external audits for clients

play16:21

happen in a number of different ways

play16:23

right they can happen as part of a

play16:24

certification process

play16:26

they can happen as part of a onboarding

play16:30

a new customer

play16:32

so typically you're going to see

play16:34

questionnaires requests for certificates

play16:36

but they can also come and audit you and

play16:38

review you

play16:39

um and obviously worst case scenario is

play16:42

going to come in and audit you as well

play16:43

but you know hopefully you never get to

play16:45

that point

play16:49

so let's look at the framework so that's

play16:51

how the management of it all hangs

play16:52

together

play16:54

so if i look at what does the governor's

play16:55

framework the top two remain the same

play16:58

you think of it as an inverted

play16:59

pyramiding effects but i like to work

play17:01

bottom up top down but you see where

play17:03

we're going so the top two remain the

play17:05

same management is still set in the

play17:06

direction the management review team is

play17:08

still ensuring it gets done

play17:10

what we're looking at now is where does

play17:12

27001 logically fit within this

play17:14

structure

play17:15

and

play17:16

for me and

play17:18

through my experiences 27001 forms the

play17:21

foundation

play17:22

it is the base level management system

play17:26

as an organization that i would be

play17:28

encouraging any any client to go for

play17:30

first

play17:31

so there's some debate in uh you know

play17:33

out there i've got clients that come to

play17:35

me and they go oh i want to do sop 2

play17:36

right we want to do sop 2 first

play17:40

again we can have that discussion but i

play17:41

would always discourage that and say

play17:42

let's go 27001 first

play17:45

if 27001 is on your roadmap let's do it

play17:48

first then build on it because pretty

play17:51

much every other standard that you've

play17:53

got that's out there builds on 27001 as

play17:56

a framework

play17:58

so your bolt-ons when we build our

play17:59

structure you're going to be able to

play18:01

bolt on gdpr

play18:03

pci dss

play18:05

sock

play18:07

and the way that we're going to do that

play18:09

and the way that we would encourage to

play18:10

do that is to build these common modules

play18:13

i want to create a risk management

play18:15

approach template structure that is

play18:18

sufficient to support gdpr and to

play18:21

support pci and actually it support the

play18:24

wider business

play18:26

and i you know many engagements i go on

play18:28

business will say actually your risk

play18:29

register is better than the one we use

play18:30

for the company let's take that and

play18:32

apply that to the wider business

play18:35

so we want to build supplier management

play18:37

in a way that it satisfies all

play18:38

requirements

play18:39

policies operating procedures etc

play18:43

what i mean by the bolt-on section is

play18:45

and again for knowledge really is that

play18:48

if something like 27001 says

play18:51

you need a password management system

play18:54

based on risk

play18:56

it could be one character long it could

play18:58

be no characters long it doesn't care

play18:59

pci comes along and says oh by the way

play19:01

your password management system will be

play19:03

28 billion characters long with all of

play19:06

this level of complexity in it

play19:07

you know what oh well that's okay right

play19:09

it's what it's just like tweak to

play19:11

whatever an ad setting on a group

play19:12

whatever you know but we're building up

play19:15

on that we're building upon that

play19:17

foundation

play19:18

gdpr as well so we will have a look at

play19:21

where that fits but the principles six

play19:24

maintain adequate security 27001

play19:27

satisfies a lot of that but there may be

play19:28

some additional steps that we want to

play19:30

take just to enhance it a little bit

play19:33

for

play19:33

special category data or whatever it is

play19:35

that the gdpr is

play19:38

his driving is down

play19:42

so that's kind of

play19:44

high level

play19:45

how it hangs together and that's high

play19:47

level

play19:48

where the 27001

play19:51

fits in within that structure

play19:55

there's all things you already knew

play19:57

anything that any questions that you

play19:58

don't cover

play19:59

no questions all make sense

play20:02

perfect

play20:06

perfect

play20:08

so hopefully that's just recorded me and

play20:09

you now which is fine

play20:17

so in terms of today let's talk about

play20:19

standards

play20:21

let's talk about if you were advising

play20:22

client okay client says oh i want stop

play20:25

two

play20:26

we can do more deep dives into

play20:28

the sort two as well further down the

play20:30

line

play20:31

and but they say in general right i'm

play20:34

looking at doing i'm looking at doing

play20:35

this top two

play20:37

pci

play20:38

so let's understand where these uh

play20:40

frameworks fit fit within that structure

play20:44

27001 as we say international standard

play20:47

for information security management an

play20:49

international standard

play20:51

driven by the bsi the british standards

play20:54

institute an iso standard that is

play20:57

aligned from a management perspective

play20:59

with things like 9001 22301 business

play21:02

continuity so the management structure

play21:05

actually side of it

play21:06

you're going to see on more than one

play21:08

occasion if you're going to a more

play21:09

complex client you know if i go into one

play21:12

that's doing 9001 i'm like well you'll

play21:14

be already having a management structure

play21:15

you've already got continuum improvement

play21:17

these things that we can bolt on

play21:19

together

play21:20

it is to say it's the baseline right

play21:22

it's the minimum level

play21:23

risk-based system minimum level

play21:26

the main requirement and driver for it

play21:28

tends to be out of the uk from my

play21:31

experience so it's very uk and european

play21:34

centric

play21:36

if your client is operating within

play21:37

europe 27 01 is probably the one again

play21:40

the one they're going to be pushed for

play21:43

as you start to move across some more

play21:44

into the americas the americas would be

play21:47

driven more by a requirement for sock

play21:51

and it is typically a stock 2

play21:53

requirement that they have

play21:58

and you get that of uh you get that out

play22:00

of australia as well

play22:02

depending on the size of the

play22:03

organization that's requesting it

play22:05

they're probably going to ask for both

play22:07

so i've got clients in financial

play22:09

services you know you start working with

play22:10

the large banks before they're asking

play22:13

they're just they're asking for both

play22:14

just straight out of the back

play22:16

so let's look at or let's look at orders

play22:18

of magnitude

play22:20

yes both stand uh both standards can

play22:22

operate to any organization i deal a lot

play22:25

though with startups 27 0001 you can

play22:28

implement pretty well for a startup sort

play22:30

2 would be a little bit more complex

play22:33

so

play22:35

if i look at what does sock 2 do

play22:38

sock 2 is driven from an accounting

play22:41

uh practice right so it's an account in

play22:44

structural framework really and it

play22:47

actually sits within a broad or a audit

play22:50

uh accounting audit

play22:52

process

play22:54

when it comes to sock there are two

play22:56

types

play22:57

there's a sock one audit

play22:59

and a sock two audit

play23:01

and we'll cover this again don't worry

play23:02

but it's just conceptually so the

play23:04

client's saying to you i want to stop

play23:05

toward it what does that mean

play23:07

so you've got an accounting standard

play23:08

with an accounting audit that goes at

play23:10

the back of it that can do one of two

play23:11

things a sock one or a stock two to

play23:13

start with

play23:14

a stock one

play23:16

audit typically is of an organization

play23:18

that does something that can materially

play23:21

or fundamentally impact

play23:23

the financial reporting of that

play23:25

organization fundamentally it's going to

play23:27

impact on the accounting reporting of

play23:30

that organization

play23:32

soc2

play23:34

is usually applied to businesses as a

play23:36

general

play23:37

control set it's just a general set of

play23:39

controls

play23:42

you then have within socked two types of

play23:45

audit

play23:46

27001 is a point in time audit

play23:50

so when we do our order it just looks at

play23:52

basically the information that it can

play23:54

see at the time

play23:55

a sock

play23:56

one two

play23:58

but type one audit is a point in time

play24:00

audit so you get a point in time audit

play24:02

you're good to go

play24:04

a sock to audit is a continual audit

play24:08

for a defined period of time

play24:12

typically your client is going to take

play24:13

12 months so what that means is when

play24:16

they audit it they can say right show me

play24:18

evidence that it works in january in

play24:20

february in march in april give me a

play24:21

sample from november right the rigor

play24:24

that's associated with it just

play24:25

absolutely goes goes through the roof

play24:28

so

play24:29

differences between different audits

play24:31

point in time audit point your time

play24:32

audit and or a continuing order

play24:35

27001 is a structured framework

play24:38

right it's got 114 controls in it

play24:40

dropping to 90 whatever dependent when

play24:42

it goes when it comes out in its next

play24:43

iteration

play24:45

and

play24:46

sock is not a defined framework

play24:50

allegedly

play24:51

so what the sock

play24:53

requires you to do is for you to define

play24:55

your controls

play24:57

and then they will audit you against the

play24:58

controls that you've defined

play25:01

typically

play25:03

it's not quite actually the real world

play25:05

right because what happens is when you

play25:06

engage with these uh third-party audit

play25:08

companies they've got their own portals

play25:11

and tools and they ask you for

play25:12

documentation and it's all the standard

play25:13

stuff right so there is some work to do

play25:16

to like define controls but ultimately

play25:18

what they're looking at

play25:20

is the stuff that we look at day in day

play25:22

out

play25:23

but if i look at it conceptually to the

play25:24

client and client i'm saying look you've

play25:26

got stock two over here it doesn't have

play25:28

a set of controls with it you've got

play25:30

twenty seven thousand one over here it

play25:31

does so let's implement twenty seven

play25:33

thousand one eighty percent of what

play25:35

we're going to need is going to be

play25:36

delivered by twenty seven thousand and

play25:38

one and then we'll bolt on the extra

play25:40

that we need and the extra little bit of

play25:41

rigor if and when you want to do sop2

play25:44

no issue

play25:47

okay

play25:50

so that's the difference between those

play25:51

two

play25:52

pci dss that fits in follows the various

play25:54

signal stretches about 344 controls

play25:56

depending on which

play25:58

level of business you are you do

play25:59

self-assessment or you do your report on

play26:00

compliance

play26:02

we can go through all of that but

play26:03

fundamentally pci dss is a control set

play26:06

and depending on what kind of business

play26:07

you are is what business uh which of

play26:09

those controls apply is rule-based yes

play26:11

or no pass or fail um and again that

play26:14

applies to anything that stores

play26:16

processes or transmits data

play26:19

sorry cardholder data yeah

play26:21

and so again the level of rigor that

play26:23

goes with that can be quite high start

play26:25

with 27 0001 build on what you want as

play26:27

you go through it

play26:29

if we look at costs

play26:31

client says i want twenty seven thousand

play26:32

one

play26:34

twenty seven thousand one to certify

play26:37

to get the certificate

play26:39

is going to range anywhere

play26:42

between maybe

play26:44

four

play26:45

to maybe 12 grand maybe

play26:47

again it depends on the size of the

play26:49

business right

play26:51

so what will happen is when you go for

play26:52

your 27 0001

play26:55

certification

play26:56

they follow a structured format

play26:59

and it spits out a number of audit days

play27:01

at the end of it

play27:02

small organization like me it was three

play27:04

days i've got a small organization that

play27:06

are based out of brazil that i'm taking

play27:08

through at the moment one is aries

play27:10

they're six people software development

play27:13

no on-prem

play27:15

all in the cloud three-day audit yeah

play27:18

tomorrow i start a stage one audit for a

play27:21

large uk charity it's a three-day stage

play27:24

one and a 12-day stage two

play27:26

massive right

play27:28

so there is variation in it

play27:30

but you can get a feel for it that it's

play27:32

not really

play27:34

technically it's not not that expensive

play27:37

so you know a couple of couple of people

play27:38

in a room if you were to go for it

play27:40

you're probably going to be looking

play27:41

around about three and a half four grand

play27:42

something like that

play27:45

if i go into the world of sock

play27:48

depending on what i'm doing my sock one

play27:51

order it can start at 18 grand just to

play27:53

take the test

play27:55

right

play27:56

and that's for a type one

play27:58

so again i'm like client right you want

play28:00

to go for stock two it's complicated

play28:02

there's no controls we're gonna have to

play28:03

define them all and it's gonna cost you

play28:06

probably three times as much as the

play28:07

twenty seven thousand and one

play28:09

should we walk before we run run

play28:11

right let's go down this row and then

play28:13

and then we'll get to the sock

play28:16

okay to do a type 2 order bit

play28:19

you can be in tens of thousands of

play28:21

pounds

play28:23

so i've got a uk-based financial company

play28:25

that's forced to do a top 2 type 2 at

play28:27

the moment and for them just to take the

play28:29

test it's 42 000 pounds a year just to

play28:32

take the test

play28:33

and they pay me less than that to do the

play28:35

work

play28:37

but that's fine

play28:39

so you you know your your type 2 audits

play28:42

arranging you know probably late 20s

play28:45

early 30s all the way up to

play28:47

40s mid you know mid 40s now there are

play28:50

influences and factors on that and again

play28:52

we can discuss those i can guide you

play28:54

through it but i'm just giving you

play28:55

orders of magnitude okay when you're

play28:58

getting a pci dss clearly they'll charge

play29:00

what they want right 10 again 30 40

play29:02

ranges to take just to take place

play29:07

so for me my framework is 27001 build

play29:09

upon and build upon top of that

play29:13

let's look at how the

play29:14

27001

play29:16

process

play29:18

works

play29:19

okay

play29:21

so what we're going to need to do is

play29:22

we're going to need to

play29:24

be

play29:25

getting our client an accredited

play29:27

certification many people people out

play29:29

there that do certifications what you're

play29:31

looking for is an accredited body

play29:34

certification

play29:35

i'm not going to call out the ones that

play29:36

pretend that they are on or not but

play29:38

you've got to do your due diligence and

play29:40

find out

play29:41

who are the ones that can

play29:43

so if you look at it from the uk

play29:45

to get an accredited certification

play29:47

you're looking at

play29:49

british standards institute you've got

play29:51

sgs

play29:52

um bsi

play29:55

sgs cfa center for assessment

play29:58

uh bad british assessment bureau

play30:00

um

play30:01

the one that i use a lot and i can make

play30:04

you an introduction to is approachable

play30:06

right so the approachable guys

play30:09

um are absolutely spot on but i i use

play30:12

approachable

play30:13

you can google it there are other ones

play30:15

out lrqa etc but they tend to be they

play30:18

tend to be the big ones

play30:21

if you were going to engage with client

play30:23

i always recommend to client even though

play30:25

i know they're going to go with

play30:26

approachable is get three quotes yeah

play30:28

make make them do the work so you go

play30:30

there's got the bsi probably got a cfa

play30:33

and then go approachable and get three

play30:34

quotes back i can show you

play30:37

at some point the level of difference

play30:39

that comes back is it's not that

play30:40

standard either right

play30:42

so they're going to send back their fees

play30:44

and there's some confusion with you that

play30:45

you've got to work through that once

play30:47

you've seen a few of them you know what

play30:49

to look for like

play30:50

you can see what they're missing right

play30:52

and you know what's going to hit your

play30:53

client further down the line because it

play30:55

isn't straightforward as this is the

play30:56

price

play30:57

the way they cut it it can be confusing

play31:00

so we're going to go we're going to go

play31:02

to the certification body um

play31:04

and we're gonna make sure that they're

play31:05

accredited the accreditation body in the

play31:07

uk is ucas so it's a ucas accredited

play31:11

certification body

play31:14

and you can look on the

play31:16

ucas website and it will tell you which

play31:18

ones are underneath that

play31:20

some of the some of those bodies can

play31:22

issue certificates elsewhere so i use

play31:25

approachable they're doing my buenos

play31:27

air's client they do my america's client

play31:29

and they do their australia client okay

play31:32

so at the end of the day as long as it's

play31:33

an accredited certificate

play31:35

it kind of doesn't matter

play31:38

to help your client if you end up with

play31:40

an international client by using the uk

play31:42

as a rule and especially using

play31:44

approachable it will be cheaper

play31:46

okay

play31:47

so american auditors for twenty seven

play31:49

thousand and one can be up to three

play31:51

times the price of the uk like their day

play31:54

rates are huge they over egg it it's

play31:56

just like it yeah it's crazy it's crazy

play31:59

so i would always take a client get

play32:01

three quotes definitely

play32:03

um

play32:04

and even if i was going to say if i was

play32:05

in america i'd say get to america in one

play32:07

one uk and then let's just compare it so

play32:10

that they can see it we're not telling

play32:12

them we're not in bed with anybody i

play32:13

just know what the answer is but i'm

play32:14

going to help you

play32:16

to come up with that answer yeah

play32:19

so i get my i get my credit

play32:20

certification buddy they then send out a

play32:23

letter to your client

play32:24

that says right these are how many staff

play32:26

have you got how many offices have you

play32:28

got et cetera

play32:30

that is the thing that dictates the

play32:31

number of days so they're trying to

play32:33

scope it so if you have physical offices

play32:36

in scope then they will physically visit

play32:38

those offices it's going to cost you

play32:39

money right

play32:41

the more staff you've got again i think

play32:43

because these guys have got 200 it's

play32:45

like 11 days

play32:46

and i'm even me i'm going but it doesn't

play32:48

make sense because the process is the

play32:50

process right is it relevant of how many

play32:52

people

play32:53

like we're just going to be sat

play32:54

twiddling our phones for 10 days anyway

play32:56

that's not the story

play32:58

so then they're going to quote it and

play32:59

then they're going to come back on you

play33:02

things to look out for in quotes

play33:04

right there's going to be a

play33:07

stage 1 and a stage 2 audit

play33:11

that makes up the certification process

play33:14

the stage one audit is the one that's

play33:18

one or two days it's the smaller of the

play33:21

two audits

play33:23

the stage one audit looks at do you have

play33:25

documentation in place

play33:27

primarily

play33:29

is the information security management

play33:31

system evidenced as being implemented

play33:33

operating effectively and does it look

play33:36

like you've done some documentation on

play33:38

your annex a controls but it's

play33:40

predominantly looking at the information

play33:42

security management system

play33:44

the stage two audit

play33:47

is

play33:48

pretty much fundamentally a walkthrough

play33:50

of the annex a controls with a show me

play33:56

the auditor

play33:58

can only ever audit

play34:00

what we tell them

play34:02

right

play34:03

so when we're going to go through our

play34:04

process over the coming weeks and we say

play34:06

about documenting procedures

play34:09

we always tell client document what you

play34:12

do

play34:13

not what you think i want to hear

play34:16

right

play34:16

document the reality of your world right

play34:19

now because what the audit is going to

play34:21

do is go show me that piece of paper and

play34:22

then they're going to read it and go it

play34:24

says here that you get to work at nine

play34:27

o'clock and then you go

play34:28

yeah i normally get in at 10. you go

play34:31

right well you failed

play34:33

like why why did you write down you're

play34:35

getting at nine when you don't you know

play34:36

you don't come in until ten why didn't

play34:38

you put that you come in at ten

play34:40

so that's what they're gonna do in stage

play34:41

two they're gonna go through line by

play34:43

line what it is that you say you do so

play34:45

that you can evidence and prove

play34:47

so they're going to quote you for your

play34:49

certificate on your stage one and your

play34:51

stage two

play34:53

when we do our certificate it goes on

play34:55

this three year cycle

play34:58

so we have an annual cost now with the

play35:01

certification body to do a continuing an

play35:04

assessment audit

play35:06

a cav

play35:08

or a continuing audit

play35:11

what that means is that every year

play35:13

they're going to come back and do a

play35:14

subset of those controls

play35:18

for a small organization

play35:20

typically a day a day and a half two

play35:22

days you know if i had a six day audit

play35:25

i'd probably expect my calf to be around

play35:26

about two days

play35:28

in reality and they're going to choose

play35:31

the controls that they order based on

play35:33

risk that's what they're going to tell

play35:34

you but they haven't they've got a

play35:35

standard template and it'll be whatever

play35:37

it is that they're going to award it in

play35:38

that year

play35:39

so they'll just do they'll just do a

play35:40

kicking of the tires and making sure

play35:42

that things are running but they're

play35:43

going to charge you for it right

play35:45

so the fees that you're looking out for

play35:46

are what are my continuing audit fees

play35:50

some certification bodies won't tell you

play35:52

that when you sign up to take the

play35:54

certificate they'll say oh we'll let you

play35:57

know when you've got your certificate

play35:58

but not you right because then they've

play36:00

got you over about you're in then so you

play36:02

want to know transparency is what is my

play36:04

annual ongoing audit fee

play36:07

so once you know that you've got a good

play36:09

grasp then pretty much of where you're

play36:11

going to be landing for your client some

play36:13

of them will include that some of them

play36:15

will exclude that

play36:17

some of them will add services that you

play36:18

don't need the bsi horrendous for it oh

play36:21

we're going to give you access to this

play36:22

portal and this system and we're going

play36:24

to do this management and we're going to

play36:26

charge you a 10 project fee and we're

play36:28

going and you're like whoa

play36:29

by the time you you know every time

play36:32

you've gone through it again you're in

play36:33

that 15 grand mark for what i can get

play36:36

through approachable for probably six

play36:38

seven eight i mean it's layering on

play36:41

what you need though you need the stage

play36:43

one stage two certification audit

play36:45

and you need the cav

play36:47

and then you're asking them and you're

play36:48

looking out for hidden fees

play36:51

when we engage with a third party to do

play36:52

the 27001 order it can take up to 12

play36:55

weeks

play36:56

but really you're just at the mercy of

play36:58

their availability

play37:00

so they've got auditors

play37:02

their availability is going to dictate

play37:04

it

play37:05

if like me you can end up in a good

play37:07

relationship with the certification body

play37:09

of your choice then you're going to be

play37:11

in a position then where eventually that

play37:13

things will be a little bit easier so

play37:15

you get if you get cancellation can i go

play37:16

to the top of the list you know work

play37:18

well with these people then they'll work

play37:20

well back with you it isn't about like

play37:23

getting any special favors but it's just

play37:25

about smoothing the wheels a little bit

play37:27

so sometimes you can fast track your

play37:28

client a little bit through if you're a

play37:29

bit more flexible uh flexible with it

play37:32

but if set the expectation client is

play37:34

always like how long is it going to get

play37:35

how long is it going to take me

play37:37

i'm going to say again it's going to

play37:39

depend on the certification body

play37:41

then it's going to depend on your

play37:43

ability to implement an evidence the

play37:44

annex a controls

play37:46

let's say three months let's set three

play37:49

months is a realistic timeline to do

play37:50

that

play37:52

his client then comes back and says can

play37:53

we do it in 10 days can we do it a month

play37:55

ago yes we can

play37:57

but once we start to look at what is

play38:00

involved in it it's dependent on them to

play38:02

write all these procedures down and

play38:04

evidence that they're doing what they're

play38:05

doing so i can do my bit no problem but

play38:07

you've got to be able to keep up with me

play38:10

so we've got that certification process

play38:12

the certificate won't again it depends

play38:14

on how lazy they are you know you might

play38:16

not get the certificate back for maybe

play38:17

four or six weeks after you've taken the

play38:20

last audit

play38:21

so again clients expectation in january

play38:23

i'm going to have a bit of paper by the

play38:25

end of january not going to happen even

play38:27

if it's march before we do the

play38:28

certificate to do this two stages of

play38:30

order could be april before you even get

play38:32

the piece of paper

play38:35

so that's worth knowing

play38:38

what i do with a client is

play38:40

say normally if you have a conversation

play38:42

so client says we need it go back to the

play38:44

person that's requesting it and say if i

play38:47

get an engagement letter from the

play38:48

certification body

play38:50

that shows that i've paid my

play38:52

upfront bill

play38:54

and i show you my commitment dates

play38:57

and i

play38:58

explain to you that i brought in high

play39:00

table or whoever

play39:02

and show you i'm on the journey will

play39:03

that be enough

play39:05

and

play39:06

nine times out of ten it will right most

play39:09

if a customer is engaging with your

play39:10

client normally it's because they want

play39:12

their services so if they can show that

play39:15

they're going in the right direction

play39:16

they can show they've got the dates

play39:18

they've got a letter-headed letter from

play39:19

the certification body everything's

play39:21

booked in they can see yep you spent

play39:23

money on consultants we can see you

play39:25

doing the right thing then they might

play39:27

let it slide and say okay we can wait

play39:28

till april for a bit of paper because we

play39:30

can see that you're on that journey yeah

play39:33

so again that's

play39:35

just

play39:36

based on experience really

play39:38

you can feed back to people uh

play39:41

and let them know

play39:43

yeah i mean i've done like i do a lot of

play39:46

work with the hsc here which is the

play39:48

equivalent of the nhs

play39:51

part of my job is is

play39:53

reviewing it security questionnaires

play39:56

yeah we always get you know yeah we are

play39:58

on the road to iso certification

play40:01

it's like okay show me

play40:03

yeah because i can have fun oh i've got

play40:06

long blonde uh

play40:07

yeah yeah ferrari but

play40:10

no you do you do you do the right thing

play40:12

and again we can

play40:13

stuff that you already know but again

play40:15

it's worth chewing the

play40:16

like indicators at this at this point

play40:18

i'm looking at it as being an advocate

play40:20

of my client i can flip it to the other

play40:22

side because again i externally audit

play40:24

people and then you can go these are the

play40:25

key red flags and then as we go through

play40:28

the process you can see

play40:29

how to counter the key red flags to be

play40:32

the advocate of your customer

play40:35

it is you know it is what it is right

play40:36

that's how it depends what it depends

play40:38

where you want to fit

play40:40

so in terms of today i want to overload

play40:42

with knowledge right so what we've gone

play40:44

through we've gone through this is again

play40:45

just some base principles this is how a

play40:48

governance risk and compliance framework

play40:50

looks like some of the reasoning about

play40:53

why we need the management buy-in the

play40:55

structure that would sit under it and

play40:56

then that role of continual improvement

play40:59

we've touched on the types of different

play41:01

standards that are out there and the

play41:03

different approaches that they take

play41:05

point in time audit continual audit risk

play41:07

based audit versus rule-based

play41:09

audit and we've touched on the process

play41:12

and the engagement of how we will

play41:13

deliver 27001 certification for client

play41:16

and from the certification point of view

play41:19

we had a look at the difference between

play41:21

uk and non-uk costs

play41:24

um and timelines

play41:26

three quotes as an approach and now

play41:29

you've got the if you haven't spoke to

play41:30

them before approachable or my go-to

play41:33

and you've got that as well in terms of

play41:35

some practical things that you could do

play41:37

if you ever got to the point where you

play41:38

were going to certify

play41:42

out of everything we've covered today is

play41:44

there anything else is there anything

play41:45

that's come up as question or no it all

play41:48

makes sense you know the government's

play41:50

framework it makes sense

play41:52

um

play41:54

it's really handy to know in term the

play41:56

timeline stuff is really handy to know

play41:58

the costs stuff is really handy to know

play42:01

um

play42:03

you know i haven't come across

play42:04

approachable but you know

play42:07

i've come across

play42:08

bsi in terms of them

play42:11

some of their quotations for data

play42:12

protection stuff here

play42:18

it's over the top right yeah it's over

play42:20

the top so what yeah i mean it's up at

play42:22

the top and to be fair when you're

play42:23

getting a sock too i have i have some

play42:25

conversation with the sort of audio it's

play42:27

supply and demand and i'm like what is

play42:29

it that you're going to do they come to

play42:30

me

play42:31

right so my client every year 10 days of

play42:33

order 10 days of audit that's i've audit

play42:36

audit and then it's pre-audit that

play42:37

happens before that and i'm like okay so

play42:39

what you're going to do can you upload

play42:40

all this document into a portal i'm like

play42:43

okay but what are you gonna do like i

play42:45

know what you're gonna do why are you

play42:46

charging my client 40 000 pounds

play42:49

right for what is that best five days

play42:51

worth at best yeah

play42:53

and the answer is because we can and you

play42:55

go well that's fine too

play42:57

so if you look at the stretcher i mean

play42:58

we're going off on a little bit of a

play42:59

deviate deviation i think i've probably

play43:01

spent a little bit of time with it on

play43:02

your neck on the next chord really which

play43:05

is what is your role right so what is

play43:07

what are the roles that are at play

play43:10

in fact let's pick that up next time

play43:12

what are the roles that are at play in

play43:14

terms of an engagement and an audit

play43:17

and then what is everybody's perspective

play43:19

and then what is the reality of what is

play43:21

going on and then how do you manage that

play43:22

so let's have a look at we'll have a

play43:23

look at that next time i'll give you

play43:25

because you know anyway but it'll give

play43:26

you some insights into that

play43:29

super

Rate This
โ˜…
โ˜…
โ˜…
โ˜…
โ˜…

5.0 / 5 (0 votes)