admin, Author at Audit and Risk

Understanding ISO 27001’s 93 Security Controls: Your Essential Guide

By admin|2025-08-30T13:39:31+01:00September 1st, 2025|ISO 27001 Controls|

Understanding ISO 27001's 93 Security Controls: Your Essential Guide If you've ever wondered what lies behind ISO 27001's reputation as the gold standard for information security management, the answer is largely found in Annex A. This technical appendix contains 93 specific security controls that form the backbone of any robust information security framework. Think of these controls as your organisation's security toolkit. They're organised into four main themes that cover every aspect of information security: organisational security policies, people security, physical and environmental security, and technology [...]

0

ISO 27001 Risk Assessment: How to Map Business Risks to Annex A Controls

By admin|2025-06-29T16:53:26+01:00June 30th, 2025|ISO27001 Certification, ISO27001 Implementation, Risk Assessment|

ISO 27001 Risk Assessment: How to Map Business Risks to Annex A Controls In a previous blog post, I explored whether organisations should choose scenario-based or asset-based risk management techniques when implementing ISO 27001. Today, I want to build on that discussion by examining a critical aspect that many organisations overlook: ensuring your risk register properly addresses the broader organisational risks that underpin the controls in Annex A. This isn't just about compliance box-ticking. When done correctly, your risk mapping demonstrates that you've genuinely considered the [...]

0

ISO27001 – Control 5.17 – Authentication Information

By admin|2025-06-16T17:44:25+01:00June 16th, 2025|Information Security, ISO 27001 Controls|

ISO 27001 - Control 5.17 - Authentication Information Control 5.17 Wording Control 5.17 - Authentication Information states "Allocation and management of authentication information should be controlled by a management process, including advising personnel on the appropriate handling of authentication information." What this means Control 5.17 aims to ensure that your organisation has in place proper rules for creating, giving out, and looking after login details like passwords, PINs, and access codes. This matters because the organisation needs to make sure that only the right people [...]

0

How to choose the right ISO 27001 Implementation Partner

By admin|2025-06-23T12:12:40+01:00June 3rd, 2025|ISO27001 Certification|

ISO 27001 Implementation Services: What to Look for How to choose the right ISO 27001 implementation partner and avoid costly mistakes that delay certification The Reality: It's More Complex Than It First Appears When we're working with businesses considering ISO 27001 certification, one conversation particularly stands out. A company director told us: "When we first started looking at ISO 27001, we genuinely had no idea what we were signing up for. Six months seemed like plenty of time, the process looked straightforward on paper, and we [...]

0

What happens at an ISO 27001 Certification Audit?

By admin|2025-05-26T14:31:21+01:00May 26th, 2025|ISO27001 Certification|

Understanding the ISO 27001 Certification Audit Process It's one of the most common questions we get asked as organisations pursue ISO 27001. What happens at the certification audit? Firstly, the certification audit is undertaken in two parts a Stage 1 audit and a Stage 2 audit, both undertaken by a certification body. The audits have two distinct roles. Stage 1: Documentation Review The first stage is primarily a desk-based assessment where auditors examine your Information Security Management System (ISMS) documentation to see if you are ready [...]

0

ISO27001 – Control 5.16 – Identity Management

By admin|2025-06-16T17:47:26+01:00May 5th, 2025|Information Security, ISO 27001 Controls|

ISO 27001 - Control 5.16 - Identity Management Control 5.16 Wording Control 5.16 - Identity Management states "The full life cycle of identities should be managed." What this means Control 5.16 focuses on managing digital identities throughout their complete lifecycle - from creation to deletion. Think of it as a comprehensive system for tracking and controlling every digital identity in your organisation, ensuring that the right people and systems have the right identities and access. It's not just about creating usernames; it's about maintaining a [...]

0

ISO27001 – Control 5.15 – Access Control

By admin|2024-11-24T16:48:08+00:00November 25th, 2024|Information Security, ISO 27001 Controls|

ISO 27001 - Control 5.15 - Access Control Control 5.15 Wording Control 5.15 - Access Control states "Rules to control physical and logical access to information and other associated assets should be established and implemented based on business and information security requirements." What this means Control 5.15 - At its core, access control is about ensuring the right people have access to the right resources at the right time. Think of it as a sophisticated bouncer for your business assets, both digital and physical. It's not [...]

0

We’ve got ISO27001 Certification, Now what?

By admin|2024-11-17T18:07:25+00:00November 18th, 2024|BUSINESS, ISO27001 Certification|

We've Got ISO 27001 - Now What? You've done it. The audits are complete, the certificate is on the wall and the website, and everyone's breathing a collective sigh of relief that all the work has finally paid off. But if you think getting ISO 27001 certified was the hard part and it's all downhill from here, think again. ISO 27001 maintenance isn't just about keeping your certificate on the wall. It's about turning those hard-won security practices into business value. While getting certified is a [...]

0

ISO27001 – Control 5.14 – Information Transfer

By admin|2024-11-09T16:25:08+00:00November 11th, 2024|Information Security, ISO 27001 Controls|

ISO 27001 - Control 5.14 - Information Transfer Control 5.14 Wording Control 5.14 - information transfer states "Information transfer rules, procedures, or agreements should be in place for all types of transfer facilities within the organization and between the organization and other parties". What this means Control 5.15 - information transfer is aiming to ensure that any information transfer processes are robust and secure and available to all within the organisation. The most obvious means of data transfer is email but there is also the consideration [...]

0

5 Information Security Mistakes That Could Cost You Your Business

By admin|2024-11-02T11:51:16+00:00November 4th, 2024|Cyber Security, Information Security|

5 Information Security Mistakes That Could Cost You Your Business Information security mistakes can devastate UK businesses of any size. In today's digital landscape, these information security mistakes aren't just IT concerns - they're fundamental business risks that UK organisations cannot afford to ignore. With data breaches costing companies an average of £3.7 million according to IBM's 2024 Cost of a Data Breach Report, even seemingly minor security oversights can have devastating consequences. 1. Assuming Compliance Equals Security Many UK businesses make the critical error of [...]

0

About admin