We're beginning our ISO27001 journey!

In the ever-increasing world of cyber risk, here is a brief article describing the steps that we are taking in order to assure ourselves and you as our customers, that we are working relentlessly to ensure the highest levels of data security.

Data security has always been a top priority for ICT Revolutions, and we are always looking for ways to improve the procedures we use for physically managing sensitive data; as well as the “whole company” approaches to enforce best practices. We have been Cyber Essentials certified for a number of years but in light of the daily increases in volume, complexity, and scale of cyber-attacks, we began to look for a recognised and standardised methodical and sustainable way of managing personal and sensitive data, one that all the people we work with could practically engage with. The obvious answer was ISO27001. 

ISO27001 is published by the International Organisation for Standardisation (ISO) and is the only auditable international standard that defines the requirements of an Information Security Management System (ISMS).  An ISMS is a set of policies and procedures, processes and systems that manage information security risks and cover three basic objectives: Confidentiality, Integrity, and Transparency. Aligning these policies and documents to the ISO27001 requirements allows us to protect, monitor, and mitigate current and future risks in a defined and structured way.  

So why have we decided that certification is the best route when we could simply follow the standards without independent assessment? Certification means we can demonstrate that we have defined, put in place, and regularly monitor best-practice information security processes. Confidential and sensitive information is secured, information can be exchanged safely, risk exposure is minimised and finally, it builds a culture of information security within the organisation which we can share with customers. External auditors will review the ISMS at specific intervals (at least annually) and provide an expert opinion on whether it is functioning correctly and provides the level of security we are striving for, giving piece of mind all round.  

The continued escalating risk to: Identity theft and online scams affecting UK citizens, IP theft, espionage and extortion targeted at UK businesses and fiscal fraud committed against the Government including ransomware indiscriminately targeting local government social care databases means that we are constantly upgrading our physical security and cyber standards to guard and protect data.  We must be able to demonstrate at least as, or more secure than the customers we serve. Our dedicated security managers remain vigilant. Implementing, amongst other structures, ISO27001 is an important plank in our armour

Jon Goldie - Director