Blackmores ISO Consultancy Service: The creators of isology®

In our first episode in the ISO 27001 Steps to Success podcast series, we take you through how to implement ISO 27001 with Steve Mason, Senior Information Security Consultant with Blackmores.  Steve shares his experience and provides tips on how to implement ISO 27001 within your organisation covering the key aspects – IT, employees and physical security.  Steve provides an overview of the structure of the standard which sections of the standard you need to implement and why.

The Gap Analysis is the beginning of your Information Security journey.  This helps you to understand which controls you’ve got in place (both documented and non-documented).  Steve typically finds that companies tend to have an asset register and anti-virus, fire-walls and back-ups, however what is usually missing are documented controls to support them.

So for example you may back-up data, but you may not necessarily have any controls that clearly state:-

• What data are you backing-up?
• When is the data backed-up?
• How is the data backed-up?
• Who is responsible for making sure that the back-ups happen and can retrieve data?

Who should be involved with the Gap Analysis?  Ideally, a cross-representation of functions to understand what type of data assets are received, processed, protected and communicated within your organisation.  This can include a representative from operations, HR, Office Management, IT, procurement and supplier/contractor management.

What is the scope of your Information Security Management System?  Is it the entire business, or only certain locations or services?

Once the scope is understood, the next stage is the Information Security Risk Assessment to understand the type of information assets your business has, owners of the assets and the risks associated.  At Blackmores, we have a simplistic but very effective approach to Risk Assessment which Steve explains the methodology behind it and how it rates the risks in your business.

To hear about the Risk Assessment methodology and other interesting information such as Why can CCTV footage let you down in an assessment? Download our ISO Show Podcast and join Steve and I on our ISO 27001 Steps to Success Journey.

Listen to our previous 12 episodes by subscribing to us on iTunes or Soundcloud

And click HERE for further information on how we can help you with ISO 27001.

To help out the ISO Show:

• Share the ISO Show on twitter or Linkedin
• Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and I read each one.

BS 10012 is a British standard that outlines the specifications for a Personal Information Management System (PIMS). This was introduced in 2009 to help organisations manage personal information and comply with data protection laws. 

The standard was updated in 2017 to reflect the GDPR’s requirements, making it an ideal framework for regulatory compliance. For example, it includes specific guidance on each principal, helping organisations meet the requirements of BS10012 and GDPR. 

After implementing BS 10012 for a number of organisations, here are our Top tips on implementing BS 10012.

• Establish a PIMS team – this is not a one-person job.  You will need to have input from all areas that are involved with personal data.
• Carry out a Privacy Impact Assessment – It is important to understand where all the personal identifiable data is within the organisation, how it is collected and how it is disposed.  (remember this is all Data – soft and hard copies – get in to all the drawers and cupboards)
• Data mapping – collate the information on a data matrix, this would show all the information in one place.
• Carry out a risk assessment – the data matrix will flag up any risks that need addressing
• Update documentation – Ensure all documents are updated i.e data protection policies, cookie policy and privacy policy.
• Training, training and more training – people are the weakest link, ensure ALL staff have had BS 100012 training
• Conduct Internal Audits – to verify compliance and check your systems are effective. 

Implementing a PIMS can be challenging so if you would like assistance please contact us for further information on: enquiries@blackmoresuk.com

What is data subject consent?

This is clearly defined by GDPR, what the data subjects wishes are in processing their data.

What is a freedom of information request?

Under the GDPR, individuals will have the right to obtain:

• confirmation that their data is being processed;
• access to their personal data; and
• other supplementary information – this largely corresponds to the information that should be provided in a privacy notice

You must provide a copy of the information free of charge.  However, you can charge a ‘reasonable fee’ when a request is manifestly unfounded or excessive, particularly if it is repetitive.

You may also charge a reasonable fee to comply with requests for further copies of the same information. This does not mean that you can charge for all subsequent access requests.

In order to provide the information you must verify the identity of the person making the request, using “reasonable means”. If the request is made electronically, you should provide the information in a commonly used electronic format.

If you would like to learn more about GDPR – contact us today!

Premier Physical Healthcare is a subsidiary of Totally PLC and a leading provider of a wide range of healthcare services which include physiotherapy, podiatry and mobility assessments

Blackmores congratulate Premier Physical Healthcare’s retained certification at their first Continuing Assessment visit to ISO27001:2013 Information Security with no non-conformities.

Internationally recognized ISO/IEC 27001 is an excellent framework which helps organizations manage and protect their information assets so that they remain secure in confidentiality, integrity and availability. It helps you to continually review and refine the way you do this, not only for today, but also for the future. That’s how ISO/IEC 27001 protects your business, your reputation and adds value.

Certification body: BSI

The 2016 BCI Horizon Scan, written in collaboration between the Business Continuity Institute and BSI, has revealed some interesting results for perceived risks and threats to business.

Once again, perception of risks to business continuity for 2016 remain focused on information security and the performance and reliance on suppliers.

Top 10 Threats Identified:

1. Cyber Attack
2. Data Breach
3. Unplanned IT & Telecom Outages
4. Act of Terrorism
5. Security Incident
6. Interruption to utility supply chain
7. Supply chain disruption
8. Adverse Weather
9. Availability of talents/key skills
10. Health and Safety Incident

568 responding companies from 74 countries

This shows that cyber-attacks continue to dominate the threat landscape and organisations are getting increasingly concerned about its potential for damage given the increased sophistication of hostile elements.

The results also showed a third of the organisations do not use trend analysis results at all with access being a key barrier. This is a key weakness which impacts on building resilience across the whole organisation.

*Figures and content taken from http://www.thebci.org/index.php/download-the-bci-horizon-scan-report-2016

By implementing recognised and effective management system standards such as ISO22301 (Business Continuity) and ISO27001 (Information Security), organisations can mitigate and look at reducing the impact of the majority (if not all) of the top 10 defined risks and threats, and implement response plans to control disruption should a risk be realised.