ISO 27001 Consultants in Ireland

Understand and Manage Information Security Risks

ISO 27001 requires organisations to establish a systematic approach to identifying, assessing and treating information security risks.

This means considering what could happen to information and information-processing activities, the likelihood and potential consequences, and what controls or other treatments are appropriate.

The objective is not to eliminate every conceivable risk. It is to understand the risks that matter to the organisation and manage them appropriately.

Protect Confidentiality, Integrity and Availability

Information security is commonly understood in terms of three fundamental objectives:

• Confidentiality – ensuring that information is accessible only to those authorised to access it.
• Integrity – protecting information from unauthorised or inappropriate alteration.
• Availability – ensuring that information and information-processing facilities are available when required.

An effective ISMS brings these objectives into the organisation’s wider management processes rather than treating information security as a collection of isolated technical controls.

Provide Confidence to Customers and Interested Parties

Customers increasingly want assurance that organisations can protect the information entrusted to them.

ISO 27001 certification provides independent evidence that an organisation’s ISMS has been assessed against the requirements of the standard.

Certification may also be required by particular customers, contracts, tenders or supply-chain arrangements.

Improve Information Security Governance

ISO 27001 establishes responsibilities for information security and requires management involvement in the ISMS.

This can help organisations move from an informal or largely IT-led approach to information security towards a structured management system with defined responsibilities, objectives, risk management and continual improvement.

Improve Incident Management and Response

An ISMS provides a framework for preparing for information security incidents, responding to them and learning from what happens.

The objective is not simply to deal with an incident when it occurs, but to use incidents and other information-security events as opportunities to improve the organisation’s controls and processes.

Support Continual Improvement

ISO 27001 requires the organisation to monitor and evaluate the performance of its ISMS, conduct internal audits, undertake management reviews and address nonconformities.

This creates a structured cycle for improving information security rather than treating certification as a one-off project.

Experienced ISO Consultants

Our consultants have more than 20 years’ experience in the development, implementation and maintenance of management systems, including Information Security Management Systems.

We have worked with organisations across a range of sectors, including IT and software, data analytics, smart energy, construction, manufacturing and other information-intensive businesses.

We also have experience developing integrated management systems incorporating ISO 9001, ISO 14001, ISO 45001, ISO 27001 and related standards.

This experience means that we understand that information security cannot always be separated from the way the organisation actually operates.

An ISMS Built Around Your Organisation

We do not use generic systems.

We take the time to understand your organisation, its information, processes, assets, technology, people, suppliers and other relevant factors before determining what the ISMS needs to contain.

Where effective information security arrangements already exist, the objective is to build on them rather than replace them unnecessarily.

Where improvements are needed, we work with your team to identify what needs to change and why.

Practical and Proportionate

ISO 27001 does not require every organisation to implement every possible security measure.

The organisation needs to determine its information security risks and establish appropriate treatment. Annex A provides a set of reference controls, but the controls selected for the organisation need to be considered in the context of its risks and other requirements.

Our approach is therefore to develop an ISMS that is proportionate to the organisation’s size, complexity, activities and information security risks.

A System You Can Maintain Yourself

Our objective is not to make your organisation dependent on an external consultant.

We help your team understand the ISMS, its processes, responsibilities and controls so that the system can be maintained and improved by the organisation.

Many clients continue to work with ISO Excellence after certification for ongoing support, internal audits or management-system improvement, but the ISMS is developed so that your organisation can manage it itself if it chooses to do so.

Clause 4 – Context of the Organisation

The organisation needs to understand the internal and external issues that can affect its ability to achieve the intended results of the ISMS.

It must determine relevant interested parties and their requirements, define the scope of the ISMS and establish the processes needed for information security management.

Clause 5 – Leadership

Top management must demonstrate leadership and commitment to the ISMS.

This includes establishing an information security policy, ensuring that responsibilities and authorities are assigned, supporting the ISMS and ensuring that information security objectives are aligned with the organisation’s direction.

Clause 6 – Planning

The organisation must establish a systematic approach to information security risk assessment and risk treatment.

This includes determining information security risks, establishing appropriate treatment, setting information security objectives and planning changes to the ISMS.

Clause 7 – Support

The organisation must determine and provide the resources required for the ISMS.

This includes competence, awareness, communication and documented information.

Clause 8 – Operation

The organisation must plan, implement and control the processes required to meet its information security requirements.

This includes carrying out information security risk assessments and implementing information security risk treatment plans.

Clause 9 – Performance Evaluation

The organisation must monitor, measure, analyse and evaluate the performance and effectiveness of the ISMS.

This includes internal audits and management review.

Clause 10 – Improvement

The organisation must respond to nonconformities, take corrective action where necessary and continually improve the suitability, adequacy and effectiveness of the ISMS.

1

Is ISO 27001 mandatory in Ireland?

No. ISO 27001 certification is not generally mandatory in Ireland.

However, particular customers, contracts, tenders or supply-chain arrangements may require an organisation to hold ISO 27001 certification.

Organisations may also choose to implement an ISMS without certification where they want a structured approach to information security risk management.

2

Who needs ISO 27001?

ISO 27001 can be used by organisations of any size and in any sector.

It can be particularly relevant to organisations that handle sensitive or commercially important information, provide technology or information-based services, manage significant volumes of personal or customer information, or need to provide customers with assurance about their information security arrangements.

3

Is ISO 27001 only for IT companies?

No.

Although technology and cybersecurity are important parts of many ISMSs, ISO 27001 is an information security management standard rather than an IT standard.

Information security risks can relate to people, physical locations, paper records, suppliers, processes, technology and many other aspects of an organisation.

4

What is an ISMS?

An Information Security Management System is the framework an organisation uses to manage information security.

It brings together the organisation’s information security policies, processes, responsibilities, risk management arrangements, controls, monitoring and improvement activities.

The ISMS provides a systematic approach to managing information security rather than relying solely on individual technical controls.

5

What is Annex A in ISO 27001?

Annex A contains a reference set of information security controls that organisations can consider when determining how to treat their information security risks.

ISO 27001:2022 contains 93 Annex A controls organised into four themes: organisational, people, physical and technological controls.

The organisation does not simply have to implement all 93 controls. The selection of controls needs to be considered in the context of the organisation’s risks and other requirements and documented through the Statement of Applicability.

6

What is the Statement of Applicability?

The Statement of Applicability, or SoA, is a key part of an ISO 27001 ISMS.

It records the controls that have been determined to be necessary, whether they are implemented, and the justification for including or excluding the Annex A controls.

The SoA therefore provides an important link between the organisation’s information security risk assessment and the controls it has selected.

7

What is the difference between ISO 27001 and ISO 27002?

ISO 27001 specifies the requirements for an Information Security Management System and is the standard against which certification is carried out.

ISO 27002 provides guidance on information security controls and their implementation.

ISO 27002 can therefore support an organisation when implementing its ISMS, but certification is to ISO 27001.

8

How long does ISO 27001 certification take?

There is no fixed implementation period for ISO 27001.

The time required depends on factors including the size and complexity of the organisation, the scope of the ISMS, the maturity of existing information security arrangements, the number and nature of information-processing activities and the extent of work required to implement the ISMS.

Some organisations can complete implementation within a few months, while larger or more complex organisations may require considerably longer.

The objective should not simply be to achieve certification as quickly as possible, but to establish an ISMS that is properly implemented and capable of being maintained

9

How much does ISO 27001 certification cost?

There is no standard cost for ISO 27001 certification.

The overall cost can include consultancy and implementation support, certification-body fees, training, technical or security improvements and the time required from your own personnel.

The cost will depend on factors including the organisation’s size and complexity, the scope of certification, the maturity of its existing information security arrangements and the controls required to address its risks.

At ISO Excellence, we provide proposals based on the organisation’s actual requirements rather than applying a one-size-fits-all approach.

10

Do I need an ISO 27001 consultant?

No.

An organisation can develop and implement its own ISMS.

An experienced consultant can, however, help reduce the time involved in interpreting the requirements, establishing an appropriate risk methodology, developing the ISMS and preparing for certification.

A good consultant should also help ensure that the ISMS reflects the organisation’s actual information security risks rather than simply creating a large collection of policies and templates.

11

Who provides ISO 27001 certification in Ireland?

ISO consultants help organisations implement their ISMS, but they do not issue ISO 27001 certificates.

Certification is carried out by independent certification bodies. Where accredited certification is required, organisations should ensure that the certification body has appropriate accreditation and scope.