IT Security - ISO 27001 Strategic Review
Using the 10 major groups of the ISO 27001 standard, we review security measures, policies and practices in force in the target organisation.
This strict review serves as an ideal prelude to a detailed ISO 27001 Gap Analysis carried out using our ISO 27001 Gap Analysis Services Package. The very comprehensive coverage of the ISO 27001 standard and its widespread acceptance as a best practice standard means that it is ideal for use with non-technical IT audiences, auditors, regulatory bodies etc. It aids discussion of the area of IT Security at director level and with boards responsible for corporate governance.
The target organisation’s security stance is reviewed in the following ISO 27001 areas:
- Organisational Security - Managing information security within the organisation.
- Asset Classification and Control - Maintenance of appropriate protection of organisational assets.
- Personnel Security - Reducing the risks of human error, theft, fraud or misuse of facilities
- Physical and Environmental Security - Prevention of unauthorised access, damage and interference to business premises and information
- Communications and Operations Management - Ensuring the correct and secure operation of information processing facilities
- Access Control - Control of access to information
- Systems Development and Maintenance - Ensuring that security is built into information systems
- Business Continuity Management - Measures to counteract interruptions to business activities and to protect critical business processes from the effects of major failures or disasters
- Compliance - Avoiding breaches of any criminal, civil law and statutory, regulatory or contractual obligations and of any security requirements
- The Security Management Framework - Review of operational management of security
The contents of the organisational business plan, growth predictions and other similar strategic documents are used to inform the recommendations and conclusions. The review looks at a high level into current policy in all the above areas.
