ISO 27001

What it means

ISO 27001 is the international standard for an information security management system. It does not prescribe specific software but a way for a company to protect the confidentiality, integrity and availability of information systematically: identify risks, choose controls, implement them and regularly check that they work.

The foundation is risk assessment. The company works out what information it holds, what would happen if it leaked or was lost and which threats are real. On that basis it selects controls from the standard’s annex, such as access control, backups, encryption, supplier security or incident response.

A company can simply use the standard as guidance or be certified by an independent certification body. A certificate is valid for several years, with surveillance audits in between. The standard is related to ISO 9001, and both can be implemented as one integrated system.

How it works in practice

Large customers, banks and public contracting authorities increasingly require ISO 27001 certification from their IT, accounting and data processing suppliers. For companies within the scope of NIS2, the standard is a practical way to demonstrate the mandatory security measures.

Implementation usually takes months, depending on the company’s size. It involves documents such as a security policy and procedures, but above all a change in practice: who has access to what, how passwords are handled, how incidents are reported and how suppliers are vetted.

The costs of implementation and certification, meaning advice, audits, training and technical measures, are deductible. For larger investments in software and equipment, it has to be assessed whether they are assets to be depreciated.

What to watch out for

The most common mistake is treating ISO 27001 as a paperwork exercise. The company has procedures nobody reads and a certificate that protects nothing. When an incident happens it turns out the procedures were not followed, and the certificate helps with neither insurance nor liability.

The second risk is a badly defined scope. The certificate covers only the part of the company named in its scope. If a customer assumes it covers the whole company and an incident happens outside the scope, a dispute over trust follows.