Protecting information is an important part of running a business. That is especially true in uncertain times. For MINRES, that means taking care of all of the knowledge, the development work and all customer information entrusted to us.
We decided to address the topic proactively and work towards ISO/IEC 27001 certification. ISO 27001 is a global standard for information security, and focuses on an organization’s management system, to ensure the confidentiality, integrity, and availability of data is correctly systematized, documented, and protected.
We were confident in our IT systems. What we came to appreciate during the process was how much information security also depends on everyday business decisions: how we plan projects, assign responsibilities and assess risks.
Having completed our combined ISO 9001 and ISO 27001 audit, these are some of the lessons we take away.
Building on our existing management system
On the recommendation of our consultants at Ascendo, we prepared for ISO 27001 alongside our ISO 9001 re-certification and brought quality management and information security together in one integrated management system.
Our existing quality-management system gave us a foundation. We integrated information security into it, so that project planning and other business decisions could address quality and security together.
Making knowledge useful for project planning
Being a small team, we generally know who has experience in which area. Having a documented competency matrix makes that knowledge easier to use systematically.
The competency matrix helps us to match the skills a project requires with the expertise available in the team. It can also identify where we need additional support or training. Its value therefore extends beyond the certification process.
Clear goals make it easier to evaluate security improvements
We also took a closer look at the objectives in our management plan. We realized that we had defined too few concrete goals, and that the existing ones were often too broad to guide decisions or assess progress.
What exactly do we want to achieve, by when, and how will we know whether we have succeeded?
These questions helped us to see where our objectives needed to be more specific.
That insight extends beyond information security. Clear objectives give the company better direction and make any progress easier to assess.
Sharing knowledge through better documentation
Preparing for the audit also showed us the value of more systematic documentation of our workflows and IT infrastructure. Knowing that a system works is different from having enough information for another colleague to maintain it. Making this knowledge accessible reduces dependence on individual team members and it helps colleagues take over responsibilities.
A broader understanding of information security
One of the biggest lessons from the process was that information security reaches far beyond IT systems. It is also shaped by how we plan projects, how we assign responsibilities, how we assess risks, how we share knowledge and how we define and review our business objectives. The process helped us connect these areas more systematically and enabled us to see information security as part of everyday business management rather than as a separate technical topic.
Completing the audit is an important milestone. The lasting value will come from using the integrated management system in our everyday work.
Our ISO 27001 qualification complements our existing ISO 9001 quality certification, giving MINRES a truly Integrated Management System. If you’re just starting out on the ISO process, you might want to read my previous post on the value small businesses can derive from the ISO 9001 process.
