The most important thing is to make the decision makers (i.e. the top management) interested in this project, because they are the ones who will approve the project or reject it. And to do this you have to find which business benefits could be achieved by implementing information security in your company.
I usually like to present the following benefits: (1) compliance – by implementing ISO 27001, a company will comply with all the information security legislation, but also with contractual requirements that clients are enforcing more and more; (2) marketing advantage – companies with this certificate might get some new clients who are looking for this kind of guarantee for the security of their information; (3) decreasing the costs – by implementing ISO 27001, many security incidents will be prevented, and the investment in implementing this standard is usually far less than the cost of remediation of the incidents; and (4) optimizing the business processes – since the standard requires defining exactly who needs to do what, when and how, this means that employees will be spending less time searching for ways to perform their tasks.
Unfortunately, too many IT and security professionals focus on IT benefits instead of focusing on business benefits – but by presenting the benefits like “We will be more secure,” or even worse, “We will have a nice secondary location,” this doesn’t really say anything to the top management on how it will increase their profits, decrease costs, achieve their strategic goals, or limit their business risks.
It sounds like once the initial work is complete, the rules and procedures ISO 27001 puts in place can reduce mistakes and make the IT department’s job easier?
Exactly! The problem is that very often IT professionals see this standard as unnecessary bureaucracy; but in reality, if the rules for using the information technology are clear for everyone in the company, the number of problems related to IT will decrease. This means IT departments will be dealing less with resolving the problems like “Why don’t I see this icon anymore,” and can focus on more strategic things.
What are the benefits of implementing ISO 27001 with other management standards?
If a company has already implemented, e.g., ISO 9001, it will decrease the time required for ISO 27001 implementation by 30% – this is because these two standards have a lot in common and, for instance, some of the documentation written for ISO 9001 can be used for ISO 27001 as well.
But there is one standard that is even more compatible with ISO 27001: the business continuity standard ISO 22301. When implementing ISO 27001, with 10% additional effort a company can implement ISO 22301 too, because these two standards are highly compatible and about 60% of their requirements are the same.
By subscribing to our early morning news update, you will receive a daily digest of the latest security news published on Help Net Security.
With over 500 issues so far, reading our newsletter every Monday morning will keep you up-to-date with security risks out there.