ISO/IEC 27001 – Information Security Management Systems
ISO/IEC 27001 is the international standard for Information Security Management Systems (ISMS). It is based largely upon the previously adopted BS 7799, used commonly since 1995 for managing information security.
ISO/IEC 27001 provides the framework for a technology-neutral, vendor-neutral management system that enables an organisation to assure itself that its information security measures are effective. This includes the continued accessibility, confidentiality and integrity of its own information and that of its stakeholders, as well as legal compliance.
Threats ISO 27001 helps you respond to
Implementation of ISO 27001 is an ideal response to legal requirements and potential security threats such as:
Compatible with other management systems
ISO/IEC 27001 is structured to be easily compatible with other management system standards such as ISO 9001 and ISO 14001. Whilst there are some clause numbering differences, common elements include documentation, review and audit requirements, enabling an organisation to develop a largely integrated management system.
Whilst modern communication mediums mean that most ISMS are focused on ICT, ISO 27001 is equally applicable to other forms of information, such as paper records, images, and even conversations.
Who is ISO/IEC 27001 applicable to?
ISO/IEC 27001 is applicable to any organisation where the misuse, corruption or loss of its business or customer information could result in major commercial prejudice.
TOV has registered organisations to ISO/IEC 27001 in sectors as diverse as storage and warehousing, secure destruction, telecommunications, advertising, financial outsourcing and software development.
What are the benefits of certification?
Customer satisfaction
By giving confidence that their personal information is protected and confidentiality upheld.
Business continuity
Through management of risk, legal compliance and vigilance of future security issues and concerns.
Legal compliance
By understanding how statutory and regulatory requirements impact the organization and its customers.
Improved risk management
Through a systematic framework for ensuring customer records, financial information and intellectual property are protected from loss, theft and damage.
Proven business credentials
Through independent verification against recognized standards.
Ability to win more business
Particularly where procurement specifications require certification as a condition to supply.
How it works
TOV Certification Process
TOV has a unique approach to certification which complies with the requirements for bodies providing audit and certification of management systems.
Enquiry & quote
Tell us about your organisation, scope and sites. We send a clear, fixed quotation.
Application review
We confirm scope, competence and audit time, then agree the audit programme with you.
Stage 1 audit
Documentation review and readiness check of your management system.
Stage 2 audit
On-site audit of how the system is implemented and how effective it is.
Certification decision
An independent reviewer decides on certification and your certificate is issued.
Surveillance audits
Annual audits confirm the system is maintained and keeps improving.
Recertification
A full re-audit in year three renews the certificate for another cycle.
FAQ
Frequently asked questions
Is ISO 27001 only about IT?+
No. Although most ISMS focus on ICT, it equally covers paper records, images and even conversations.
How long is the certificate valid?+
A management-system certificate is valid for three years, with annual surveillance audits to keep it active and a recertification audit before it expires.
How long does certification take?+
It depends on size and readiness. Once your system is implemented, the Stage 1 and Stage 2 audits and the certification decision typically take a few weeks.
Can several standards be audited together?+
Yes. Standards built on the common Annex SL structure, such as ISO 9001, ISO 14001 and ISO 45001, can be audited together in an integrated audit.
How can my customers verify my certificate?+
Anyone can confirm a certificate with our online certificate search using the company name or certificate number.