ISO 27001 Certification: What it is and why we have it

ISO 27001 Certification, there’s actually a downside to not having it. Scammers, hackers and dark web types love it when you work with suppliers who don’t have ISO 27001 Certification. It means that you’ve got a vulnerability that they can exploit. So, today we’ll explain why that is, why you want a gamification platform that’s ISO 27001 certified like ours and how these extra steps protect you. As always, data security is our top priority at Mambo, and we’re happy to officially share the news:

Mambo is now ISO 27001 certified!

In this post, we’ll explain what it means to be certified, the benefits and the process we went through to shed light on this qualification. Lastly, we’ll share why you should care and how you can check that an ISO 27001 Certification is legitimate.

What is ISO 27001 Certification?

ISO 27001 Certification is a framework from the International Organization for Standardization that looks at our ability to keep your data safe.

To get this certification, there is an audit that ensures we meet their tough standards. For ISO 27001 Certification; which in long form is “ISO/IEC 27001 – Information technology — Security techniques — Information security management systems — Requirements,” we had to reach the highest levels of information security as mandated by the ISO and the International Electrotechnical Commission (IEC).

These are international standards that form part of global information security protocols; the ISO/IEC 27000 series. The core of these policies and procedures is the adoption of an Information Security Management System (ISMS) to support these enhanced security measures.

It’s an internationally-accepted standard for information security that’s supported by nearly 170 different national standards organisations across the globe.

What is an ISMS ISO 27001?

To get ISO 27001 Certification, you need to have an ISMS. These are policies and processes that help you manage sensitive data. It reduces risk and minimises breaches for better business continuity.

There are a few levels to this. The first is employee behaviour. This is what your team does with information in their control and the standards they’re trained to. Then you have the data and technology associated with it. Think IT policies, servers, computers, backups, access restrictions and the like. An ISMS needs to become part of the company culture to be truly effective. And here at Mambo, we’re educated and compliant in line with ISO 27001 standards through and through.

The rules around data management we follow according to ISO 27001 standards are:

Identifying stakeholders and data security expectations
Creating safeguards and mitigation methods to manage notated risks
Setting and meeting objectives for information security
Implementing, measuring and optimising risk treatment approaches
Operating under continuous improvement methodologies RE: ISMS

We have robust documented policies, processes and practices which allowed us to be ISO 27001 Certified.

The 14 ISO 27001 Certification domains we completed

From section A.5 to A.18, there are 14 domains of ISO 27001 Certification in Annex A. In brief, these cover how to:

A.5 – handle your information security policies
A.6 – define the internal structure of your team and the application of information security topics like remote working, mobile phones etc
A.7- hire, onboard, train and manage with information security in mind including termination and disciplinaries
A.8 – provision your information security assets (data, computers, storage etc) and designate the training/handling practices associated with each type of classification
A.9 – restrict access to information and assets via physical and logical restrictions
A.10 – use encryption to protect your data
A.11 – prevent unauthorised access and protect the physical environment where your data is stored
A.12 – ensure data is protected and secured against loss including logs and creating evidence, vulnerability testing and business continuity during audits
A.13 – affirm your network is protected including data in transit
A.14 – take information security into account when buying new or upgrading systems
A.15 – vet and monitor 3rd parties to ensure their security performance meets standards
A.16 – communicate and deal with security incidents to resolve them quickly including how to document and learn from events
A.17 – keep continuity of security management during incidents and how the systems will remain available
A.18 – prevent breaches and audit your information security effectiveness under ISO 27001 Certification standards

You can see how ISO 27001 isn’t just about the IT practices and hardware, but it’s about the human processes and physical elements as well.

Why is it important to get ISO 27001 Certification?

ISO 27001 protects data in three ways based on the ISMS security objectives. These are:

Availability – ensuring data is accessible to the right people at the right time
Integrity – ensuring only authorised people can edit the data
Confidentiality – ensuring only authorised people can access the data

ISO 27001 is good for business because it keeps your data safe from a breach, builds trust with customers, gives your shareholders confidence, protects your reputation and can function as a competitive advantage.

Key benefits of ISO 27001 compliance for data processing

Anytime you need to work with personal data; like with your gamification projects, there are a lot of advantages to working with an ISO 27001 Certification-approved business.

High quality – ISO 27001 is a complex standard to meet and requires regular audits which ensure you’re working with a high-quality organisation.
Risk reduction – ISO 27001 ensures there are fewer security breaches and; should one occur, provides a framework to reduce damage caused.
Enhanced trust – With ISO 27001, you’re getting a sign you can trust that your data is handled with the highest standards and integrity in mind with policies that are always tested to ensure robustness.
Sign of security – An ISO 27001 Certification means you know what standards have been met when it comes to data and you can remove all proposals from companies without this level of data handling acumen.
Boosts awareness – Beyond a handshake, ISO 27001 illustrates that data protection is a core part of a supplier’s business operations. It permeates every aspect of the business from training to procurement including the suppliers that they use.
Reduced downtime – ISO 27001 includes policies to reduce downtime in crisis situations including BC and DR plans that are tested and updated regularly.
Eliminates loopholes – ISO 27001 helps you manage internal and 3rd party practices to prevent workarounds and outsourcing from compromising your data. When your supplier is ISO compliant, remember that their suppliers must be too.
Drives acquisition – When you work with only suppliers who hold an ISO 27001 Certification, your own customers and prospective employees know how much data security matters to you. This can increase sales and attract the right candidates to your organisation.
Reduces attacks – While 100% prevention is unlikely, ISO 27001 helps reduce the frequency and severity of cyberattacks through regular monitoring and continuous improvement.
Fewer errors – Breaches due to human error (common) are reduced with an ISO 27001 due to the training required to maintain compliance. This is also tracked and logged as well.

FAQ – ISO 27001 Certification

What did we need for ISO 27001 Certification?

To reach the high standards for ISO 27001, you need to make intentional steps to document and enhance your policies and processes. Many companies fail because the criteria are quite stringent.

Across your whole organisation, you must have:

An information security policy with objectives
Risk assessment and treatment methodology
Information security management system scope
Statement of applicability
A risk treatment plan
Definition of security roles
Use policy and inventory of assets
Logs of all exceptions, user activities and security events
Access control policy
IT management operating procedures
Supplier security policy
Security system engineering principles
Documented incident management procedure
BC procedures
Legal, regulator & contractual requirements
Training, skills experience and cert records
Measuring and monitoring results
Auditing results
Management review results
Nonconformities and the results of corrective actions

ISO 27001 standards are broad to make sure the qualification isn’t a box-ticking exercise. ISO wants companies to undergo a company-wide culture and process change to meet these standards. Just thinking you have the right policies in place is not enough. You need to meet and document every single one of these very wide-reaching areas and then pass audits to earn an ISO 27001 Certification. And to keep it, you have to maintain the same standards which earned you the qualification in the first place.

How was the ISO 27001 process of certification?

An ISO auditor will walk you through the ISO 27001 Certification process. They help you understand how ISO works and what you need to do to become compliant. They will also test your systems, provide staff certification and manage the ongoing upkeep of the ISO 27001 Certification once earned. They are only there to support you, however. It’s your team that must demonstrate robust knowledge of what ISO 27001 Certification standards really mean.

Once you earn the ISO 27001 Certification, you can automate some of the process with support from services like Drata, as we do. This is a security and compliance platform that monitors your system and collects evidence of your security controls while helping you when audits happen. This helps you maintain constant ISO 27001 Certification audit readiness.

Can you trust ISO 27001 Certification standards themselves?

ISO designed this global framework with help from independent auditors from around the world. This tests their guidance, system and operating methods to ensure everything is as robust as possible. Their own QA testers are even tested. Taking the tester out of the data across several steps ensures that there’s no bias during the ISO 27001 Certification process. This keeps their internal ISO 27001 Certification processes honest and ensures the quality of these standards.

How can you check if a certification is legitimate?

First, when checking for an ISO 27001 Certification, ask to see the actual certificate or a copy of it. Then, you should contact the awarding body to make sure that the ISO 27001 Certification they presented you with is both valid and within date. Since companies need to maintain their ISO 27001 Certification, you won’t want to work with an organisation that had the certification at one time and then lost it. This means their standards have slipped and they no longer meet the high expectations of the ISO 27001 Certification testers. Remember that conformity assessments are challenging but only one part of what it takes to earn an ISO 27001 Certification.

How can you ensure the certification body is accredited too?

Just like any certification body, the ISO members must maintain their own accreditation as well. This involves audits in line with their established standards. There are a number of bodies which maintain these standards. You could check with the national standards body in the USA ANAB (ANSI-ASQ National Accreditation Board) or the national-appointed IAF (International Accreditation Forum) to see who maintains the standards in your country. For the UK, it’s the United Kingdom Accreditation Service (UKAS).

Don’t accept any certification body that does not maintain an accreditation. This is because they have no oversight of their measures. You can suspect this if the certificate is valid for more than 3 years or issued for more than one premises. ISO standards are represented by 167 members in countries all over the world and you can learn more about them here.

Conclusion

In summary, you’ve just learned about the ISO 27001 Certification process, what it covers and how it’s awarded. We’ve shown you the true range of the qualification and how it’s much more than a box-ticking exercise. Plus, we’ve explained how to look out for dodgy ISO 27001 claims and check if the certification you’re seeing is real. Lastly, we’ve shown how working with a gamification company boasting an ISO 27001 Certification can increase trust, reduce outages, minimise risk, increase sales and ensure your customers and employees feel safe with you sharing data with us. Want to learn more about our robust policies and processes that led to ISO 27001?