Kritischer Infrastrukturen (KRITIS)
Prüfung gemäß §8a BSIG

WHAT IS

ISO 27001?

BSI-Gesetz

The increasing implementation of IT solutions in all departments of organisations is enabling processes and organisations themselves to become more digital. This allows for faster, more complex and more accurate processing of information. This, in turn, leads to an increase in challenges for information security and data protection. In recent years, the number of cyber attacks has steadily increased. 

As a modern and competitive organisation, it is incredibly important to protect business, employee and client data from theft, abuse and data loss

DIN EN ISO/IEC 27001:2017, in short ISO 27001, covers important requirements for information security management systems (ISMS). A successful accredited certification in compliance with ISO 27001 will not just allow you to fulfil industry and client demands, but will also enable you to integrate legal data protection requirements as described in the EU’s  General Data Protection Regulation (GDPR) into your security and risk management processes.

CONTENTS OF

ISO 27001

ADVANTAGES OF AN
ISO 27001 CERTIFICATION

Information & IT security

ISO 27001 follows the known “High-Level-Structure”. This structure allows the integration of further management systems that also follow this structure. These are: ISO 9001, ISO 50001, ISO 45001, and ISO 14001. Aside from the management system requirements in the “High-Level-Structure” chapters, the standard itself and goals are defined in Appendix A or Annex A.

The core focus of ISO 27001 is the protection of business data. This includes client data as well as personal data. In order to achieve this, ISO 27001 requires a risk-management process that allows for all available business data to be defined, classed, implemented and adjusted according to the three core goals.
 

These three core goals are:

• Information Availability

• Information Confidentiality 

• Information Integrity 

The individual chapters of ISO 27001 can easily be divided into the PDCA Cycle (Plan-Do-Check-Act). This cycle decides further standards, such as the “Process Approach” and “Risk-Based Thinking”. 

The Process Approach is centred around the organisation's processes. For this to work, all processes and their respective interactions within the organisation need to be managed and named. This allows the organisation to steer processes towards the desired organisational and information security goals.

A more efficient and goal oriented defence against cyber attacks is made possible through the combination of requirements for an ISMS and the requirements for measures and objectives concerning information and data protection listed in Appendix A/Annex A. 

This allows you to protect your organisation from potential interruptions and interference in your day-to-day business, as well as the subsequent loss of trust and image.

• Increase Trust in your Organisation

  • Show your clients and business partners that data protection is a natural priority for you.
    ​

• Reduce Cost and Time Investment (Enhanced Efficiency and Effectiveness)

  • Prevent data loss or theft, that could lead to monetary damage and loss of reputation.
    ​

• Minimise Risks and Maximise Opportunities 

  • Consistent and continuous risk and opportunity management allows you to act instead of react in the right moments.
    ​

• Enhance Competitiveness / Market Acceptance

  • A certified ISMS can make new customer acquisition easier, as well as lower barriers to entry.
    ​

• Enrichment through CEA Expertise 

  • The CEA Certification GmbH is a German, internationally recognised certification authority. Profit from our know-how and the expertise of our experts and auditors.