Is ISO 27001 Worth It?

For many organisations, knowing whether to go for ISO 27001 can pose something of a dilemma. Motivations vary. There are those that decide they have to go for certification in order to meet contractual obligations, making it a means to an end. Others see it as a way to prove themselves in a crowded market so it’s a differentiator, while some see it as having merit in itself as a means to improve their security practices.

When the time comes, all weigh up the relative pros and cons of ISO 27001, so what are they and is ISO 27001 worth it?

The ISO 27001 standard is well known worldwide and has a reputation for demonstrating an organisational commitment to managing information security. It’s the only auditable international standard that defines the constituents of an ISMS (Information Security Management System), an approach that sets out the policies and procedures for systematically managing, controlling and improving the organisation’s information security.

It can be applied to all organisations, regardless of size or purpose. 

ISO 27001 confers numerous benefits. It can assure customers and partners that the business has done its due diligence with regards to its security, helps the business comply with other industry standards – including protecting personal data, and can lead to an improved security posture by providing focus. However, despite these obvious gains, uptake remains relatively low. 

Low levels Of Adoption

The latest Cybersecurity Longitudinal Survey (Wave 2) conducted by the UK Government in mid 2022 of medium to large businesses found that only 17% adhere to ISO 27001. Another report, the Cyber Security Breaches Survey found only 8% of businesses had adopted the standard, although this rose to 23% among large businesses. 

Quantitative research carried out by the Longitudinal survey revealed that it was often regarded as onerous and expensive. This is probably down to the fact that the standard also requires organisations to carry out internal audits (clause 9.2), in addition to an annual external audit, all of which can rack up costs. 

Many organisations also want the standard to add assurances against cyber-attack. But, as with any security framework, there are no guarantees it will protect you. Any organisation can suffer a breach and there are almost certainly ISO 27001 certified organisations out there that have done so. Rather, the standard assesses and enables improvement of the ISMS framework and in this way reduces the likelihood of breach, lessens the potential impact and protects the company’s reputation by virtue of the fact that it may not be accused of negligence (particularly if operating and maintaining the ISMS has not been neglected) with respect to its security practices. 

In fact, ISO 27001 can make the company’s reputation more resilient if it does suffer a breach. There’s direct evidence of this in the Ponemon Institute report on The Impact of Data Breaches on Reputation and Share Value. It found that those companies deemed to have a low security posture saw their share price drop 4% more on average than those with a high security posture, a gap that then widened over the course of the next 90 days to 5%. 

What’s more, the low security posture group didn’t regain their pre-breach share price during the course of the study whereas those with a high security posture exceeded their pre-breach share price.

So, they not only recovered but went on to make a gain, probably because they had the processes in place to expedite a quick recovery and communicate effectively when disclosing, thereby reassuring the market.

Turning The Tide

It's this business resilience where ISO 27001 really delivers but its highly intangible. However, other drivers are now slowly turning the tide.

Firstly, we’re seeing insurance companies offer checklists that align with the standard and this is seeing smaller companies put the framework in place. The Cyber Breaches Survey found the only thing stopping these companies from becoming fully certified were the audit costs but to all intents and purposes they’ve done the legwork required, making it trivial to then pursue certification. The larger businesses, for instance, said they found it easy to comply once they’d gone through the initial certification process. 

We’ve also seen ISO 27001 updated for the first time in nine years in 2022. Assessments against ISO/IEC 27001:2022 are now happening but organisations have the next three years to comply. The new version now covers information security, cybersecurity and privacy protection and there are three major changes to the standard itself. The standard structure has been consolidated from 14 down to four: Organisational, People, Physical and Technological. The list of controls has decreased from 114 to 93, with 11 new ones added while 57 have been merged and some removed. And finally, five new attributes have been introduced to align with digital security. 

The good news is that this rationalisation of the standard is likely to make it more appealing to SMEs and it’s now more relevant in focus, helping to address the risk associated with remote working for example.

These changes together with the clear evidence that certification can improve security posture and resilience all make for compelling arguments to adopt the standard. 

But perhaps further incentives are required in those sectors where certification isn’t mandatory. Whether that should take the form of additional regulation, financial incentives (ie tax breaks) or advice, guidance and support, as suggested in a recent Cyber Security Incentives and Regulations Review, remains to be seen.

Phil Robinson is Principal Consultant at Prism Infosec

You Might Also Read: 

US Defense Contractors Don't Meet Basic Cyber Security Standards:

____________________________________________________________________________________

If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

« Why Zero Trust Is Fundamental In Today’s Economic Climate
Retrofixing The Remote Workforce »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Cyber Security Supplier Directory

Cyber Security Supplier Directory

Our Supplier Directory lists 6,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

Resecurity, Inc.

Resecurity, Inc.

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

The PC Support Group

The PC Support Group

A partnership with The PC Support Group delivers improved productivity, reduced costs and protects your business through exceptional IT, telecoms and cybersecurity services.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

Serena

Serena

Serena Software helps increase speed of the software development lifecycle while enhancing security, compliance, and performance.

Infiltrate

Infiltrate

INFILTRATE is a deep technical conference that focuses entirely on offensive security issues.

Information Security Research Group - University of South Wales

Information Security Research Group - University of South Wales

The Information Security Research Group has an international reputation in the areas of network security, computer forensics and threat analysis.

GreyCastle Security

GreyCastle Security

GreyCastle Security is a leading cybersecurity services provider dedicated exclusively to cybersecurity and the practical management of cybersecurity risks.

Claranet

Claranet

Claranet are experts in modernising and running critical applications and infrastructure through end-to-end professional services, managed services and training.

Ignyte Assurance Platform

Ignyte Assurance Platform

Ignyte Assurance Platform™ is a leader in collaborative security and integrated GRC solutions for global corporations in Healthcare, Defense, and Technology.

BrainChip

BrainChip

BrainChip is the leading provider of neuromorphic computing solutions, a type of artificial intelligence that is inspired by the biology of the human neuron - spiking neural networks.

Totalsec

Totalsec

Totalsec is a Grupo Salinas company with a team of professionals in cybersecurity and information security providing Security Consulting, Solutions Integration, and Managed Security Services.

Inpher

Inpher

Inpher has pioneered cryptographic Secret Computing® that enables advanced analytics and machine learning while keeping data private, secure, and distributed.

Kontron

Kontron

Kontron offers a combined portfolio of secure hardware, middleware and services for Internet of Things (IoT) and Industry 4.0 applications.

Axiado

Axiado

Axiado Corporation is a security processor company redefining hardware root of trust with hardware-based security technologies, including per-system AI.

LocateRisk

LocateRisk

LocateRisk provides more efficiency, transparency and comparability in IT security with automated, KPI-based IT risk analyses.

Halborn

Halborn

Elite blockchain cybersecurity. Award-winning ethical blockchain hackers to secure your stack end-to-end. Far beyond smart contracts.

Arctic Group

Arctic Group

Arctic Group is a Swedish service provider focusing on cybersecurity, integration services and deployment of software development tools.

Apura Cybersecurity Intelligence

Apura Cybersecurity Intelligence

Apura is a Brazilian company that develops advanced products and provides specialized services in information security and cyber defense.

Archer Technologies

Archer Technologies

Archer helps organizations manage risk in the digital era—uniting stakeholders, integrating technologies and transforming risk into reward.