Are you a cloud-based service looking into getting ISO-27001 certification? Are you wondering about the process, the benefits, and whether it’s worth it?

There are a lot of articles about ISO-27001 written by security and compliance consultancy firms, but there’s not much out there about what it’s actually like from the perspective of an organisation going through the process.

This was something we thought was lacking when we were doing our research, so we thought – why don’t we share our first-hand account?

This blog post addresses some of the big questions we had before making a decision.

Why become ISO-27001 certified?

After completing our GDPR compliance requirements prior to its implementation in May 2018 we decided to pursue ISO-27001 certification.

We realised that in an ever-evolving security landscape, our customers were becoming more and more stringent in their procurement process. With major security breaches such as the Dropbox incident in 2016 (which led to the leaking of 68 million user passwords) and the iCloud leak of more than 500 private celebrity photos in 2014, organisations are much more aware of the security risks of using cloud-based services.

Prospective customers were beginning to ask us detailed and specific questions about our security management processes. One question that kept coming up was “Are you ISO 27001-certified?” We knew many of our competitors were attaining SOC 2, but direct customer feedback was telling us that ISO-27001 was more important for our particular service and market niche: we serve many international enterprises, and ISO is more globally applicable than SOC 2. This, of course, is something that your organisation needs to weigh up.

How long does it take to get ISO-27001 certified? 

We found it really difficult to find an answer to this online – and now it’s very clear why. It really does completely depend on your organisation. We had read everything from a couple of months to more than a year. It took us 18 months.

There were a few factors that stretched the process out for us:

• We are a relatively small team, and we did not have a dedicated person working on this full-time, so our IT and Security departments were working on ISO over and above BAU.
• We also decided to address and meet every control as outlined in Annex A of the standard, including things that were not necessarily risks for us. This was a decision to be completely thorough and follow best practice. Some organisations might not choose to do this.

ISO 27001 is very resource hungry on your teams, and when you are trying to focus on growth, ISO can seem like a distraction. But it is not. It is an essential part of our DNA and creates opportunities for growth in your people, your culture, and your customer footprint.

– Darren Whitaker-Barnett, CEO

Is ISO-27001 certification worth the time, energy and cost?

For us, becoming ISO 27001-certified was absolutely worth it. Even despite the fact that we had contracts that were contingent upon our eventual certification, this was a sound business decision for so many reasons.

This process has been great for building customer confidence. And it lowers the barriers to sale when we are interacting with potential customers. For many of them, it’s a must. And for the others, it’s a huge bonus.

– Andrew Thompson, Chief Security Officer

Business benefits for us include…

• Having a solid foundation to pursue other security certifications or attestations, such as SOC 2
• Establishing a strong security culture throughout our organisation
• Living and breathing our vision to become the most trusted people presence management system in the market
• Further establishing our brand as the top choice for enterprise-level organisations
• Potential cost savings in the long run that come from having a sound information security management system

Being ISO 27001-certified allows us to speak confidently about our security practices because we know we’re following international best practice. That’s the best value you can possibly offer from a security perspective.

– Tom Peck, Chief Technology Officer

What is the ISO-27001 certification process like?

We engaged Axenic, a security consultancy agency, to assess our current state of security, conduct internal audits and assist us on the path to certification (getting us ready for external audit and assessment – which was ultimately conducted by a third party auditor from BSI).

It was the right decision to engage a security and compliance consultant. We couldn’t have done this without Lisa [from Axenic].

– Tom Peck, Chief Technology Officer

Firstly, Axenic conducted a gap analysis using the Framework in conjunction with Annex A of ISO/IEC 27001 to create a Current Profile. As we mentioned earlier, we decided to implement everything in Annex A – even things that were not risks to our business/security processes – this was a business decision to follow best practice.

After this, we conducted a risk assessment. This report identified which controls were there and did not need improvement, which controls were already there but did need improvement, and which controls needed to be implemented from scratch. These are “risks” and are categorised as either low, moderate or critical.

Originally, we identified 35 risks. We achieved certification with only 7 areas of concern (though none enough to be a nonconformity).

The process was not complicated, but we certainly had no idea how extensive or time-consuming it would be.

– Andrew Thompson, Chief Security Officer

What kind of ongoing maintenance does it require to keep ISO-27001 certification?

ISO-27001 requires consistent management and maintenance. We’ve seen it said that ISO is a lifestyle, and that’s definitely true!

Retention of ISO 27001 certification includes…

• An annual surveillance audit makes sure you’re on track to managing all outstanding areas of concern
• A 3-yearly major re-audit will determine your eligibility to retain certification
• There will be other reports and documentation that requires even more regular review, bi-monthly etc.

Should you get ISO-27001 certified? 

Consider ISO-27001…

• If you want to serve customers in countries like Japan and India, it’s a legal requirement.
• If your customer base includes international organisations, ISO-27001 is more widely applicable globally than SOC 2.
• If your customers include large enterprises, it is good practice, and it removes a barrier when trying to get new customers over the line.

However…

• If you’re a small company (say, smaller than 20 people), consider that there are many roles that are required of staff over and above BAU, so a small team may not feasibly be able to complete or maintain ISO-27001.
• If you only service small businesses (who generally are less discerning than larger organisations) ISO-27001 certification is possibly not necessary.

ISO certification has created a ‘security first’ mentality in our office culture; this is an absolute must-have when dealing with customer information.

– Darren Whitaker-Barnett, CEO

Our advice to any organisation going through the certification process:

Make sure you’ve got the resources to get through it because it’s not something you can go into half-heartedly. For example, sometimes it will make sense to bring in external experts.

Make sure you’ve brought everyone in the company along on the journey. This requires a big culture shift, so make sure everyone understands why this is important and what the process is like.

Make sure you have enough people to fill the roles required by the standard. We have a relatively small leadership team so with all the roles necessary it might not have been possible to do it if the team were any smaller.

You need someone to really own and drive this process internally. For us, this was our CEO – he was committed to this and really gave it everything. It had his full attention over and above everything else.

Disclaimer:

We are not security or compliance consultancy. Everything outlined in this article is purely our own experience or opinion. Every organisation considering ISO-27001 should undertake their own research and gain professional advice before making a decision.

About MRI OnLocation

MRI OnLocation provides people presence management software that monitors the safe and secure movement of people through buildings and work sites. Our powerful, cloud-based solution unites visitor, contractor, employee, and emergency management, enabling organisations to secure their facilities and ensure the safety of every person on-site. Armed with a rich, unified source of people presence information, our users are empowered to make more strategic, data-driven decisions that mitigate risk, reduce overhead costs, and streamline operations. Compliant with ISO:27001 2013 for Information Security Management. MRI OnLocation serves organisations in 42 countries around the world and manages over 60 million secure movements through thousands of locations each year. For more information, visit MRI OnLocation.

At MRI OnLocation we want everyone to know that there is a safer way to do building evacuation – that is, by using the latest visitor management technology.

No matter where we are in the world, there is always a risk of a natural disaster occurring at any point in time. Natural disasters serve as a reminder that businesses should run their building evacuation processes in the most efficient, yet safest way possible. After all, it’s impossible to know when and where events such as earthquakes will happen. Business directors and floor wardens have a moral and legal responsibility to make sure they have an adequate means of ensuring everyone is safe and accounted for in an emergency.

It seems as though every time we watch the news we hear of another disaster around the world. There has been a tremendous amount of flooding and of course the devastating bushfires in both California and Australia. These disasters remind us of how real our responsibility is to let those responsible know what technology is available to them to help keep their people safe. With MRI OnLocation, you can make sure everyone is accounted for, so that first responders and emergency services to get to anyone needing help in the shortest possible time.

What should you do when you need to evacuate in an emergency?

Fire:

1. Activate the fire alarm.
2. Call 911 immediately and provide information.
3. Assist injured personnel or notify emergency responders of the medical emergency.
4. Exit the building following emergency maps.
5. Assist physically impaired individuals to a secure area and notify emergency responders.
6. Ensure all personnel are out of the building.
7. Do not use the elevators.
8. Use a fire extinguisher only if it is safe to do so and you have been trained.
9. Assemble personnel at a remote location noted on evacuation maps.
10. Report hazardous conditions.
11. Stay low if confronted with smoke. Check closed doors for heat before opening.
12. Stay away from the building until it is safe to return.

Earthquake:

1. Seek cover immediately, in a place close by and out of the way of windows and significant hazards.
2. After the shaking has stopped, run a check for injuries and safety hazards.
3. After it is deemed safe, begin evacuating.
4. Those needing assistance to exit the building should be helped.
5. The evacuation should take place using a stairway, not an elevator.
6. During an evacuation, people should be aware of falling debris and other hazards.
7. The muster point for an earthquake emergency should be in an open area where it is safe to do a roll call.

Flood:

1. Listen to your local radio stations as emergency management officials will be broadcasting the most appropriate advice for your community and situation.
2. If you have a disability or need support, make contact with your support network.
3. Put your emergency plan into action. Be prepared to evacuate quickly if it becomes necessary.
4. Where possible, move stock or other items to higher ground.
5. Consider using sandbags to keep water away.
6. Lift valuable items and chemicals as high above the floor as possible.
7. Fill containers with clean water in case water becomes contaminated.
8. Turn off utilities if told to do so by authorities as it can help prevent damage to your community. Unplug appliances to avoid damage from power surges.
9. Do not attempt to drive or walk through floodwaters unless it is absolutely essential.

For some useful information on how to plan for and what to do should an evacuation event occur, see:

• Ready.gov website
• Emergency and disaster preparedness guide
• All Business – Evacuation Planning Ideas
• Emergency management software

Evacuation technology

Because we work in the visitor management, contractor, employee, and evacuation management business, we know (and see) the many benefits that come from knowing who’s on-site and who isn’t at any time. We also know that one of the most significant advantages of using an electronic visitor management system is having the ability to verify the safety of people during an evacuation event quickly.

Why use a visitor management system?

MRI OnLocation actively encourages businesses to use visitor management software to run evacuations. The technology is inexpensive, easy to implement, and can make all the difference not only around emergency services response time but the general organisation of evacuation events. Our cloud software MRI OnLocation came about after Founder, Darren Whittaker-Barnett, was involved in a somewhat shambolic evacuation event. At the time, he decided there must a better way to account for everyone during an evacuation. This was when the genesis of MRI OnLocation was born.

Using a visitor management system with those on-site: employees, visitors, contractors (or off-site in the case of lone workers and such), logged and ready to do a roll-call (in person at the muster point or online) can mean the difference between life and death. And, being able to pull up a list of those who need assistance during evacuations on your mobile device straight away means you can get to those people fast and not risk leaving them behind. If your evacuation management system is in the cloud, you can also run communications between wardens, emergency services, and first responders. You can also send out a bulk text to make sure everyone is accounted for and clear buildings zone by zone.

There are other forms of technology that can be useful in a natural disaster.

Here’s a list of 7 apps that might be of use in an emergency.

Keep your people safe!

Use this chance to ensure your emergency and evacuation policies are as effective as they can be before the emergency is real. The risk from natural disasters, not to mention building fires and other events, is real, and there is a good chance your office building will have to be evacuated at some stage. Don’t leave the safety of those you are responsible for to chance. Implement visitor/evacuation management technology today and make sure everyone is accounted for in an emergency evacuation.

See how MRI OnLocation can make your building evacuation plan safer and more effective today.