What is ISO 27001:2005?

All organizations today have to respond to a rapidly changing and increasingly threatening range of information security risks – risks which can, if unmitigated, lead to severe financial, regulatory and reputation damage for organizations. Information security investment and control decisions should be specifically driven by the outcome of a risk assessment process that identifies risks to specific information assets.

We provide clear, practical and comprehensive inspection/auditing on developing a risk management methodology that meets the requirements of ISO27001, the information security management standard that will help achieve corporate risk management objectives.

Why seek certification to ISO 27001:2005?

Information security management system (ISMS) - the ‘guts’ of the standard, based on the Plan-Do-Check-Act cycle where Plan = define requirements, assess risks, decide which controls are applicable; Do = implement and operate the ISMS; Check = monitor and review the ISMS; Act = maintain and continuously improve the ISMS. Also specifies certain specific documents that are required and must be controlled, and states that records must be generated and controlled to prove the operation of the ISMS (e.g. certification audit purposes).

• Management responsibility - management must demonstrate their commitment to the ISMS, principally by allocating adequate resources to implement and operate it.
• Internal ISMS audits - the organization must conduct periodic internal audits to ensure the ISMS incorporates adequate controls which operate effectively.
• Management review of the ISMS - management must review the suitability, adequacy and effectiveness of the ISMS at least once a year, assessing opportunities for improvement and the need for changes.
• ISMS improvements - the organization must continually improve the ISMS by assessing and where necessary making changes to ensure its suitability and effectiveness, addressing nonconformance (noncompliance) and where possible preventing recurrent issues.

Requirement for ISMS

• Product Description
• Establishing Policy
• Quality records & documentation
• Management Review

Assessment to ISO 27001.2005

Once all the requirements of ISO 27001 have been met, it is time for an internal / external / certification audit. This is carried by our experienced auditors as we are certification body. Our certification body & professional auditors will review the quality manuals and procedures. This process involves looking at the company’s evaluation of quality and ascertains if targets set for the management program are measurable and achievable. This is followed at a later date by a full on-site audit to ensure that working practices observe the procedures and stated objectives and that appropriate records are kept.

After a successful audit, a certificate of registration to ISO 27001:2005 will be issued. There will then be surveillance visits (usually once/twice a year) to ensure that the system continues to work effectively.

The Benefits of implementing ISO 27001:2005

• Improves credibility and enhances customers confidence.
• Reduces the needs for multiple assessments.
• Provides opportunity for continuous improvement through regular audits.
• Provides more avenues for trade in the global market.

What is the cost of an audit to ISO 27001:2005?

To know about the cost of certification/audit to ISO 27001:2005, please contact us on details provided.