ISO 27001: Insights and practical tips

The updated ISO 27001 standard

ISO 27001 is a globally recognized standard in the field of information security(TÜV NORD). This standard describes how to handle information security in a process-oriented way. The ISO 27001 certificate helps you reduce information security risks and prevent incidents.

The ISO 27001 standard has been given quite a shake-up. For example, Management of Change has been given a more prominent role. Therefore, despite the fact that the quality management system is effectively embedded in the day-to-day operations at LeanForms, this year’s recertification of the ISO27001 standard took some extra effort. This has led to insights that we are happy to share.

Need for information management: more than just security

It is often thought that ISO 27001 focuses only on protecting information from unauthorized use, but this is a misconception. Properly managing information encompasses several important aspects, including its availability. What impact does it have on your business operations if information is not available on time or is no longer available at all? By thinking about this thoroughly, preventive measures can be taken.

In addition to availability, data integrity is crucial. This means that the data must always be accurate and reliable. This may seem obvious, but an error in an Excel sheet is easily made! Performing an analysis in these three dimensions provides insight into critical workflows and enables effective measures to reduce risk.

Change Management: essential for progress

In the new ISO27001:2022, change management has been given a much more prominent role. And rightly so, because making uncontrolled changes in an organization often leads to undesirable situations. By the way, this does not only relate to information management but also to installations or working methods, for example. The trick is to make the Management of Change procedure as suitable as possible for the organization. No unnecessary time should be wasted with small changes, but it is preferable to implement them according to the MOC process. Indeed, with this process, employees are naturally forced to think about relevant risks. Change is improvement and remains people work.

Process management as a common thread

Information management is also about transportation of information. Result-oriented organizing with a good process management tool can help tremendously here for the right insight. Precisely at the transfer moments it is critical to assess whether the delivered result (read: the information) is properly controlled. Especially if the information is spread over several processes or departments, it is important to apply good control measures to the information. You can also apply the 5S workplace organization to information within your organization. Because if an IT system has no practical possibilities to properly control additional information, a lot of employees flee in ‘illegal’ Excel sheets. With all possible risks involved.