What is ISO 27001? Information security explained simply | DICIS AG

ISO 27001 is an international standard for information security management systems, which organizations (companies, associations, clubs, authorities, etc.) use to reliably implement all data protection and information security requirements. It follows the same principles as quality management systems such as ISO 9001, the so-called “High Level Structure” of the ISO family of standards. Management systems according to ISO 27001 can be certified as part of an ISO certification. In this article, you will learn about the requirements of ISO 27001.

Why does ISO 27001 exist?

Information security and data protection are among the most important topics for organizations that want and need to professionalize within the framework of digitalization and digital transformation. ISO 27001 is based on a simple philosophy: information security and data protection must not be a coincidence. There must be fixed rules for,

  • who, for example, is allowed to create new users,

  • who manages their role permissions,

  • which specific behavioral guidelines users of IT systems must follow,

  • at what intervals and with which methods IT security is checked, etc.

ISO 27001 follows the logic of the PDCA cycle known from quality management: Plan, Do, Check, Act.

Plan: Define and establish the information security management system

Roles and authorities, processes and procedure descriptions, the basis for internal audits and controls—all of this is determined during the planning of a management system according to ISO 27001. In other words: the theoretical foundation is created. This makes it clear who has to do what, when, and how in relation to information security.

Do: Put the theoretical plan into practice

Every plan is only as good as its execution. Implementation in practice therefore plays an important role in management systems like ISO 27001. What measures ensure that the information security management system does not remain a theoretical concept? In fact, this is one of the major challenges for organizations. An ISO 27001 manual can be quickly downloaded from the Internet, and templates for process descriptions and work instructions are also easy to find. But now it is a matter of reliably putting this into practice.

Check: Is the management system fulfilling its task?

An ISMS (Information Security Management System) is planned and implemented. But that is not enough. Is the organization achieving its goals? Are data and information really effectively protected? Especially in the field of information security, where cybercriminals are constantly finding new ways to attack IT systems, reviewing the management system is one of the most important tasks. Internal audits—checks to see if the system is working reliably—are therefore a vital component, especially with ISO 27001.

Act: Continuous improvement and optimization

ISO 27001 relies on two important principles:

  1. Learning from mistakes. Security flaws that are discovered are fixed immediately.
  2. The system is constantly improved. Suggestions are actively sought to make the information security management system work even better and more effectively. These can be better technical facilities, more efficient processes, or innovative measures to strengthen information security.

The PDCA cycle is also known from other management systems such as quality management. The structure of ISO 27001 is also similar to that of ISO 9001. Therefore, management systems from the areas of quality, environmental protection, or information security can be very well combined in the form of integrated management systems.

DICIS® AG offers a modern solution for ISO 27001 certification that can significantly reduce the effort involved. With the help of an AI assistant, the entire documentation can be created within a few hours—instead of several weeks as was previously the case.

Companies can test the solution for 30 days free of charge and be guided step-by-step through the certification process.

Advantages of a quality management system

Why should companies implement a quality management system? The short answer is: because it makes them more professional. But what does more professional mean?

  • Companies gain reliability: The definition of business processes ensures that companies can continuously deliver their performance. Regardless of whether those responsible are currently ill or busy with other activities.

  • The company has systematically committed itself to customer orientation. The risk of developing products and services that miss customer needs decreases.

  • Continuous improvement keeps workflows and processes lean. A  process management system ensures that internal structures and workflows are repeatedly scrutinized and revised.

Companies that have achieved ISO 9001 certification are reliable and valued business partners. Accordingly, they can expand their market share and scale their services. This means nothing other than: the company is prepared for growth. Companies that have established a quality management system benefit from greater growth potential while simultaneously reducing costs.

How is ISO 27001 structured?

ISO 27001 follows the so-called High Level Structure and is structured similarly to ISO 9001 or ISO 14001. The actual requirements are in chapters 4 to 10. Additionally, there is an Annex with 93 measures that you must implement or justify to fully cover information security.

The standard is structured so that you can simply proceed step by step. You start by understanding your company, establish rules, and ensure that work is carried out securely in everyday life. Then you regularly check whether everything is working and improve your system.

The following overview shows you quite simply what you specifically need to do in each chapter:

Chapter What you specifically need to do in this chapter
Chapter 4 – Context Consider: Which data is important? What can happen? Where do you deploy your security system?
Chapter 5 – Leadership Ensure that the topic is important and everyone knows: data must be protected.
Chapter 6 – Planning Consider: What can go wrong and how do we prevent it?
Chapter 7 – Support Ensure that your employees know what to do and have the right resources.
Chapter 8 – Operation Define how data is handled securely in everyday work.
Chapter 9 – Evaluation Check regularly: Is it all working or are there problems?
Chapter 10 – Improvement If something is not going well, improve it step by step.
Annex A – Measures Implement specific protective measures: rules, training, securing access, and protecting IT.

DICIS® AG has developed an innovative and particularly simple way to achieve ISO 27001 certification—specifically for small companies. Instead of complex projects and weeks of preparation, you use an AI-supported tool that guides you step-by-step through the implementation.

Through targeted questions, the system automatically recognizes the relevant requirements and creates the necessary documentation in a short time. Certification then takes place efficiently via an online audit.

This makes ISO 27001 certification significantly easier and faster. You can start immediately and test the certification tool for 30 days free of charge.

What do I need to implement in ISO 27001 Chapter 4.1 (Context of the Organization)?

In Chapter 4.1, ISO 27001 creates the basis for an information security management system to be implemented at all. Organizations create a list of internal and external issues that are relevant.

  • Internal issues: This is about dealing with all areas in which information security plays a role. For example: securing the WLAN, security of production facilities, data and information security in employees’ home offices, etc.

  • External issues: Here, external factors influencing information security are considered. Create a list of the topics that are relevant to you and your information security management system. For example, new data protection laws, security updates for the software you use, reports on cybercriminal attack strategies, or innovative security technologies.

ISO 27001 does not specify which internal and external issues you must monitor and analyze. Ultimately, it is a question of relevance. But at its core, it is quite simple. You need to clarify what potential threats exist, what requirements you must follow, and which areas of your organization are affected.

Which interest groups (so-called “interested parties”) are relevant for ISO 27001?

When it comes to information security, different groups have different interests.

  • Owners and investors look for the best possible protection of their invested capital, but pay attention to the economic efficiency of a solution.

  • Employees expect that the solutions used

      1. are easy to use and
      2. do not restrict their productivity.

  • The works council wants to ensure that records of employee activities are only processed for the purpose for which they were collected.

  • Customers want clarity on how their data is processed and how their information is protected.

Countless other interest groups could be listed. ISO 27001 requires organizations to actively engage with the different interests and recognize potential areas of tension that exist in the management of information security.

How do I define the scope (Chapter 4.3) of ISO 27001?

Contrary to a widespread assumption, ISO 27001 does not automatically have to be implemented for an entire organization. It is even conceivable that you implement ISO 27001 for only a few processes, for example, for all workflows and activities surrounding the use of a CRM system (Customer Relationship Management system). Therefore, it is necessary to clearly define the scope of ISO 27001.

Practical tip!

If you are dealing with ISO 27001 for the first time: start with a small sub-area. Initially implement the ISMS requirements only for certain processes, one location, one department, or one team. This way, you get to know the logic behind ISO 27001 and learn to master the complexity. Gradually expand ISO 27001 to other areas.

What do I need to do in Chapter 4.4 (The Information Security Management System)?

This chapter is the concretization of 4.3. Which processes and workflows does your ISMS include? Create a list of all relevant processes and workflows that are relevant to your ISMS. There are classic standard workflows that affect practically every organization: for example,

  • the creation and deletion of internal users,

  • the expansion or restriction of access rights,

  • as well as the procedure for security flaws identified by management.

Here, ISO 27001 requires clear processes and workflows. With the digital information security management system from Innolytics AG, you can fulfill these requirements quickly and easily.

What does ISO 27001 require from leadership? (Chapter 5.1)

Managers have a special role within organizations. They are responsible for considering information security in all areas of daily work. They are the ones who define information security goals, develop measures to implement them, and support employees in acquiring the necessary skills. Chapter 5.1 explicitly lists the requirements for managers in organizations.

What roles and responsibilities (Chapter 5.2) are there in ISO 27001?

ISO 27001, like all management systems, requires that there are fixed responsibilities and jurisdictions for certain tasks. What these look like in detail is not explicitly prescribed in the standard. However, it is important that roles and responsibilities are specifically named. It is therefore not enough to merely point out in general terms that, for example, a certain department should think about information security. In an information security management system (ISMS), specific persons or functions are named.

What competencies do employees need with regard to information security? (Chapter 7.3)

Organizations must ensure that the persons responsible have the necessary know-how to fulfill their tasks. At its core, this is a very logical requirement. What is the point of organizations setting goals for information security, developing measures, and naming responsible persons if no one then has the necessary expertise to carry this out?

What does information security assessment mean?
(Chapter 8.2: Risk Analysis and Assessment)

ISO 27001 requires companies to regularly check their own IT infrastructure (this includes not only internal networks and devices connected to the Internet, but also employees’ smartphones and even the home office workstation). Everything can become a gateway for cybercriminals. And thus represents a security risk.

ISO 27001 does not prescribe a specific form of risk analysis. However, there are security criteria listed in the standard. In addition, there are standards such as the BSI standard that are compatible with ISO 27001.

Which information security audits does ISO 27001 require (Chapter 9.2)?

Internal audits are a central requirement of management systems such as a quality management system according to ISO 9001:2015. What is it all about?

  • Audits are internal reviews that must be planned and carried out.

  • Behind this is the philosophy: if you don’t check something regularly and in a planned manner, it eventually falls out of focus and is finally forgotten.

  • But it is precisely this form of negligence that ultimately increases attack risks and can subsequently lead to damage.

ISO 27001 does not prescribe the form in which these audits should be carried out. For this, there is the special standard  ISO 19011 (Guidelines for auditing management systems), which provides for certain criteria. The most important are the technical competence of internal auditors and independence. These are actually self-evident requirements: what good is a glossed-over audit in which security risks—e.g., for corporate political reasons—are not uncovered, if vulnerabilities for possible attacks on information security remain as a result?

How must I improve information security? (ISO 27001 Chapter 10.1)

ISO 27001—like all certifiable standards in the ISO family—is based on the philosophy of “learning from mistakes.” Chapter 10.1 therefore establishes a binding approach to dealing with identified vulnerabilities and security flaws. They should serve to improve the overall system.

This list is not exhaustive. In practice, it is supplemented by security criteria. But it gives a good overview of how the management system is structured and what requirements are placed on companies seeking ISO 27001 certification.