Is ISO 27001 Worth It?

For many organisations, knowing whether to go for ISO 27001 can pose something of a dilemma. Motivations vary. There are those that decide they have to go for certification in order to meet contractual obligations, making it a means to an end. Others see it as a way to prove themselves in a crowded market so it’s a differentiator, while some see it as having merit in itself as a means to improve their security practices.

When the time comes, all weigh up the relative pros and cons of ISO 27001, so what are they and is ISO 27001 worth it?

The ISO 27001 standard is well known worldwide and has a reputation for demonstrating an organisational commitment to managing information security. It’s the only auditable international standard that defines the constituents of an ISMS (Information Security Management System), an approach that sets out the policies and procedures for systematically managing, controlling and improving the organisation’s information security.

It can be applied to all organisations, regardless of size or purpose. 

ISO 27001 confers numerous benefits. It can assure customers and partners that the business has done its due diligence with regards to its security, helps the business comply with other industry standards – including protecting personal data, and can lead to an improved security posture by providing focus. However, despite these obvious gains, uptake remains relatively low. 

Low levels Of Adoption

The latest Cybersecurity Longitudinal Survey (Wave 2) conducted by the UK Government in mid 2022 of medium to large businesses found that only 17% adhere to ISO 27001. Another report, the Cyber Security Breaches Survey found only 8% of businesses had adopted the standard, although this rose to 23% among large businesses. 

Quantitative research carried out by the Longitudinal survey revealed that it was often regarded as onerous and expensive. This is probably down to the fact that the standard also requires organisations to carry out internal audits (clause 9.2), in addition to an annual external audit, all of which can rack up costs. 

Many organisations also want the standard to add assurances against cyber-attack. But, as with any security framework, there are no guarantees it will protect you. Any organisation can suffer a breach and there are almost certainly ISO 27001 certified organisations out there that have done so. Rather, the standard assesses and enables improvement of the ISMS framework and in this way reduces the likelihood of breach, lessens the potential impact and protects the company’s reputation by virtue of the fact that it may not be accused of negligence (particularly if operating and maintaining the ISMS has not been neglected) with respect to its security practices. 

In fact, ISO 27001 can make the company’s reputation more resilient if it does suffer a breach. There’s direct evidence of this in the Ponemon Institute report on The Impact of Data Breaches on Reputation and Share Value. It found that those companies deemed to have a low security posture saw their share price drop 4% more on average than those with a high security posture, a gap that then widened over the course of the next 90 days to 5%. 

What’s more, the low security posture group didn’t regain their pre-breach share price during the course of the study whereas those with a high security posture exceeded their pre-breach share price.

So, they not only recovered but went on to make a gain, probably because they had the processes in place to expedite a quick recovery and communicate effectively when disclosing, thereby reassuring the market.

Turning The Tide

It's this business resilience where ISO 27001 really delivers but its highly intangible. However, other drivers are now slowly turning the tide.

Firstly, we’re seeing insurance companies offer checklists that align with the standard and this is seeing smaller companies put the framework in place. The Cyber Breaches Survey found the only thing stopping these companies from becoming fully certified were the audit costs but to all intents and purposes they’ve done the legwork required, making it trivial to then pursue certification. The larger businesses, for instance, said they found it easy to comply once they’d gone through the initial certification process. 

We’ve also seen ISO 27001 updated for the first time in nine years in 2022. Assessments against ISO/IEC 27001:2022 are now happening but organisations have the next three years to comply. The new version now covers information security, cybersecurity and privacy protection and there are three major changes to the standard itself. The standard structure has been consolidated from 14 down to four: Organisational, People, Physical and Technological. The list of controls has decreased from 114 to 93, with 11 new ones added while 57 have been merged and some removed. And finally, five new attributes have been introduced to align with digital security. 

The good news is that this rationalisation of the standard is likely to make it more appealing to SMEs and it’s now more relevant in focus, helping to address the risk associated with remote working for example.

These changes together with the clear evidence that certification can improve security posture and resilience all make for compelling arguments to adopt the standard. 

But perhaps further incentives are required in those sectors where certification isn’t mandatory. Whether that should take the form of additional regulation, financial incentives (ie tax breaks) or advice, guidance and support, as suggested in a recent Cyber Security Incentives and Regulations Review, remains to be seen.

Phil Robinson is Principal Consultant at Prism Infosec

You Might Also Read: 

US Defense Contractors Don't Meet Basic Cyber Security Standards:

____________________________________________________________________________________

If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

« Why Zero Trust Is Fundamental In Today’s Economic Climate
Retrofixing The Remote Workforce »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

FT Cyber Resilience Summit: Europe

FT Cyber Resilience Summit: Europe

27 November 2024 | In-Person & Digital | 22 Bishopsgate, London. Business leaders, Innovators & Experts address evolving cybersecurity risks.

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

Cortado Mobile Solutions

Cortado Mobile Solutions

Cortado Mobile Solutions is the manufacturer of the mobile device management solution Cortado MDM.

Zayo

Zayo

Zayo is a leading global bandwidth infrastructure services provider for high-performance connectivity, secure colocation and flexible cloud services.

Association of Information Security Professionals (AISP)

Association of Information Security Professionals (AISP)

The Association of Information Security Professionals (AISP) represents the interests of information security professionals in Singapore.

Wooxo

Wooxo

Wooxo provides business security and continuity solutions to protect business data for organisation of all sizes.

Conix

Conix

Conix offerings include Governance and Risk Management, Auditing and Penetration Testing, Digital Forensics, Managed Security Operations Centre (SOC).

Nixu

Nixu

Nixu is the largest Nordic specialist company in information security consulting.

Cybertech

Cybertech

Cybertech Conference & Exhibition presents commercial problem solving strategies and solutions for the global cyber threat that meet the diverse challenges for a wide range of sectors.

Digital Resolve

Digital Resolve

Digital Resolve delivers solutions that help companies maintain trust and confidence through proven and cost-effective fraud-protection and identity intelligence technology.

SIS Certifications (SIS CERT)

SIS Certifications (SIS CERT)

SIS Certifications is an ISO certification body serving more than 10,000 clients in over 15 countries worldwide.

Incopro

Incopro

Incopro is an online IP and brand protection software provider that arms brand owners with actionable intelligence to combat online and offline intellectual property and copyright infringements.

Stellar Cyber

Stellar Cyber

Stellar Cyber makes Open XDR, the only comprehensive security platform providing maximum protection of applications and data wherever they reside.

Conference on Applied Machine Learning in Information Security (CAMLIS)

Conference on Applied Machine Learning in Information Security (CAMLIS)

CAMLIS is a venue for discussing applied research on machine learning, deep learning and data science in information security.

Dr Web

Dr Web

Since 1992 the Russian anti-virus Dr.Web has been helping companies to keep their digital assets protected and operate in a secure digital environment.

Techstep

Techstep

Techstep is a complete mobile technology enabler, making positive changes to the world of work; freeing people to work more effectively, securely and sustainably.

ITC Federal

ITC Federal

ITC Federal delivers IT cybersecurity assessment services to support agencies in meeting their security strategies and federal security compliance goals.

Indevtech

Indevtech

Indevtech has been serving Hawaii since 2001, providing end-to-end managed IT services to small- and medium-businesses.