ISO 27001 is a leading international standard for information security management, aimed at protecting the confidentiality, integrity, and availability of information across organizations, regardless of its technical nature. The benefits of ISO 27001 certification include an improved organizational image, reduced costs through risk avoidance, and smoother operations due to clearly defined responsibilities. Successful implementation involves planning, implementing, checking, and improving the information security management system, varying in duration and cost depending on organizational size.

1. Benefits of ISO 27001

2. About ISO 27001 Leading international standard for information security management Till the end of year 2009, more than 12 , 000 organizations worldwide certified against this standard Its purpose is to protect the confidentiality, integrity and availability of information

3. ISO 27001 It is not a technical standard that would describe the ISMS into technical detail It does not focus only on information technology, but also on other important assets at the organization

4. ISO 27001 Focuses on all business processes and business assets Focuses on reducing the risks for information that is valuable for the organization Information may or may not be related to information technology, may or may not be in a digital form

5. ISO 27001 benefits Better organizational image because of the certificate issued by certification body Lower costs because of the avoided risks The operations in the organization are running more smoothly because the responsibilities and business processes are clearly defined

6. Process of ISO 27001 implementation Phase 1 - Planning Phase 2 - Implementing Phase 3 - Checking Phase 4 - Improving

7. Planning the ISMS Policy and objectives Risk assessment & risk treatment Risk Assessment Report Statement of Applicability

8. Implementing the ISMS 4 mandatory procedures Risk Treatment Plan Implement all controls Conduct trainings, awareness

9. Checking the ISMS Execute monitoring and reviewing procedures Measuring the effectiveness of controls Internal audit Management review

10. Improving the ISMS Corrective actions Preventive actions

11. Requirements for successful implementation Management support (available people + funding) Project team Awareness of employees

12. Duration of implementation For very small organizations (less than 10 employees) - up to 4 months For small organizations (10 to 50 employees) - up to 8 months For middle sized organizations (50 to 500 employees) - up to 12 months For large organizations (500 or more employees) - up to 18 months

13. Cost of implementation It is not possible to calculate the cost before the risk assessment is completed and applicable controls are identified Majority of investment is usually not in technology, but in employees that are implementing the ISMS (invested time + trainings)

14. For more useful information: www.iso27001standard.com