Is ISO 27001 Worth It?

For many organisations, knowing whether to go for ISO 27001 can pose something of a dilemma. Motivations vary. There are those that decide they have to go for certification in order to meet contractual obligations, making it a means to an end. Others see it as a way to prove themselves in a crowded market so it’s a differentiator, while some see it as having merit in itself as a means to improve their security practices.

When the time comes, all weigh up the relative pros and cons of ISO 27001, so what are they and is ISO 27001 worth it?

The ISO 27001 standard is well known worldwide and has a reputation for demonstrating an organisational commitment to managing information security. It’s the only auditable international standard that defines the constituents of an ISMS (Information Security Management System), an approach that sets out the policies and procedures for systematically managing, controlling and improving the organisation’s information security.

It can be applied to all organisations, regardless of size or purpose. 

ISO 27001 confers numerous benefits. It can assure customers and partners that the business has done its due diligence with regards to its security, helps the business comply with other industry standards – including protecting personal data, and can lead to an improved security posture by providing focus. However, despite these obvious gains, uptake remains relatively low. 

Low levels Of Adoption

The latest Cybersecurity Longitudinal Survey (Wave 2) conducted by the UK Government in mid 2022 of medium to large businesses found that only 17% adhere to ISO 27001. Another report, the Cyber Security Breaches Survey found only 8% of businesses had adopted the standard, although this rose to 23% among large businesses. 

Quantitative research carried out by the Longitudinal survey revealed that it was often regarded as onerous and expensive. This is probably down to the fact that the standard also requires organisations to carry out internal audits (clause 9.2), in addition to an annual external audit, all of which can rack up costs. 

Many organisations also want the standard to add assurances against cyber-attack. But, as with any security framework, there are no guarantees it will protect you. Any organisation can suffer a breach and there are almost certainly ISO 27001 certified organisations out there that have done so. Rather, the standard assesses and enables improvement of the ISMS framework and in this way reduces the likelihood of breach, lessens the potential impact and protects the company’s reputation by virtue of the fact that it may not be accused of negligence (particularly if operating and maintaining the ISMS has not been neglected) with respect to its security practices. 

In fact, ISO 27001 can make the company’s reputation more resilient if it does suffer a breach. There’s direct evidence of this in the Ponemon Institute report on The Impact of Data Breaches on Reputation and Share Value. It found that those companies deemed to have a low security posture saw their share price drop 4% more on average than those with a high security posture, a gap that then widened over the course of the next 90 days to 5%. 

What’s more, the low security posture group didn’t regain their pre-breach share price during the course of the study whereas those with a high security posture exceeded their pre-breach share price.

So, they not only recovered but went on to make a gain, probably because they had the processes in place to expedite a quick recovery and communicate effectively when disclosing, thereby reassuring the market.

Turning The Tide

It's this business resilience where ISO 27001 really delivers but its highly intangible. However, other drivers are now slowly turning the tide.

Firstly, we’re seeing insurance companies offer checklists that align with the standard and this is seeing smaller companies put the framework in place. The Cyber Breaches Survey found the only thing stopping these companies from becoming fully certified were the audit costs but to all intents and purposes they’ve done the legwork required, making it trivial to then pursue certification. The larger businesses, for instance, said they found it easy to comply once they’d gone through the initial certification process. 

We’ve also seen ISO 27001 updated for the first time in nine years in 2022. Assessments against ISO/IEC 27001:2022 are now happening but organisations have the next three years to comply. The new version now covers information security, cybersecurity and privacy protection and there are three major changes to the standard itself. The standard structure has been consolidated from 14 down to four: Organisational, People, Physical and Technological. The list of controls has decreased from 114 to 93, with 11 new ones added while 57 have been merged and some removed. And finally, five new attributes have been introduced to align with digital security. 

The good news is that this rationalisation of the standard is likely to make it more appealing to SMEs and it’s now more relevant in focus, helping to address the risk associated with remote working for example.

These changes together with the clear evidence that certification can improve security posture and resilience all make for compelling arguments to adopt the standard. 

But perhaps further incentives are required in those sectors where certification isn’t mandatory. Whether that should take the form of additional regulation, financial incentives (ie tax breaks) or advice, guidance and support, as suggested in a recent Cyber Security Incentives and Regulations Review, remains to be seen.

Phil Robinson is Principal Consultant at Prism Infosec

You Might Also Read: 

US Defense Contractors Don't Meet Basic Cyber Security Standards:

____________________________________________________________________________________

If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

« Why Zero Trust Is Fundamental In Today’s Economic Climate
Retrofixing The Remote Workforce »

CyberSecurity Jobsite
Check Point

Directory of Suppliers

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

BCS, The chartered Institute for IT

BCS, The chartered Institute for IT

BCS provides IT professionals with up to date and relevant certifications enabling them to manage IT security effectively within their budget.

HPE Aruba Networking

HPE Aruba Networking

HPE Aruba Networking, a Hewlett Packard Enterprise company, is a leading provider of next-generation network access solutions for the mobile enterprise.

CRU Data Security Group (CDSG)

CRU Data Security Group (CDSG)

CRU is a pioneer in devices for data mobility, data security, encryption, and digital investigation.

Identifi Global Recruitment

Identifi Global Recruitment

Identifi Global is one of the UK's leading Cyber Security & IT Recruitment specialists.

GreyNoise Intelligence

GreyNoise Intelligence

GreyNoise Intelligence is a cyber security company that collects, labels, and analyzes Internet-wide scan and attack data.

iSecurity Consulting

iSecurity Consulting

iSecurity delivers a complete lifecycle of digital protection services across the globe for public and private sector clients.

Secured Communications

Secured Communications

Secured Communications has developed the only unified secure communications platform trusted by public safety and counter terrorism professionals around the world.

Stratosphere Networks

Stratosphere Networks

Stratosphere Networks offer managed cybersecurity services rooted in Managed Detection and Response and Security Operations Center services that our team can tailor to meet your needs.

6clicks

6clicks

6clicks is an easy way to implement your risk and compliance program or achieve compliance with ISO 27001, SOC 2, PCI-DSS, HIPAA, NIST, FedRAMP and many other standards.

Ballistic Ventures

Ballistic Ventures

Ballistic Ventures is a new kind of venture capital firm, built by and for cybersecurity entrepreneurs and investors.

Druva

Druva

Druva is the industry’s leading SaaS platform for data resiliency, and the only vendor to ensure data protection across the most common data risks backed by a $10m guarantee.

Mobilicom

Mobilicom

Mobilicom is an end-to-end provider of cybersecurity and smart solutions for drones, robotics & autonomous platforms.

Google Cloud

Google Cloud

Accelerate your digital transformation. Whether your business is early in its journey or well on its way to digital transformation, Google Cloud can help solve your toughest challenges.

Diversified Technical Services Inc. (DTSI)

Diversified Technical Services Inc. (DTSI)

DTSI provides a wide range of technology solutions for Federal Agencies, the Department of Defense, and commerical organizations with capabilities including Cyber Security and DevSecOps.

Teal

Teal

Teal provides exceptional managed IT solutions for small- to medium-sized organizations that value real partnerships and elevated security.

QuantumGate

QuantumGate

QuantumGate are a team of world-class cryptographers, cybersecurity professionals and researchers. We help organizations protect their data assets in a post-quantum world.