ISO 27001 vs. Cyber Essentials: Similarities and differences
Rhand Leal
In the Internet environment, big, medium, and small businesses all face similar risks, and many regulatory demands enforce information protection,...
In the Internet environment, big, medium, and small businesses all face similar risks, and many regulatory demands enforce information protection, but differences in resources and knowledge often result in data breaches because of the failure...
How to gain employee buy-in when implementing cybersecurity according to ISO 27001
Hannah Churchman
In the majority of organizations, change is embraced by senior management, but feared by employees. In the case of implementing...
In the majority of organizations, change is embraced by senior management, but feared by employees. In the case of implementing ISO 27001, a committed senior management team (SMT) can understand clearly the benefits that an...
Which security clauses to use for supplier agreements?
Running a business on your own these days is practically impossible. Maintaining high levels of performance in every aspect of...
Running a business on your own these days is practically impossible. Maintaining high levels of performance in every aspect of your business to stay competitive means draining precious resources that would be better invested in...
Using ISO 22301 business continuity practices to support mass public events
Wolfgang Mahr
Managing public events with hundreds or thousands of people is a challenge, as disruptions of these events may result in...
Managing public events with hundreds or thousands of people is a challenge, as disruptions of these events may result in huge material losses or even loss of life. We face the classic situation where disruptions...
Case study: ISO 27001 implementation in an IT system integrator company
Aleksandra Gakidova
For any major change in our lives, whether professional or personal, there are questions that come up before taking the...
For any major change in our lives, whether professional or personal, there are questions that come up before taking the first step. Here are just a few of the questions that you may face before...
How ISO 27001 can help suppliers comply with U.S. DFARS 7012
DFARS 7012 is an example of how customers’ concerns about protecting their information in the custody of suppliers and outsourced...
DFARS 7012 is an example of how customers’ concerns about protecting their information in the custody of suppliers and outsourced services has led to the establishment of ever more complex security requirements for those who...
How to demonstrate resource provision in ISO 27001
The availability of resources is a critical point in any endeavor. You can have the best ideas and the best...
The availability of resources is a critical point in any endeavor. You can have the best ideas and the best intentions, but if you lack resources you are doomed to failure. So, it may seem...
What to implement first: ISO 22301 or ISO 27001?
Implementing ISO management system standards, even with the help of toolkits and consultants, may be a challenging task. In practice,...
Implementing ISO management system standards, even with the help of toolkits and consultants, may be a challenging task. In practice, sometimes it seems appropriate to enhance preparedness and protection in several areas of an organization,...
How to use Scrum for the ISO 27001 implementation project
Antonio Jose Segovia
Scrum is a framework, based on the Agile method, mainly used in software development. Originally, it was developed for complex...
Scrum is a framework, based on the Agile method, mainly used in software development. Originally, it was developed for complex product development, and there are many companies in the world that currently use this framework...
Should information security focus on asset protection, compliance, or corporate governance?
Dejan Kosutic
Traditionally, information security has been perceived as an activity that was built around protecting sensitive information assets – after all,...
Traditionally, information security has been perceived as an activity that was built around protecting sensitive information assets – after all, this is what the first (2005) revision of ISO 27001, and its predecessor BS 7799-2,...
Business Continuity Management vs. Information Security vs. IT Disaster Recovery
For outsiders, it’s not easy to distinguish among the specific purposes of Business Continuity Management (BCM), Information Security (IS), and...
For outsiders, it’s not easy to distinguish among the specific purposes of Business Continuity Management (BCM), Information Security (IS), and IT Disaster Recovery (IT DR). All three areas have something to do with “security,” “losses,”...
Aligning information security with the strategic direction of a company according to ISO 27001
There is one requirement of ISO 27001 that is very rarely mentioned, and yet it is probably crucial for the long-term...
There is one requirement of ISO 27001 that is very rarely mentioned, and yet it is probably crucial for the long-term “survival” of an Information Security Management System (ISMS) in a company: this is the requirement...
How to manage the security of network services according to ISO 27001 A.13.1.2
Everybody knows that information is stored in information systems (workstations, laptops, smartphones, etc.), but to exchange the information via a...
Everybody knows that information is stored in information systems (workstations, laptops, smartphones, etc.), but to exchange the information via a network is necessary. Most of the information systems in this world are connected to the...
How to identify ISMS requirements of interested parties in ISO 27001
“If you do not know where you’re going, you’re unlikely to end there.” This saying from the title character in...
“If you do not know where you’re going, you’re unlikely to end there.” This saying from the title character in the movie Forrest Gump describes perfectly why many projects fail: lack of clear requirements. Definition...
How to integrate ISO 27001 controls into the system/software development life cycle (SDLC)
Updated: March 27, 2023, according to the ISO 27001 2022 revision. Information security is only as good as the processes...
Updated: March 27, 2023, according to the ISO 27001 2022 revision. Information security is only as good as the processes related to it, yet we find many organizations concerned only about whether security features exist...
