{"id":593,"date":"2018-09-13T17:44:27","date_gmt":"2018-09-13T17:44:27","guid":{"rendered":"http:\/\/iso.thatwebdev1.co.uk\/?page_id=593"},"modified":"2024-04-30T15:47:34","modified_gmt":"2024-04-30T15:47:34","slug":"iso-27001","status":"publish","type":"page","link":"https:\/\/www.episodeltd.com\/iso-27001\/","title":{"rendered":"ISO 27001"},"content":{"rendered":"\n\t

ISO 27001<\/h1>\n\t

ISO 27001:2013, Information security management systems requirements, is a definitive global model for best practice in managing information safely and securely.<\/h4>\n\t

How do I get ISO 27001?<\/h2>\n\t

Don\u2019t be put off by thinking it is too complex a thing to do. We aren\u2019t saying it\u2019s simple, but with us doing the bulk of the work for you, including managing the whole process, it is relatively straightforward.<\/p>\n

There are essentially 6 stages to becoming and staying certified to ISO 27001:<\/p>\n

    \n
  1. Establish a system that complies with the standard<\/li>\n
  2. Identify which of the 114 control objectives, in 13 categories, apply to your business, why, and what you are doing to control them<\/li>\n
  3. Make everyone aware of the system and any changes in ways of working that have come about<\/li>\n
  4. Operate the system to
    \na. Make sure it works efficiently
    \nb. Build evidence of compliance with the requirements of the standard
    \nc. Get staff familiar with it<\/li>\n
  5. Appoint a \u201ccertification body\u201d to independently assess whether you comply with the standard. We recommend you choose a UKAS accredited body (see below)<\/li>\n
  6. Keep using the system once it has been certified (to keep the certificate)<\/li>\n<\/ol>\n

    There is more detailed information below about the various stages you need to go through.<\/p>\n\t\t\t\t\"\"\n\t

    Your ISO 27001 certification journey<\/h2>\n\t\t\t\t\"Group\n\t

    Getting Started<\/h3>\n\t
      \n
    1. Provide a comprehensive briefing of what the standard asks you to do in simple to understand terms<\/li>\n
    2. Begin to understand in detail how you operate<\/li>\n
    3. Set a timetable and stick to it<\/li>\n
    4. Decide what you want covered by the certificate \u2013 which sites, products and services.<\/li>\n
    5. Put the right resources in place<\/li>\n
    6. Collect all existing documentation<\/li>\n
    7. Establish a dedicated client portal on our collaboration and document sharing platform<\/li>\n
    8. Begin to identify which of the 114 control mechanisms apply and how to address them<\/li>\n
    9. Begin identifying and recording all your information assets<\/li>\n
    10. Begin creating an Information security asset register<\/li>\n
    11. Begin understanding what legislation applies & what you do to comply<\/li>\n<\/ol>\n\t\t\t\t\"Group\n\t

      Implementing<\/h3>\n\t
        \n
      1. Establish a detailed project plan in our online project management platform (and stick to it)<\/li>\n
      2. Undertake a technical audit of your system (with our cyber security\/info sec partner)<\/li>\n
      3. Carry out a Data Protection Impact Assessment (good practice and mandatory for GDPR)<\/li>\n
      4. Decide with you what you need operationally<\/em><\/strong><\/li>\n
      5. Map out your business processes<\/li>\n
      6. Complete a gap analysis between what the standard requires and what you have\/do already<\/li>\n
      7. Implement the system<\/li>\n
      8. Complete required documentation (Statement of Applicability, Asset register, etc.)<\/li>\n
      9. Submit the system to Episode Head Office for final QC checks<\/li>\n
      10. We return it you for your final approval<\/li>\n
      11. Separate consultant Internally audit the system<\/li>\n
      12. Carry out a management review<\/li>\n<\/ol>\n\t\t\t\t\"Group\n\t

        Certification<\/h3>\n\t
          \n
        1. Work with you to select and appoint a UKAS accredited certification body.<\/li>\n
        2. Be onsite throughout the certification process<\/li>\n
        3. Address any issues that arise during the audit<\/li>\n
        4. Brief you on post-certification activity
          \na. 3 year cycle of annual surveillance audits and
          \nb. what you need to do throughout the year to maintain the system<\/li>\n
        5. Agree where the finished, certified system should be housed<\/li>\n<\/ol>\n

          <\/h4>\n

          Episode guarantees certification<\/strong><\/h4>\n\t

          FAQ\u2019s<\/h3>\n\t