by Abdul Halim | Apr 27, 2019 | iso 27001
ISO 27001:2013 is the latest version yet for ISMS Certification. Like other management system standards such as ISO 9001, 14001, 20,000, 45001 it has 10 clauses:
- Scope
- Normative References
- Terms and Definitions
- Context Of the Organization
- Leadership
- Planning
- Support
- Operation
- Performance Evaluation
- Improvement
The most important requirement for this standard is security threat. Online security threats are including Online hacking, data breaching, data theft, online robbery, money stealing from bank account etc are very common and great concern for IT and data management firm.
Clause 6 and clause 8 are the main clauses where an IT firm can work with more concentration. In the clause 6 it is told about planning. This planning should be done very carefully before starting implementation of ISO 27001 Standard throughout the processes of an organization.
Information security risk assessment and Risk Treatment both the two things are very important for a company who are going to implement this ISMS standard in his organization. Establishment of processes for risk assessment and treatment should be focus point of this clause. To do this two jobs carefully helps can be taken from ISO 31000 Standard.
Specially for financial organizations including bank, insurance, leasing company etc who are thinking to adopt this 27001 standard they should do this two things very carefully. If data or client information is disclosed by online hacker then there is a great loss for that organization. So, unauthorized network or server access is a very very risky incident for an financial institute. Risk assessment time this kind of risk should be taken very seriously.
After identifying risk what will be the possible treatment procedures to measure the risk and what will be be mitigation plan to minimize the losses against those risks. All this things should be clarified very carefully during the working time on the clause no 6.
Another important clause is Operation related and it is 8. It is the main process of a company. Most of the incidents happen in this stage. Due to lack of security knowledge of IT Staffs many risks are happened in this operation section. So, 8.2 and 8.3 Sub clauses can be implemented very carefully to minimize any loss in this section. But nothing is written with elaboration in this two sub clauses. That’s why an 27001 Consultant can guide you how to assess the risk and how to minimize the risk in operation.
Software attacks, theft of intellectual property or sabotage are just some of the many information security risks that organizations face in this operation section. And the consequences can be huge. Most organizations have controls in place to protect them, but how can we ensure those controls are enough? The international reference guidelines for assessing information security controls have just been updated to help. ISO 2700, 27002 and 27008 can be good references to work more closely on those risks.
Prof. Edward Humphreys, said,“In a world where cyber-attacks are not only more frequent but increasingly harder to detect and prevent, assessing and reviewing the security controls in place needs to be undertaken on a regular basis and be an essential aspect of the organization’s business processes,”
ISO 27001 is based on PDCA Plan. So before implementation of this ISMS standard you should consider the meaning of P. P means Planning. It should be done carefully. If your planning is not proper and related with your activities then implementation cannot be effective and successful.
So, an expert consultant on 27001 Standard can help you to do the plan properly by focusing on clauses 6 and 8 before real implementation of ISO 27001. Not only for that two clauses rather he will guide you how to apply other clauses like 6,7,9,10 etc in your processes to get real test of ISO 27001:2013 Certification in your organization.
But the problem is lack of 27001 consultant in Bangladesh. Hiring a foreign consultant is a matter of high cost. It is not hard for small and medium size financial organization and IT firm to hire an 27K foreign expert. On the other-hand it is also tough for many organizations to implement 27K requirements just buying some documents from online. There are two causes of it first of all the staffs have no enough time and they are not certified auditor on 27 standard.
So, to implement ISO 27001 requirements properly in your organization there is no alternative to hire a local consultant. Before implementing 27k requirements an ISMS consultant should study your processes and operation by regular visit plans. After introducing with your processes he will help to asses your risks and establishing your risk treatment plan to mitigation the risk.
AAS-BD has some local 27k Consultants who have working experience with foreign 27k expert in Bangladesh for the last 10 years. So, find your 27 implementer in Bangladesh contact now with AAS-BD.
by Abdul Halim | Feb 17, 2018 | iso 27001
ISO 27001 Audit Checklist is an important document for performing internal audit for ISO 27001 Certification. Not only for 27001 but for all standards, Internal audit is mandatory. Organization should do real practice for performing Internal audit before and after iso certification.
ISO 27001 is very sensitive standard. It is very important standard for IT firms. Nowadays IT firms, ICT Firms, Data management firms and financial institutes are in great risk. Because hackers around the world are always trying to steal important data from your computer and server.
If you just take 27001 certificate for meeting buyers requirements than it is not enough. You will have to know actually what guidelines are in the ISO 27001:2013 Standard. How can you implement those guidelines in your system effectively and protect your information from stealing. If you can implement those guidelines properly then the risk and vulnerability will be definitely minimized.
If you are dealing with your client’s confidential information then it is your responsibility to defend hackers from access to those data. If hackers or spammers access to your system and steal your data then it is harmful both of you and your clients. So, regularly you should check your system. In this regards 27001 Internal audit is the effective tool to do that. And ISO 27001 audit checklist the is the right documents to do that ISMS audit.
So, there is no scope to stay far from doing internal audit on 27001 certification and after certification. From ISMS internal audit you will check your system by yourself or by a hired ISO 27001 Consultant. 27001 Internal audit report will say how you are securing your parties data.
Without data security you will know many other guidelines from 27001 certification? How have you implemented the ISM standard in your system? After establishing the documentation and implementation it is your responsibility to check how it is working. In this regard 27001 Internal audit checklist is the important tool to do that.
To do internal audit it is your responsibility to train your staffs to do ism internal audit. Minimum twice in a year you can do isms internal audit. However, it can be done more frequently. So, during the certification time you can talk to your CB about 27001 internal auditor training. Your CB can provide this training. You can hire an ISO 27001 consultant too to do that.
If you are very small company and thinking to achieve certificate on 27001 standard then you can also do internal audit from a third party consulting firm or by a free lancer ISO 27001 consultant.
There may be many iso 27001 auditors or consultants but you will have to select one who has previous auditing or working experience in other it or ICT firms or data firms. Just you should not think the price only. Auditor’s experience is the most important thing for you.
Still now many ICT companies are hiring foreign ISO 27001 Consultants in Bangladesh. It costs them a big amount of money. But now it is not necessary to hire an ISO 27001 Consultant from abroad. In Bangladesh there are many 27001 auditors.
Advanced Assessment Services(AAS) has the most experienced 27001 auditors who have auditing experiences in different IT, ICT and multinational Companies. Their consultancy or auditing works may add extra value in your system. It will bring extra security in your system.
AAS has already provided ISO 27001 Certificates to the few ICT firms in Dhaka. If you are looking for ISO 27001 Certification or 27001 consultancy then AAS may be your right place. Contact now at 01742125232 for details.
by Abdul Halim | Feb 15, 2018 | iso 27001
iso 27001 compliance
ISO 27001 Compliance post will help you to understand the compliance process of ISO 27001 Standard. Before going to know about compliance let’s know what about the standard 27001 is?
27001 standard is about information security management system. That’s mean how can you keep your information secure and secret that is the main focus point of this standard.
You are keeping your information in your own secure way. But if you compliance 27001 standard in your system then you will know how the information can be saved according to the international standard.
If you want to iso 27001 compliance properly then you need to do the following things:
- Determine the scope of Information Management System
- ISMS Policy Set up
- ISMS Objectives set up
- Addressing the risk
- Training and awareness
- Operational Procedure set up
- Internal Audit
- Management Review Meeting
- CA Plan
To do all the above things you need the Training and awareness on ISO 27001. So, we can say the root of compliance of ISMS is training. Without training you cannot expect real compliance of ISO 27001.
You may see advertisement about ISO 27001 from online like 27001 certikit, 27001 audit checklist etc. Those are like notebook in the market. You can get partial idea from those documents. You may be certified on 27001 but for real compliance you need to study the whole standard.
There are several hundred clauses and sub clauses in the 27001 standard. You do not know which one is most important and which one is less important. In this regard an ISO 27001 Consultant can help you to understand the more and less important requirements for 27001 compliance.
So, if you really want to compliance 27001 standard then there is no alternative of training on 27001.
From whom you should take ISMS training. Definitely an expert 27001 auditor or 27001 consultant who has been working on this standard for long time.
Cost, it is the another issue for ISO 27001 Compliance. Most of the companies do not like to spend money. Because training is costly. But it is not true. Actually first of all you will have to assess what type of training is required?
There are two types of training on ISO 27001 Standard. One is LA training and another one is overview & Internal auditor training on ism.
Actually if you are company owner then LA training is not required for compliance of 27001 for your staffs. Overview and Internal audit training is enough. It is for two days training. 5-6 members can be included in this group training. It will cost you only 45-50 thousand taka.
If you want to do work as an 27001 part time auditor then LA training is required. It will cost you around 50,000 taka. it is 5 day long course.
If you hire an ISO 27001 Consultant he will train your staffs and will help you to prepare all the documents, audit checklist and show you how to implement isms requirement in the organization.
So keep away to buy any simple ready made 27001 documents it will not help you to compliance of ISO 27001 standard.
It is not necessary to hire an foreign 27001 consultant or Indian consultant for 27001 Compliance. Bangladesh has many IRCA Certified 27001 consultant. Just by spending taka one lac to 1.5 lac you may get one local 27001 consultant for complete iso 27001 compliance. Simply visit this page to get one from AAS.
by Abdul Halim | Nov 20, 2017 | iso 27001
27001 Consultancy is required for ISMS Certification. AAS has some freelancer 27001 consultants who can provide you consultancy services on 27001:2013. To get your 27001 consultant please call now at 01742125232.
ISO 27001 Standard is not like other standards. It is a great light particle in the dark world. I mean now IT firm is in great risk. They are not known when they will be attacked by hackers or online robbers. So, thanks ISO for publishing a standard 27001.
You cannot simply neglect about necessity of implementation of 27001 guidelines. Without proper implementation you will get nothing from this standard. An 27001 consultant can help you to do that. Specially who are working in on this standard for long.
How an ISO 27001 Consultant can help you? An 27001 consultant will help you practically how to establish working procedure, how to work according to that procedure in your security management system in your organization. This is very much required for your organization.
How can a 27k expert help you for documentation? An 27001 expert can help you to do the following things:
- Determine the scope of Information Management System
- ISMS Policy Set up
- ISMS Objectives set up
- Addressing the risk
- Training and awareness
- Operational Procedure set up
- Internal Audit
- Management Review Meeting
- CA Plan
Simply buying 27001 documentation from online is not the right decision to implement ISO 27001 guideline. Because all it firms are not same. Based on the activities of ICT farm documents should be prepared. Only an ISO 27001 auditor can help you to do that.
An 27001 service provider can help you to hire the skilled 27001 consultant. So, to hire an 27001 auditor you can contact any 27001 service provider.
Advanced Assessment Services has been providing 27001 services in Bangladesh by providing real 27001 auditor in Bangladesh to do your ISO 27K Implementation process properly. To get 27001 consultancy services please contact at 01742125232 now.
by Abdul Halim | Oct 4, 2016 | iso 27001
CALL NOW 017 42 12 52 32 FOR QUOTATION
ISO 27001 Certification is the growing trend for it, data, financial organization and bank. Security is the major concern in IT and data management firms. To protect from this threat there is no alternative of adopting ISO 27001 Standard certification. This standard can help you to protect your data from hackers. This standard is also very beneficial for financial institute like bank, insurance, leasing company, call center, software development firm etc.
Why Needs ISO 27001 Standard?
To secure company information it shows guidelines for all types of information, including digital, paper-based documents, intellectual property, company secrets, data on devices, servers, hard copies and personal information. ISMS certification also resist from possible cyber attacks.
CALL NOW 017 42 12 52 32 FOR QUOTATION
What are 27001 Documentation?
For security management System Certification it is first and important thing that preparing some mandatory documents like security policy, Security Procedures, Asset Registrar, Risk Registrar, Various forms and some other required documents which should be prepared before going to attend certification body audit. Only 27001 consultant can help you to develop those ISMS documents.
What are Benefits of 27001 Certification?
- Reduces cyber attacks
- Secures confidentiality of your data
- Develops data management process
- Establishes Risk assessment and treatment process
- Reduces online threats
- Increases skill of IT staffs
- Provides frame works of data security
Who provides ISO 27001 Certificate in Bangladesh?
AAS provides Security management system certification in Bangladesh. AAS is the first and most popular certification body partner in Bangladesh who provides certificate in the shortest time and at the lowest cost. It is the only iso company in Bangladesh who works with UK based certification body IQS Audits located in the UK.
CALL NOW 017 42 12 52 32 FOR QUOTATION
How AAS Works?
AAS has 27001 certified IRCA auditors and consultants who has long time working experience in different kinds of top label IT firms, Banks and other financial institutes. To obtain 27001 certification AAS performs audits and training on 27001 standard.
Receive 27001 Certificate from AAS means you are getting certificate from the UK. Local auditors audits here and those are sent for review in the UK. Final decision comes from UK and certificates are also issued from UK.
Who Needs This ISMS Certificate?
IT Company, Private Banks, Government Bank, Insurance Company, Brokerage company, Data management company, Out sourcing companies, Mobile operators and others.
What are the ISO 27001 Certification Process?
The certification process of ISO 27001 is almost same as other management system certification. Training, documentation , implementation, Internal audit are few steps to get ISO 27001 Certification. To see more please visit this page. Contact with AAS From this link
CALL NOW 017 42 12 52 32 FOR QUOTATION
