It gives us immense pleasure to announce that our Information Security Management System is now ISO/IEC 27001 certified for being the PROVIDER OF INTEGRATED BUSINESS APPLICATION SOFTWARE & APPS FOR MICRO, SMALL, AND MIDSIZE BUSINESSES.
ISO/IEC 27001 is an international standard on how to manage information security. The standard was originally published jointly by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) in 2005 and then revised in 2013. It details requirements for establishing, implementing, maintaining, and continually improving an information security management system (ISMS) – the aim of which is to help organizations make the information assets they hold more secure.
ISO/IEC 27001 requires that management:
1. Systematically examine the organization’s information security risks, taking account of the threats, vulnerabilities, and impacts;
2. Design and implement a coherent and comprehensive suite of information security controls and/or other forms of risk treatment (such as risk avoidance or risk transfer) to address those risks that are deemed unacceptable; and
3. Adopt an overarching management process to ensure that the information security controls continue to meet the organization’s information security needs on an ongoing basis.
The ISO/IEC 27001 certification involves a three-stage external audit process defined by the ISO/IEC 17021 and ISO/IEC 27006 standards:
a. Stage 1 is a preliminary, informal review of the ISMS, for example checking the existence and completeness of key documentation such as the organization’s information security policy, Statement of Applicability (SoA), and Risk Treatment Plan (RTP). This stage serves to familiarize the auditors with the organization and vice versa.
b. Stage 2 is a more detailed and formal compliance audit, independently testing the ISMS against the requirements specified in ISO/IEC 27001. The auditors will seek evidence to confirm that the management system has been properly designed and implemented, and is in fact in operation (for example by confirming that a security committee or similar management body meets regularly to oversee the ISMS). Certification audits are usually conducted by ISO/IEC 27001 Lead Auditors. Passing this stage results in the ISMS being certified compliant with ISO/IEC 27001.
c. Ongoing involves follow-up reviews or audits to confirm that the organization remains in compliance with the standard. Certification maintenance requires periodic re-assessment audits to confirm that the ISMS continues to operate as specified and intended. These should happen at least annually but (by agreement with management) are often conducted more frequently, particularly while the ISMS is still maturing.
By applying and securing an ISO/IEC 27001 certification we have exhibited that the complete satisfaction of clients is our utmost priority and we are (and will remain) committed to the same.
Thanks,
Marg ERP Limited
