We spend over 1 million hours each year improving the performance ofbusinesses around the world

ISO/IEC
27001:2013

Information Security
Management

This experience allows us to see first-hand how ISO/IEC 27001 can help organizations to continually improve and deliver real benefits.

Business issue

How ISO/IEC 27001 helps

Benefit to your organization• Helps you identify risks to your information and put in place measures toReputation• Improved reputation and stakeholder confidence
manage or reduce them
• Better visibility of risk amongst interested parties• Helps you put in place procedures to enable prompt detection of information • Builds trust and credibility in the market to help you win moresecurity breaches

business• Requires you to continually improve your Information Security ManagementSystem (ISMS)• Requires you to identify all internal and external stakeholders relevant toyour Management System ISMS

Engagement• Requires you to communicate the ISMS policy to and ensure that theworkforce understands how they contribute to it• Top management need to define ISMS roles and ensure individuals are• Improved information security awareness amongst all relevant
parties• Reduces likelihood of staff-related information security breaches• Shows commitment to information security at all levels of thebusinesscompetent• Gives you a framework which helps you to manage your legal and regulatory

Compliancerequirements• Makes you review and communicate your regulatory requirements to other• Reduces the likelihood of fines or prosecution• Helps you comply with relevant legislation and helps make sure
you keep up-to-dateinterested parties• It makes you assess risks to information security so you can identify

Risk
management

potential weaknesses and respond• Requires you to put in place controls that are proportionate to the risks• Requires you to continually evaluate risks to your information security andmake sure the controls you put in place are appropriate• Helps you protect your information so you can continue businessas usual and minimize disruptions• Gives cost savings by minimizing incidents• Ensures information is protected, available, and can be accessedTop tips on making ISO/IEC 27001 effective for you
Every year we have interactions with tens of thousands of clients. Here are their top tips.
Top management commitment is key to making
implementation of ISO/IEC 27001 a success. They need tobe actively involved and approve the resources required.

“The earlier that organizations talk to senior managers, thebetter it will go for them so have those discussions early”.

Think about how different departments work together
to avoid silos. Make sure the organization works as a teamfor the benefit of customers and the organization.

“The key to implementing the standard lay in getting staff to think
about information security as an integral part of the daily businessand not as an additional burden”.

John Scott, Overbury, leading UK fit-out and refurbishment business

Mr. Thamer, Ibrahim Ali Arab, Assistant General Manager I.T.

Review systems, policies, procedures and processes
you have in place – you may already do much of what’s in thestandard, and make it work for your business. You shouldn’t be doing
something just for the sake of the standard – it needs to add value.

“Don’t try and change your business to fit the standard. Think about
how you do things and how that standard reflects on how you do it,
rather than the other way around”.

Speak to your customers and suppliers.
They may be able to suggest improvements and give
feedback on your service.

“This certification allows us to go one step further by offering ourcustomers the peace of mind that we have the best controls in place
to identify and reduce any risks to confidential information”.

Paul Brazier, Commercial Director, Overbury

Jitesh Bavisi, Director of Compliance, Exponential-eBavisi

And finally, when you gain certification celebrate yourachievement and use the BSI Assurance Mark on yourliterature, website and promotional material.

“The course was loaded with practical exercises and real-case scenarios
and was structured in a way that it encouraged participants to beinteractive and share their experiences in information security”.
Nataliya Stephenson Manager, Information Security, NSW Attorney General’sDepartment

Find out more
Call: +44 (0)345 080 9000
Visit: bsigroup.com

BSI/UK/842/SC/0416/EN/BLD

Train your staff to carry out internal audits of the system.
This can help with their understanding, but it could also provide
valuable feedback on potential problems or opportunities
for achievement.

© BSI Group