ISO 27001 – Information Security is not all Information Technology. So what else is it?

Busy office environment with lots of people and papers on desks

There is increasing focus and interest in information security. Just think of recent events here in Australia… the census crashing because of overseas hackers; the almost continual reporting of people’s private information being compromised; phone hacking by unscrupulous news reporters desperate for the latest big story; and of course, people posting information they shouldn’t on social media.

Whilst all these major stories are centred around the failure of some aspect of information technology, ISO 27001 (the International Standard for information security management systems) does include many requirements for non-IT security of information… and that is what we are going to talk about here.

What can you do to keep your information secure that does not involve the IT department? We’ve picked nine specific ISO 27001- Information Security controls which are listed specifically in Annex A and have been directly derived from, and align with, ISO 27002. We also briefly explain what each means.

9 Information Security Controls

1. You have to do background checks on all candidates for employment, and you have to include information security requirements in their terms and conditions of employment (A.7.1.1).

Your HR department or recruitment organisation will need to ensure that when they do background checks on new recruits they ask questions about information security.

2. You have to educate and train your staff and contractors in information security as relevant to their positions, and you have to discipline those who breach your information security policy and procedures (A.7.2.2. & A.7.2.3).

Information security will need to be included in induction training, ongoing training and information sessions. It should be included as part of any daily pre start and toolbox talks as required. This will need to include staff, contractors and visitors.

3. Any information security assets have to be included on an inventory and the assets have to be owned. Upon termination of employment, people have to return any assets in their possession (A.8.1.1, A.8.1.2 & A.8.1.4).

You need a register of all of your information security assets, which will be more than just a list of your computers; it will also include smart phones, any locks and passcodes, storage boxes, transport vehicles, specifications and plans etc. You need to know who has what because you will need to get it back from them when they leave.

4. Information has to classified, and then protected according to its importance. Information has to be labelled according to it classification (A.8.2.1 & A.8.2.2).

Some information is more critical than other information; therefore it needs to be better protected than information that is not so critical. Whatever the classification, the information needs a label on it to show its classification level.  

5. When transporting physical media containing information it needs to be protected (A.8.3.3).

Any vehicles you or your contractors use need to be secure and in such a condition that information will not be damaged when it’s being moved around. This may include cars, motorbikes, couriers, trains, trucks and planes.

6. Physical entry controls need to be in place where information is stored and processed, and these areas also need to be protected against natural disasters, malicious attack or accidents (A.11.1.2 & A.11.1.4).

Two issues here… Firstly you need to keep unauthorised people out, which essentially means locks on doors – and doors need to be locked not propped open. Secondly, don’t store precious information in the basement if it’s likely to flood.

7. Unauthorised entry from delivery, loading and other such areas need to be prevented (A.11.1.6).

You don’t just need security on the front door. Make sure that other entrances are secure too. This can be awkward if entrances need to be left open to move things in and out, so ensure that sensitive information is not available –  and make sure the people in the loading dock understand this.

8. Desks need to be cleared of papers and removable storage devices (e.g. data sticks) when not in use (A.11.2.9).

People cannot leave things on their desk, or anywhere else come to that. Whenever people are away from their desk, information items should be cleared away, either in a locked drawer or a locker. The key word here is ‘locked’.

9. Any cables that carry data or supporting information services need to be protected from damage (A.11.2.3).

Data cabling – it’s normally blue or yellow – needs to be correctly routed so that it cannot be damaged. Cables should not be just trailed across the floor, left hanging from the ceiling, or exposed to be chewed by rodents. Some older cables may also have interference from other cables (power in particular). Different types of cables should be separated from one another.

Information security is no longer just a problem for IT – it affects all people, at all levels, in all businesses.

The information security controls listed above have been taken specifically from Annex A and have been directly derived from, and align with, ISO 27002. It challenges the idea that security is solely the responsibility of the IT department, when in fact many information security controls are implemented across the whole organisation.

Are you across all of its different aspects?


Interested in Information Security Management Systems or ISO 27001? Why not attend a training course?

Information Security Management Systems Lead Auditor


Related Articles

Leave a Reply

Your email address will not be published.

“I found the PWC IMS Lead Auditor training course very valuable. The content covered all areas in good detail. Claire presented all topics with clarity and made the whole course fun (who thought auditing could be fun!) and easy to understand. The course materials supplied both at the course and afterwards are valuable tools that can be utilised in any industry. I would happily recommend PWC training.”

“Overall very valuable course. Balance of theory with practical workshops was excellent. Trainers stuck to timetable very well.”

“The course was thorough and many relevant examples provided by both Tom and Jackie to help me apply it to the workplace.”

“Great presentation of the course, engaging facilitators and good use of group work. I found the course to be a great refresher for an audit course I did 10 years ago and now feel more motivated to go audits in a non-bow tie way!”

“Trainers’ knowledge was excellent, their knowledge made the training and learning easy.”

×
Menu