You may have heard the term ISO certification, especially if you are in IT. This guide covers what ISO is, why standards matter, the three main ISO standards for technology, benefits of ISO 27001, and what certification can cost.
What is ISO?
The International Organization for Standardization (ISO) is an independent, non-governmental organization of national standards bodies. It brings experts together to form voluntary, consensus-based international standards that support innovation and address common challenges.
Why have standards?
Many buyers look at ISO certifications when choosing vendors. The same measures also reassure management that internal data and processes are worth the investment. ISO 20000, ISO 27001, and ISO 22301 relate to IT service management, information security, and business continuity.
Three main ISO standards for technology
- ISO 20000 — how to manage IT services the rest of the organization uses.
- ISO 27001 — information security management for assets such as financial information, employee details, intellectual property, and information entrusted by third parties.
- ISO 22301 — business continuity when operations take a left turn, including the IT assets that have to be preserved.
Benefits of ISO 27001
- Increase information security awareness
- Identify and minimize risks to corporate information
- Raise stakeholder confidence and company reputation
- Lower staff-related information security breaches
- Stay current with relevant legislation
What certification can cost
Cost varies with ISMS maturity, company size, in-house capability, the gap to the desired control environment, and how soon the certificate is required. An illustrative average from the original article was about $48,000 through first certification, plus annual internal and surveillance audits in years two and three. Actual costs can range widely.
Cyber Security Resource offers cybersecurity assessments, consultations, and risk management. Contact us or start with program development.