Illustrative stock imagery from Pexels. Images do not identify the people, premises or events discussed and do not imply endorsement.
Stay Ahead of Cyber Threats and Protect Your Data with ISO 27001
Information security involves people, working practices and technology. ISO 27001 provides requirements for an information security management system, or ISMS. An independent audit examines the implemented system within its stated scope; it is not a promise that attacks or mistakes will never occur.
Connect a risk with the organisation's response
For an illustrative audit trail, consider an employee receiving a fraudulent request for confidential information. The auditor could ask how the organisation recognised this risk, who owns the response and what evidence shows that the chosen arrangements operate in practice.
Depending on the circumstances, the organisation may have relevant staff guidance, access arrangements, reporting routes or technical safeguards. These are examples to investigate, not a universal design prescription or findings about a named company.
Look beyond a list of security products
Buying a tool does not explain who uses it, how its results are reviewed or what happens when it reports a problem. An audit can connect the organisation's decisions with operating records, interviews and follow-up action.
Where an incident or exercise identifies a weakness, useful questions include what was learned, who acted and how the organisation judged whether the action worked. The answers should be supported by evidence relevant to the system's scope.
Keep the assurance clear
A certificate is not a guarantee of legal compliance or a replacement for another assurance scheme a customer requires. Check the actual contractual and regulatory requirements rather than assuming one certificate satisfies them all.
NIST publishes informative references describing relationships between the Cybersecurity Framework and other resources. A mapping should not be presented as NIST endorsement of an organisation, product or service.
AAA provides independent ISO 27001 certification audits. Your organisation remains responsible for implementing its system, selecting suitable safeguards and meeting its obligations. Tell us about your organisation for an indicative price or send a readiness enquiry. Certification follows an audit and an independent decision.
Sources: ISO information on ISO 27001; NIST informative references; ICO data-security guidance.