Is ISO 27001 Worth It?

For many organisations, knowing whether to go for ISO 27001 can pose something of a dilemma. Motivations vary. There are those that decide they have to go for certification in order to meet contractual obligations, making it a means to an end. Others see it as a way to prove themselves in a crowded market so it’s a differentiator, while some see it as having merit in itself as a means to improve their security practices.

When the time comes, all weigh up the relative pros and cons of ISO 27001, so what are they and is ISO 27001 worth it?

The ISO 27001 standard is well known worldwide and has a reputation for demonstrating an organisational commitment to managing information security. It’s the only auditable international standard that defines the constituents of an ISMS (Information Security Management System), an approach that sets out the policies and procedures for systematically managing, controlling and improving the organisation’s information security.

It can be applied to all organisations, regardless of size or purpose. 

ISO 27001 confers numerous benefits. It can assure customers and partners that the business has done its due diligence with regards to its security, helps the business comply with other industry standards – including protecting personal data, and can lead to an improved security posture by providing focus. However, despite these obvious gains, uptake remains relatively low. 

Low levels Of Adoption

The latest Cybersecurity Longitudinal Survey (Wave 2) conducted by the UK Government in mid 2022 of medium to large businesses found that only 17% adhere to ISO 27001. Another report, the Cyber Security Breaches Survey found only 8% of businesses had adopted the standard, although this rose to 23% among large businesses. 

Quantitative research carried out by the Longitudinal survey revealed that it was often regarded as onerous and expensive. This is probably down to the fact that the standard also requires organisations to carry out internal audits (clause 9.2), in addition to an annual external audit, all of which can rack up costs. 

Many organisations also want the standard to add assurances against cyber-attack. But, as with any security framework, there are no guarantees it will protect you. Any organisation can suffer a breach and there are almost certainly ISO 27001 certified organisations out there that have done so. Rather, the standard assesses and enables improvement of the ISMS framework and in this way reduces the likelihood of breach, lessens the potential impact and protects the company’s reputation by virtue of the fact that it may not be accused of negligence (particularly if operating and maintaining the ISMS has not been neglected) with respect to its security practices. 

In fact, ISO 27001 can make the company’s reputation more resilient if it does suffer a breach. There’s direct evidence of this in the Ponemon Institute report on The Impact of Data Breaches on Reputation and Share Value. It found that those companies deemed to have a low security posture saw their share price drop 4% more on average than those with a high security posture, a gap that then widened over the course of the next 90 days to 5%. 

What’s more, the low security posture group didn’t regain their pre-breach share price during the course of the study whereas those with a high security posture exceeded their pre-breach share price.

So, they not only recovered but went on to make a gain, probably because they had the processes in place to expedite a quick recovery and communicate effectively when disclosing, thereby reassuring the market.

Turning The Tide

It's this business resilience where ISO 27001 really delivers but its highly intangible. However, other drivers are now slowly turning the tide.

Firstly, we’re seeing insurance companies offer checklists that align with the standard and this is seeing smaller companies put the framework in place. The Cyber Breaches Survey found the only thing stopping these companies from becoming fully certified were the audit costs but to all intents and purposes they’ve done the legwork required, making it trivial to then pursue certification. The larger businesses, for instance, said they found it easy to comply once they’d gone through the initial certification process. 

We’ve also seen ISO 27001 updated for the first time in nine years in 2022. Assessments against ISO/IEC 27001:2022 are now happening but organisations have the next three years to comply. The new version now covers information security, cybersecurity and privacy protection and there are three major changes to the standard itself. The standard structure has been consolidated from 14 down to four: Organisational, People, Physical and Technological. The list of controls has decreased from 114 to 93, with 11 new ones added while 57 have been merged and some removed. And finally, five new attributes have been introduced to align with digital security. 

The good news is that this rationalisation of the standard is likely to make it more appealing to SMEs and it’s now more relevant in focus, helping to address the risk associated with remote working for example.

These changes together with the clear evidence that certification can improve security posture and resilience all make for compelling arguments to adopt the standard. 

But perhaps further incentives are required in those sectors where certification isn’t mandatory. Whether that should take the form of additional regulation, financial incentives (ie tax breaks) or advice, guidance and support, as suggested in a recent Cyber Security Incentives and Regulations Review, remains to be seen.

Phil Robinson is Principal Consultant at Prism Infosec

You Might Also Read: 

US Defense Contractors Don't Meet Basic Cyber Security Standards:

____________________________________________________________________________________

If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

« Why Zero Trust Is Fundamental In Today’s Economic Climate
Retrofixing The Remote Workforce »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

Resecurity

Resecurity

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

Vera Security

Vera Security

Vera is a data security platform that provides 360-degree visibility and control over critical business data, anywhere it's shared or stored.

Digital Guardian

Digital Guardian

Digital Guardian is a next generation data protection platform designed to stop data theft.

Internet Storm Center (ISC)

Internet Storm Center (ISC)

ISC provides a free analysis and warning service to thousands of Internet users and organizations, and is actively working with ISPs to fight back against the most malicious attackers.

Critifence

Critifence

Critifence provides unique Cyber Security solutions designed for Critical Infrastructure, SCADA and Industrial Control Systems.

HYPR

HYPR

HYPR Decentralized Authentication minimizes the risk of enterprise data breaches while providing an enhanced user experience for your customers and employees.

FinCom.co

FinCom.co

FinCom.Co is the world’s first automatic AML/ KYC screening system, for comprehensive compliance.

R2S Technologies

R2S Technologies

R2S can help you implement a cyber security framework to ensure your business is more resilient towards the growing threat of cyber crime. We provide Web and Mobile Application Security Assessment..

Sphonic

Sphonic

Sphonic provides regulated institutions of any size a powerful compliance & risk platform to quickly and securely onboard new customers and manage ongoing AML and Fraud & Risk trends.

Bio-Morphis

Bio-Morphis

Bio-Morphis Reflex solution is a paradigm shift in the approach to information systems security.

Applied Magnetics Laboratory (AML)

Applied Magnetics Laboratory (AML)

Applied Magnetics Laboratory is a manufacturer of military security and data destruction equipment for sensitive, classified, and secret information.

Cyber Bytes Foundation

Cyber Bytes Foundation

Cyber Bytes Foundation exists to establish and sustain a unique Cyber Ecosystem to accelerate the development of a strong Cyber workforce and support community outreach programs.

Airgap Networks

Airgap Networks

Airgap is fixing the fundamental flaw of excessive trust. We help enterprises modernize their network for a simple and secure infrastructure.

Ruptura InfoSecurity

Ruptura InfoSecurity

Ruptura InfoSecurity provide CREST Accredited Penetration Testing & Offensive Security Services. We secure your critical assets through targeted and research driven penetration testing.

Security Awareness Special Interest Group (SASIG)

Security Awareness Special Interest Group (SASIG)

The Security Awareness Special Interest Group (SASIG) addresses the human aspects of security and fraud prevention in an initiative to improve trust and confidence in the online environment.

WaveLink

WaveLink

WaveLink offers low risk, results-oriented Engineering Services and best-of-class Technical Support Services. Areas of expertise include cyber and security engineering.

SECTA5

SECTA5

SECTA5 is a cybersecurity company building a next-generation Continuous Threat and Exposure Management platform, leveraging the expertise of offensively trained cyber defenders.