ISO 27001 A Quick Guide

ISO 27001 Quick Guide for SaaS companies

ISO 27001 is the internationally recognised “best practice” standard for Information Security (Infosec) which is published by the International Organization for Standardization (ISO).

The standard provides the framework for an effective Information Security Management System (ISMS). It sets out the policies and procedures needed to protect organisations and includes the risk controls necessary for robust IT security management. The standard does not only cover technology, it applies to all types of data, across all areas of a business whether it is in hard or soft copy.

Several of the ISO 27001 requirements also fulfill those of the UK GDPR and Data Protection Act.

Any organisation, whatever its size, sector or shareholder structure, can implement ISO 27001. SME SaaS companies often consider it too costly, it doesn’t have to be.

Why do organisations get certified?

Win more deals. Certification improves reputation and prospective clients will gain confidence that your business will protect their data.
Retain more customers. Your customers will be more confident sharing data and doing business with you.
Speed up the procurement process. On-boarding with customers is typically much faster for ISO certified SaaS providers since they are better prepared to answer the RFIs/RFPs and lengthy information security questionnaires and less likely to trigger enhanced risk assessments. The reduced cost and time of sale is often critical to the success of SME SaaS providers.
Revenue protection. Implementing the certification reduces the risk of an information security incident such as a data breach. These incidents can be catastrophic to your business and SMEs often fail to recover. With an ISO 27001 information security management system you will be in a better position to identify breach risks and prevent them before they happen. Even the most secure companies benefit from having an independently audited process in place, and that independent review will solidify trust with your customers.
Reinforce a culture of security. Implementing ISO 27001 helps to reinforce a company culture that considers information security in every aspect of the business.

How can you achieve ISO 27001 certification?

1 – Design, build and implement an Information Security Management System (ISMS)

There are many ways of creating an ISMS, if you have a Chief Information Security Officer (CISO) they are likely to have experience building the framework, if you do not have the internal capacity, then you can engage with a consultancy to implement the ISMS which can come at a high cost.

At Adoptech we give you the tools, documents and expert support you need, balancing the use of our platform to streamline the process with having our experienced ISO practitioners on hand every step of the way.

For CISOs Adoptech provides the tools to simplify ISMS development and ongoing management.

For Sales Teams, the platform provides an easy way to evidence good governance and win more deals.

How long will ISO 27001 Certification take?

That depends on the size of your organisation, the kind of Infosec challenges you face, as well as any time or resource pressures and many other factors. With our help, it typically takes between six weeks and six months, we support you for as long as it takes to achieve certification.

2 – Engage with an independent, accredited certification body

Your auditors will assess your ISMS documentation, sometimes on-site and sometimes remotely. Then they’ll test your ISMS, usually through on-site interviews and sampling. If you get through those and achieve certification, you’ll have at least two annual surveillance audits followed by recertification after three years.

We make this easy for you. Our ISO practitioners will engage with various certification bodies on your behalf and will be on hand to support you throughout the process and will continue to be available to provide you with support before your annual audits.

How much will ISO 27001 certification cost?

The cost of implementing the ISMS system and certification depends on several factors including:

Your company’s sector
Annual turnover
The number of employees
Whether you require industry-specific accreditation (such as ASCB or UKAS).

Using Adoptech’s platform to streamline elements of the process means that the time required and costs associated with achieving certification are much lower than when dealing with traditional consultancies.

ISO 27001 certification is a realistic goal for SaaS companies even at a relatively early stage of growth, contact us directly to see how we can make this process more efficient or visit our frameworks page to understand which certification suits your company.