ISO 27001 Archives - Blackmores

At Blackmores, we are ISO consultants for many ISO standards. We work with clients within the UK and internationally. We provide in-person and virtual training for all standards across all industries.

One of the reasons our clients choose to work with us is our unique ISO training material. We believe that education is key to your organisation’s success when it comes to ISO standards. That is why, as part of our ISO consultancy service, we also provide in-depth ISO training material that leaves no stone unturned.

We host all of our ISO training material in our online platform; our isologyhub. Here you will find various materials and mediums for you and your team to study and learn. No matter which ISO certification you are working towards, our isologyhub can provide what you need.

About Our isologyhub

Our isologyhub will revolutionise the way your organisation gathers information to understand ISO certifications.

Through our isologyhub, you can work through our ISO Roadmap, this is our step-by-step guide where you work through our proven path to go from initial concept to launching your ISO management system. We guide you through everything you need to know and implement for success.

Our isologyhub offers different Pathways to take you from Learner, to Practitioner, to Leader. You can enter your training at any of our three stages depending on your previous ISO experience and knowledge progression. Find out about our different Pathways on our isologyhub page.

Throughout each Pathway, there are several quizzes available to test what you have learnt. You also have the opportunity to earn certificates throughout your learning process.

Thanks to our ISO training materials, achieving ISO standards for your organisation has never been easier. Take your business to the next level with our ISO training plan—contact our team of isologists today.

What You Can Expect from Our ISO Training Material

We wanted to create a safe learning space with ISO training material that suits every learning type. Within our platform, we have a selection of:

Tools and templates – You can download our practical templates, which you can then adapt to your needs and your organisation. We also have a range of resources where you can learn about each standard.

Coffee Break Training – Some people work better in short, sharp bursts, which is why we provide 5 to 10 minute informative courses within our ISO training material.

Live Sessions – Sometimes, you need time with an expert to ask any questions that may have arisen during your training. We provide live sessions where you have time to ask questions and seek advice.

Game Plans – our ISO Training Material also includes Game Plans. These are action-focused guides to help you tackle common challenges that arise.

The Importance of Good ISO Training Material

Good ISO training material is so important when you are focusing on achieving your certification for your organisation.

Up-to-Date Information – Investing in good ISO training material is important for ensuring you and your company are working with and learning from up-to-date sources. The elements of the standard change periodically, and we ensure all of our ISO training materials remain as up-to-date as possible.

Increase Your Skill Set – The main goal of any training is to increase your skill set. Investing in good ISO training materials means you will actually learn about what is required for your organisation, not just read a checklist.

Bespoke Solution – With ISO solutions, there is not always a one-size-fits-all. Our ISO online training materials can help you create bespoke solutions to suit your organisation.

Learning Pace – When you embark on a learning journey, it is important to be able to work at your own pace. With our isologyhub, you can access materials as and when you need them in a timeline that suits you.

ISO Training Material from Blackmores

At Blackmores, we have created our isologyhub so that you have a dedicated platform to work through and keep track of your progress. We believe we have provided the most logical and easy to use ISO training platform.

Stitcher | Spotify | YouTube | iTunes | Soundcloud

AI has been integrated into almost every aspect of our lives, from everyday software we use at work, to the algorithms that determine what content is recommended to us at home.

While extraordinary in its capabilities, it isn’t infallible and will open up everyone to new and emerging risks. Legislation and regulations are finally catching up to the rapid adoption of this technology, such as the EU AI Act and new Best Practice Standards such as ISO 42001.

For those looking to integrate AI in a safe and ethical manner, ISO 42001 may be the answer.

Today Rachel Churchman, Technical Director at Blackmores, explains what ISO 42001 is, why you should conduct an ISO 42001 Gap analysis and what’s involved with taking the first step towards ISO 42001 Implementation.

You’ll learn

What is ISO 42001?
What are the key principles of ISO 42001?
Why is ISO 42001 Important for companies either using or developing AI?
Why conduct an ISO 42001 Gap Analysis?
What should you be looking at in an ISO 42001 Gap Analysis?

Resources

In this episode, we talk about:

[00:30] Join the isologyhub – To get access to a suite of ISO related tools, training and templates. Simply head on over to isologyhub.com to either sign-up or book a demo.

[02:05] Episode summary: Rachel Churchman joins Steph to discuss what ISO 42001 is, it’s key principles and the importance of implementing ISO 42001 regardless of if you’re developing AI or simply just utilising it.

Rachel will also explain the first step towards implementation – an ISO 42001 Gap Analysis.

[02:45] Upcoming ISO 42001 Workshop– We have an upcoming ISO 42001 workshop where you can learn how to complete an AI System Impact Assessment, which is a key tool to help you effectively assess the potential risks and benefits of utilising AI.

Rachel Churchman, our Technical Director, will be hosting that workshop on the 5th December at 2pm GMT, but places are limited so make sure you register your place sooner rather than later!

[03:20] The impact of AI – AI is everywhere, and has largely outpaced any sort of regulation or legislation up until very recently. These are both needed as AI is like any other technology, and will bring it’s own risks, which is why a best practice Standard for AI Management has been created.

If you’d like a more in-depth breakdown of ISO 42001, check out our previous episodes: 166 & 173

[04:30] A brief summary of ISO 42001 – ISO 42001 is an Internationally recognised Standard for developing an Artificial Intelligence Management System. It provides a comprehensive framework for organisations to establish, implement, maintain, and continually improve how they implement and develop or consume AI in their business. It aims to ensure that AI risks are understood and mitigated and that AI systems are developed or deployed in an ethical, secure, and transparent manner, taking a fully risk-based approach to responsible use of AI.

Much like other ISO Standards, it follows the High-Level Structure and therefore can be integrated with existing ISO Management systems as many of the core requirements are very similar in nature.

[05:45] Why is ISO 42001 important for companies both developing and using AI? – AI is now becoming commonplace in our world, and has been for some time. A good example is the use or Alexa or Siri – both of these are Large Language AI Models that we all use routinely in our lives. But AI is now being introduced in many technologies that we consume in our working lives – all designed to help make us more efficient and effective. Some examples being:

Microsoft 365 Copilot
GitHub Copilot
Google Workspace
Adobe Photoshop
Search Engines i.e. Google

Organisations need to be aware of where they’re consuming AI in their business as it may have crept in without them being fully aware. Awareness and governance of AI is crucial for several reasons:

For companies using AI they need to ensure they have assessed the potential risks of the AI such as unintended consequences and negative societal impacts, or potential commercial data leakage. They also need to ensure that if they are using AI to support decision making, that they have ensured that decisions made or supported by AI systems are fair and unbiased. It’s not all about risk – organisations can also use AI to streamlining processes helping to become more efficient and effective, or it could support innovation in ways previously not considered.

For companies developing AI, the standard promotes the ethical development and deployment of AI systems, ensuring they are fair, transparent, and accountable. It provides a structured approach to risk assessment and governance associated with AI, such as bias, data privacy breaches, and security vulnerabilities.

And for all, using ISO 42001 as the best practice framework, organisations can ensure that their AI initiatives are aligned with ethical principles, legal requirements, and industry best practices. This will ultimately lead to more trustworthy, reliable, and beneficial AI systems for all.

[10:00] Clause 7.4 Communication – The organisation shall determine the internal and external communications relevant to the system, and that includes what should be communicated when and to who.

[09:00] What are the key principles outlined in ISO 42001? –

Fairness and Non-Discrimination – ensuring AI systems treat all individuals and groups fairly and without bias.
Transparency and Explainability – Making AI systems understandable and accountable by providing clear explanations of their decision-making processes.
Privacy and Security – Protecting personal data and privacy while ensuring the security of AI systems.
Safety and Security – Prioritising the safety and well-being of individuals and the environment by mitigating potential risks associated with AI systems.
Environmental & Social – Considering the impact of AI on the environment and society, promoting sustainable and responsible practices.
Accountability and Human Oversight – Maintaining human control and responsibility for AI systems, ensuring they operate within ethical and legal boundaries. You’ll often hear the term ‘Human in the loop’. This is vital to ensure that AI is sanity checked by a human to ensure it hasn’t hallucinated or result ‘drifted’ in any way.

[11:10] Why conduct an ISO 42001 Gap Analysis? What is the main aim? – Any gap analysis is a strategic planning activity to help you understand where you are, where you want to be and how you’re going to get there. The ISO 42001 gap analysis will identify gaps and pinpoint areas where your AI practices need to meet the ISO 42001 requirements.

It aims to conduct a systematic review of how your organisation uses or develops AI to then assess your current AI management practices against the requirements of the ISO 42001 standard. This analysis will then help you to identify any “gaps” where your current practices do not fully meet the standard’s requirements. It also helps organisations to understand ‘what good looks like’ in terms of responsible use of AI.

It will help you to prioritise improvement areas that may require immediate attention, and those that can be addressed in a phased approach.

It will help you to understand and mitigate the risks associated with AI.

It will also help you to develop a roadmap for compliance to include plans with clear actions identified that can then be project managed through to completion, and as with all ISO standards it will support and enhance AI Governance.

[13:15] Does an ISO 42001 gap analysis differ from gap analysis for other standards? – Ultimately, no. The ISO 42001 gap analysis doesn’t differ massively from other ISO standard gap analysis, so anyone who already has an ISO Standard and has been through the gap analysis process will be familiar with it.

In terms of likeness, ISO 42001 is similar in nature to ISO 27001 in as much as there is a supporting ‘Annex’ of controls and objectives that need to be considered by the organisation. Therefore the questions being asked will extend beyond the standard High Level Structure format.

Now is probably a good time to note that the Standard itself is very informative and includes additional annex guidance information to include

implementation guidance for the specific AI controls,
an Annex for potential AI-related organisational objectives and risk sources,
and an Annex that provides guidance on use of the AI management system across domains and sectors and integration with other management system standards.

[14:55] What should people be looking at in an ISO 42001 gap analysis? – The Gap Analysis will include areas such as looking at the ‘Context’ of your organisation to better understand what it is that you do, or the issues you are facing internally and externally in relation to AI – both now and in the reasonably foreseeable future, and also how you currently engage with AI in your business. This will help to identify your role in terms of AI.

It will also look at all the main areas typically captured within any ISO standard to include leadership and governance, policy, roles and responsibilities, AI Risks and your approach to risk assessment and treatment and AI system impact assessments. It also looks at AI objectives, the support resources you have in place to manage requirements, awareness within your business for AI best practice and use, through to KPI’s, internal audit, management review and how you manage and track issues through to completion in your business.

The AI specific controls look more in-depth at Policies related to AI, your internal organisation in relation to key roles & responsibilities and reporting of concerns, The resources for AI Systems, how you assess the impacts of AI Systems, The AI system lifecycle (AI Development), Data for AI Systems, Information provided to interested parties of AI Systems, and the use of AI Systems and 3rd party and customer relationships.

[18:10] Who should be involved in an ISO 42001 Gap analysis? – An ISO 42001 gap analysis looks at AI from a number of different angles to include organisational governance that includes strategic plans, policies and risk management, through to training and awareness of AI for all staff, through to technical knowledge of how and where AI is either used or potentially developed within the organisation. This means that it is likely that there will need to be multiple roles involved over the duration of a gap Analysis.

At Blackmores we always provide a Gap Analysis ‘Agenda’ that clearly defines what will be covered over the duration of the gap analysis, and who typically could be involved in the different sessions. We find this is the best way to help organisations plan the support needed to answer all the questions required.

It’s also important to treat the gap analysis as a ‘drains up’ review, to help get the most benefit out of the gap analysis. This will ensure that all gaps are identified so that a plan can then be devised to support the organisation to bridge these gaps, putting them on the path to AI best practice for their business.

If you’d find out more about ISO 42001 implementation, register for our upcoming Workshop on the 5^th December 2024.

If you’d like to book a demo for the isologyhub, simply contact us and we’d be happy to give you a tour.

We’d love to hear your views and comments about the ISO Show, here’s how:

Share the ISO Show on Twitter or Linkedin
Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and we read each one.

Subscribe to keep up-to-date with our latest episodes:

If your company currently holds an ISO 27001 certification, you should be aware of the ISO 27001 transition.

ISO 27001 is the international standard for information security. It is suitable for any organisation as it deals with security issues in relation to company sensitive information as well as personal information.

What is an ISO 27001 Transition?

The transition moves ISO 27001 from 2013 version to the 2022 revision. If your organisation currently holds an ISO 27001:2013 certification, you will need to update your certification.

The changes were first introduced in 2022, and the deadline to transition your certification is October 2025.

If you currently hold an ISO 27001:2013 certificate and you are looking for a consultant to help you transition to ISO 27001:2022, contact Blackmores today. Our ISO 27001 consultants can discuss the transition with you and help you to adapt your management systems to achieve the newer revision.

Analysis of an ISO 27001 Transition

Many of our clients are asking about the differences between ISO 27001:2013 and ISO 27001:2022. We have a whole mini-series on our pod casts – The ISO Show all about the ISO 27001 Transition.

There have been several changes which include 56 controls which can been combined into 24 newly titles controls with 11 new controls added. This leaves 58 controls unchanged.

New Controls Added to ISO 27001:2022

To summarise, these are the 11 new controls that have been added to the ISO 27001 transition:

1. Control A.5.7 Threat Intelligence – ‘To provide awareness of the organisation’s threat environment so that the appropriate mitigation actions can be taken.’ – Threat Intelligence can come from many different sources. Some of the best places to look include the NCSC or local police websites, as well as tools that can be used to detect phishing attacks. As well as digital threats, you also need to think about physical security. ISO 27001 is about much more than just protecting data!

2. Control A.5.23 Information security for use of cloud services – “To specify and manage information security for the use of cloud services.” – With the increase in cloud computing between 2013 and 2022, adding a control around this topic was incredibly important. The best place to start is to verify the security of your service provider to ensure it’s adequate by checking their valid Information Security credentials such as CSA Star, Cyber Essentials, and SOC. This also overlaps with principles of ISO 27017 (certification for cloud security), ISO 27018 (Protection of PII in the public cloud) and ISO 27701 (PII Security Standard).

3. Control A.5.30 ICT readiness for business continuity –’ To ensure the availability of the organisation’s information and other associated assets during disruption’ – There are a few other ISO standards that could assist with this, for example, ISO 27031 (ICT

4. Control A.5.30 ICT readiness for business continuity – further considerations: Recovery Time Objectives and Recovery Point Objectives are a big focus of this control of the standard. Business Continuity is one of the most important elements of security as it determines how your business will cope in the event of an attack or a breach. If you’re looking to dig deeper into business recovery time, you may want to check out BS 25777 (ICT continuity), which is an older certification that should be helpful to you and your business.

5. Control A.7.4 Physical security monitoring –’ To detect and deter unauthorised physical access.’ – Physical security monitoring can include elements like CCTV, access control, swipe cards, etc. Within the monitoring elements, you should also have a method for detecting and alerting anomalies.

6. Control A.8.9 Configuration management – ‘To ensure hardware, software, services and networks function correctly with required security settings, and configuration is not altered by unauthorised or incorrect changes’ – This involves configuration for any software or hardware that is required. Things, including firewalls, software, any hardware devices, passwords, etc, should be documented, as well as explained and monitored on a regular basis. This will ensure nothing changes without notifying the relevant people. For further guidance, you could find helpful elements within ISO 20000.

7. Control A.8.10 Information deletion – ‘To prevent unnecessary exposure of sensitive information and to comply with legal, statutory, regulatory and contractual requirements for information deletion.’ – Information deletion is a control that already existed in the ISO 27001:2013 Standard, but it has simply been clarified further. You will now need to prove that data has been deleted as required; you may need to provide relevant certificates if you currently use a 3rd party for this.

8. Control A.8.11 Data Masking – ‘To limit the exposure of sensitive data including PII, and to comply with legal, statutory, regulatory and contractual requirements.’ – There are three options when it comes to data masking. These three options are;Obfuscation, pseudonymisation and anonymisation. The data masking elements can also help your organisation to comply with GDPR requirements.

9. Control A.8.12 Data leakage prevention – ‘To detect and prevent the unauthorised disclosure and extraction of information by individuals or systems.’ – This control has been re-added from the previous 2005 version of ISO 27001. Organisations should have systems in place to monitor any particularly large data downloads – or even possibly large print batches. Secure email systems and regular security training are also a must for any organisation.

10. Control A.8.16 Monitoring Activities – ‘To detect anomalous behaviour and potential information security incidents.’ – within ISO 27001, there is an element where monitoring and detecting unusual activities is required. This can help with secrurity and data breech es or issues.

11. Control A.8.23 Web Filtering – ‘To protect systems from being compromised by malware and to prevent access to unauthorised web resources.’ – Because we use the internty and cloud based systems, there has been a cause for including web filtering into ISO 27001. Your systems should ensure that people are unable to access unsecure sites. Some organisations choose to extend this to social media.

12. Control A.8.28 Secure Coding – ‘To ensure the software is written securely, thereby reducing the number of potential information security vulnerabilities in the software.’ – Software must be written securely. If you use a 3rdparty, this should be seen as standard. If you use a bespoke system, then you must evaluate it against industry professional standards.

Working with Blackmores for your ISO 27001 Transition

At Blackmores, we are ISO consultants. We work with organisations in various industries to help them create and implement management systems that comply with ISO standards so that they can achieve various certifications.

When it comes to completing an ISO 27001 transition, we have worked with many of our clients to help them make the required changes and ensure they are able to achieve certification to the 2022 version.

You only have until October 2025 to transition to the 2022 version of ISO 27001. If you would like expert advice and support, contact our team or isologists today.

Stitcher | Spotify | YouTube | iTunes | Soundcloud

With the world becoming more reliant on digital technology, along with the recent surge in artificial intelligence for just about everything, there is a lot of talk around ISO artificial intelligence standards for businesses.

At Blackmores, we are ISO Consultants. We work with organisations to help them achieve various ISO standards, one of which is the Artificial Intelligence Management Standard.

To kick start your journey, we have put together this guide to give you the basics of ISO 42001 and tell you why the best way forward is to work with an ISO Consultant.

What is the Artificial Intelligence Management Standard?

ISO 42001 is the first Artificial Intelligence Management Standard which has been designed and develop to help businesses implement, maintain and improve AI management practices.

It is a very new standard, having just been published in December 2023 by the International Organisation for Standardisation and the International Electrotechnical Commission.

Why Should My Business Get Certified in Artificial Intelligence Standards?

There are several reasons why your business should invest in ISO Artificial Intelligence standards.

Having this standard demonstrates that your business is using AI in a responsible and ethical way.
It allows you to be transparent and reliable in your use of AI in your development
It supports compliance with legal and regulatory standards within your business
it will help you to implement a framework for managing risks and opportunities as a result of using AI
ISO 42001 will demonstrate that you are using AI as a strategic decision for your business
The use of AI shows that you are encouraging innovation within your business

If you are using AI in any of your daily activities, then you could run into the following risks;

Inaccurate Information – If you are using AI to create any company information or internal and external communications, you need to be aware of the inaccuracies that you could be exposing yourself to. AI generators rarely fact-check; the information simply comes from resources on the web which could be

Inaccurate
Out of date
Bias
Come from a poisoned data source

If you are using information directly from AI in any company texts or literature, it’s extremely important that you fact check and ensure your information is correct, as AI can open you up to:

Plagiarism – Although many AI tools avoid copying directly from the source, there are still risks of plagiarism which could lead to law suits and potentially fines.

Security Risks – as with most external resources, there are security risks associated with the use of AI. This is something to be aware of when you are using AI for any business function.

Because of the above risks, we advise that if you are using AI in your organisation, you should invest in Artificial Intelligence Management Standards. At Blackmores, we can help you implement ISO 42001 into your existing systems to protect you from various risks.

Working With An ISO 42001 Consultant

Although ISO 42001 is a new standard, we have been working as an ISO consultant for over 18 years. We have refined our process to ensure our clients pass their certifications and gain the standards they need to grow their business, satisfy customers, and achieve sleeker working standards.

Our process tends to follow the following steps:

Gap Analysis – All of our ISO Consultancy works begin with a gap analysis. We take a look at your current management systems and determine where the gaps are and how AI standards can be integrated.

Give You Access to Training Materials – our online platform: our isologyhub contains a wide portfolio of training and development materials. When you work with Blackmores we give you access to this platform for you and your employees so you can learn at your own pace. In our isology hub you will find all you need to know about ISO Artificial Intelligence standards and much more.

Appoint your AI Management Consultant – to help you implement you management system, we will appoint you a dedicated AI Management consultant who will work alongside you and your team. Each of our consultants specialises in a different standard so they are up-to-date and well educated in the area you are looking for. We call our consultants our isologists – you can meet them here.

Internal Audits – Part of gaining your certification means conducting internal audits. This can be a daunting process whether you have already gained a certification or if this is your first one. Your ISO consultant can be onsite for these audits to ensure everything runs smoothly for you and your team.

External Audits – we can book your external audits on your behalf and ensure we are available to come and support you during this time.

Who Should Be Investing in Gaining an ISO Artificial Intelligence Standard?

Any business that uses AI for any task should consider investing in the ISO Artificial Intelligence standard. This is a growing area for businesses to consider to getting certified now could save you a lot of time and effort for the future.

If you are looking for an ISO consultant for ISO 42001 or any standard, contact our team today. We are looking forward to partnering with organisations all over the UK to help them achieve their ISO goals.

Stitcher | Spotify | YouTube | iTunes | Soundcloud

There have been a reported 9,478 publicly disclosed data incidents in 2024 alone, with that amounting to over 35 million known records breached.

It has become clear in recent years that information security isn’t just a ‘nice to have’, it’s a necessity to ensure you and your client’s data are protected. Which is especially the case for those processing personal and financial data, such as today’s guest, Mintago.

In this episode, Tom Catnach, Head of Product and Information Security Officer for Mintago, explains their journey towards ISO 27001, the challenges faced and benefits felt from certification to the leading Information Security Standard.

You’ll learn

Who are Mintago?
Who is Tom Catnach?
What was the main driver behind achieving ISO 27001?
What was the biggest ‘gap’ identified in the Gap Analysis?
What have they learned from the experience?
What are the benefits of certification to ISO 27001?
What does the threat horizon for information security look like?

Resources

In this episode, we talk about:

[00:30] Join the isologyhub – To get access to a suite of ISO related tools, training and templates. Simply head on over to isologyhub.com to either sign-up or book a demo.

[02:15] Episode summary: Today we welcome guest Tom Catnach from Mintago to discuss their journey towards ISO 27001 certification.

[02:20] Who are Mintago? – Mintago are an employee benefits company, who work with companies to help their employees be financially better off. They do this in a number of ways, including:

Finding lost pension pots
Help to save money through finding discounts
Retirement planning
Offering various salary sacrifice products
Helping companies to be more financially efficient with pension salary sacrifice or other national insurance savings
Helping people to be more financially literate

[05:10] Who is Tom Catnach?: Tom has a split role at Mintago, his primary role being Head of Product and secondary being Information Security Officer.

Through both roles he looks after all the products and offerings as well as the information security across the business, he was also the driving force behind achieving ISO 27001.

Outside of work, Tom likes to travel via motorbike, preferring to stay away from the screens and enjoying the sights.

[06:30] What was Mintago’s main driver to Implement ISO 27001?: Mintago, and most other businesses by their nature, are required to hold a lot of sensitive data and so have a responsibility to their clients and employees to ensure it’s security.

Mintago were looking for a robust framework to base their Information Security around, and what better option that the leading Information Security Standard, ISO 27001.

ISO 27001 also offers the assessment of general business practice and allows for growth and scaling. As a start-up, they wanted to have a solid base for policies, training ect to roll out to new hires as they expand.

[08:30] Aligning Standards with core values: Trust is one of Mintago’s core values and they want to give their clients the assurance that they can be trusted to protect their data.

ISO 27001 can be compared to the likes of Bcorp as it’s an on-going process. It doesn’t just stop at getting the certificate, you have annual surveillance to ensure you are still compliant year on year.

[10:15] What was the scope of Mintago’s certification?: For the initial implementation, Mintago opted to just scope in Product and Customer Service.

This was because all of the sensitive data is handled in those departments and they don’t allow access to any other teams, so it made sense to start there with a view to expand the scope after certification.

That being said, they still rolled out Information Security training to all staff, and everything has been set-up to allow for an easy business wide roll-out when they’re ready.

[11:50] How long was Mintago’s certification journey?: They started their journey in September 2023, in fact it was Tom’s first project with Mintago!

Mintago enlisted Blackmores help to implement ISO 27001, and after nine months they have been successfully certified.

Tom attributes their ease of implementation to the fact that they are currently a small business, citing that it’s an advantage to implement ISO Standards early while your agile so that your management system grows with you.

[14:25] What was the biggest ‘gap’ identified at the Gap Analysis? Mintago are lucky in the fact that they are a new business so are using modern tech, and don’t have the burden a larger site or other physical elements such as rack mounted servers.

However, policy, procedure and evidence to ensure they were doing the right thing were lacking at the start of their journey. They did have a good 70% in place and that last 30% was mostly down to having the ability to evidence their compliance.

There was also some additional work to do to improve existing policies and procedures. One example of this was having a solid Business Continuity Plan in place.

[16:35] Did Mintago experience any significant barriers in addressing identified gaps? Being a smaller business, they were able to adapt a lot quicker than a larger organisation may have been able to.

One of the biggest struggles for Tom was getting the necessary technology to aid with Information Security. They needed to show that they had a competent Mobile Device Management Solution (MDM), antivirus and anti-phishing in place.

When trying to buy some software solutions, Tom encountered a lot of companies simply not replying to his requests due to Mintago’s size. Many organisations sadly prioritize bigger potential clients, and so it took a while to finally get all the required software.

[18:45] Engagement is key – Getting everyone involved with the management system is critically important. Especially with information security as the people most often targeted are frontline workers, so they need to be actively engaged in security.

Mintago also has the advantage of being a smaller business, so getting communication out isn’t a hardship and resulted in high engagement. This was benefitted from a top-down initiative via their ‘C-Suite’.

Tom also states that you can make any necessary training more lighthearted, team based or interactive, as that’s something that people would want to engage in.

It’s also important to stress that any information security training can be beneficial for personal use too to avoid being a victim of fraud or a scam. It can be something people take away to their family members to ensure they stay safe online.

[23:10] Did the adoption of ISO 27001 highlight any issues not already considered by Mintago? – The biggest thing was how their internal process could be improved. For example, looking at the scenario of ‘what if our back-ups don’t work?’, ISO 27001 drilled down to ask specifics such as:

How do we recover from that scenario?
Are we 100% confident in our back-ups?
Will they work near instantaneously?
What’s Mintago’s availability like in that scenario?
How do we prevent disruption to our clients during that scenario?

So, while they did have back-ups they weren’t necessarily considering the whole scenario, especially if those back-ups were to fail. ISO 27001 ultimately helped to flesh out existing plans to make a much more robust system.

In regards to threat horizons, Mintago do practice OWASP and keep the team informed via e-mail, newsletters and GitHub repositories.

[25:00] Internal Auditing – A beneficial tool – Tom found the internal auditing process to be very beneficial for Mintago, currently they do a few monthly on average.

Blackmores assisted with the audits during implementation to ensure they were in the right place for assessment. Of course, the Certification Body audits were a bit more nerve wracking for Stage 1 and 2 as they would determine if they would be certified.

Mintago passed their Stage 1 (documentary review) with flying colours, their Stage 2 (evidence checking) highlighted a few non-conformities that were quickly addressed. Following the Stage 2, they were recommended for ISO 27001 certification.

[27:20] Minor Non-conformities aren’t the end of the line – There’s a common misconception that getting a certain number of minor non-conformities during a Stage 2 assessment means you can’t be certified, but that’s simply not true!

If an Assessor is comfortable that you are in a good position for certification, they will recommend you.

ISO Standards are all about continual Improvement, which is something Mintago are embracing as they continue to address issues raised at audits.

[29:00] Benefits of ISO 27001 certification – Benefits Mintago are already experiencing include:

Internal Stakeholders – The Team worked hard to achieve the Standard and have embraced it’s core qualities to the benefit of their own Information Security practices.

Positive Market Response – Much larger clients who are also ISO 27001 certified now have a mutual understanding of each other’s commitment to information security.

Gaining certification early – As a start-up, Mintago are agile and will be able to develop and mature their ISMS (Information Security Management System) as they grow.

[31:10] Any concerns on the threat horizon?: As the Information Security Officer, Tom is concerned about new emerging trends in AI led scams. They’re going to be a lot more sophisticated and harder to spot and deal with.

Thankfully, even if they are impacted, it will be rather isolated. Tom raises concerns for vital services such as Air Traffic Control which could have dire consequences if they were to be affected by a data incident.

However, with ISO 27001 Mintago are in a good place to keep on-top of their threat horizon and have the processes in place to mitigate potential incidents and continually improve their own security.

[34:30] In Summary: Mintago are a shining example of gaining certification for the right reasons. It’s not just about getting a badge, they have truly embraced a culture of continual improvement and are utilising ISO 27001 to ensure they have a robust information security management system in place.

If you would like to learn more about Mintago and their financial services, check out their website.

We’d love to hear your views and comments about the ISO Show, here’s how:

Share the ISO Show on Twitter or Linkedin
Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and we read each one.

Subscribe to keep up-to-date with our latest episodes:

At Blackmores, we are ISO consultants. One of the aspects we help our clients with is ISO 27001 implementation.

What is ISO 27001

ISO 27001 is an internationally recognised standard for managing information security. It provides a framework for establishing, implementing, and maintaining an Information Security Management System (ISMS). The goal of ISO 27001 is to help your business protect its information by identifying risks and implementing appropriate controls to mitigate them. At Blackmores, we work with our clients to help them identify these risks and implement an ISMS that meets the ISO 27001 standard.

ISO 27001 covers various aspects of security, including:

Risk assessment
Security policies
Access controls
Incident management
Compliance with legal requirements.

When you achieve your ISO 27001 certification, your company has demonstrated their commitment to safeguarding sensitive data and reducing the risk of security breaches.

ISO 27001 Implementation with Blackmores

At Blackmores, we work with clients from all industries and all over the country. We work closely with each client and create a bespoke package for them to ensure that they get exactly what they need. We can provide online resources so that you or your team can work at your own pace when focusing on your ISO 27001 implementation.

When working with our clients, we can offer the following

Initial Audit – Before we can create an Information Security Management System, we first carry out a thorough audit of your current processes. This enables us to see where the gaps are and identify what we can do to help you with your ISO 27001 Implementation.

Provide Resources, Training, and Consultations – We then begin training you and your team on ISO 27001. We give you insight into what is required to pass the certification and how your business can work towards these processes. Our online training modules, provided through the isologyhub, are perfect for you and your team to work through independently.

Dedicated isologists – We appoint a dedicated ISO consultant from our team of isologists for each of our clients. Each of our isologists specialises in a specific ISO standard. Your isologist will be available for you to reach out to for questions, queries and advice throughout your ISO 27001 implementation process. We make sure we are onsite for your internal and external audits from awarding bodies to provide that extra support where required.

Ongoing Support – Once your ISO 27001 certification has been achieved, we continue to support you. If you have further questions or want to discuss any aspect, you can contact your isologist, and they can help you.

Working with an ISO 27001 Consultant

When you choose to work with an ISO consultant for any standard, you give your business the best chance of successful implementation and long-term success.

At Blackmores, we have decades of experience in ISO implementation for all types of businesses. We know the industry inside out and understand exactly what it takes for successful implementation and achievement.

By achieving the ISO 27001 certification, your clients and customers will know that they are working with an organisation that is compliant in its information security management, highly credible and trustworthy, and committed to the industry to ensure it is doing the right thing.

It’s important not to underestimate the ISO standards. They are hard work to achieve and should be recognised as a true mark of skill and commitment to the company.

Contact Blackmores

For more information on ISO 27001 implementation or to discuss your requirements, make sure you contact our team today.

Stitcher | Spotify | YouTube | iTunes | Soundcloud

In July 2024, A logic error in an update for CrowdStrike’s Falcon software caused 8.5 million windows computers to crash. While a fix was pushed out shortly after, the nature of the error meant that a full recovery of all effected machines took weeks to complete.

Many businesses were caught up in the disruption, regardless of if this affected them directly or by proxy due to affected suppliers. So, what can businesses learn from this?

Today, Ian Battersby and Steve Mason discuss the aftermath of the CrowdStrike crash, the importance of good business continuity and what actions all businesses should take to ensure they are prepared in the event of an IT incident.