27001:2013 INFORMATION SECURITY MANAGEMENT SYSTEM CERTIFICATION
ISO 27001:2013 is a standard responsible for Information Security management System published by International Organization of Standardization and the International Electrotechnical Commission. It legally defines a management system that is meant for information security under comprehensive management control.Organizations that claim to have adopted ISO/IEC 27001 can therefore be formally audited and certified compliant with the standard.
ISO 27001:2013 Specifications:
- Management system of an organization should systematically analyze the risk involved in an organization’s information security considering the threats, vulnerabilities and its effects.
- Management System of an organization should plan and implement a reasonable and a complete risk management system as well as suite of information security controls to tackle the unacceptable risks that may occur, and
- A organization should acquire an overall management process to make sure that the information security controls continue to meet the organization’s information security needs continuously.
Technical security controls such as antivirus and firewalls are not normally audited in ISO/IEC 27001 certification auditsand its is is essentially presumed that the organization have acquired all mandatory information security controls since the overall ISMS is in place and is deemed adequate by satisfying the requirements of ISO/IEC 27001.