The ISO 27000 series is a set of important security documents released by the International Organization for Standardization (ISO) to provide a guideline for best practices in IT security management, ISMS development and organizational security and risk management practices. The earlier documents (27001, 27002, etc.) serve as a baseline for this series, and many of the following documents build from that foundation. 

Later documents in the series develop guidelines describing more specialized applications. One of these, ISO 27017, address security practices for the expanding area of cloud infrastructure that most of our business operations rely on. 

Read More

You’ve studied ISO 27001 and, either internally or through the help of a security partner, you’ve implemented the security controls and practices therein to achieve compliance. Now, per ISO standards, it’s on you to continually monitor your ISMS, measure performance and effectiveness, and determine success. With complex ISMS, however, this can seem like a daunting prospect. Thankfully, ISO provides a framework for monitoring and measurement in the 27000 series–the ISO 27004 publication on monitoring, measurement, analysis and evaluation of information technology. 

As part of our series on the ISO 27000 series, we turn to ISO 27004 to highlight the importance of system monitoring and evaluation from the perspective of this particular framework. 

Read More

Of all the upheavals and challenges we’ve seen in the past few years; cybersecurity is one of the most important topics emerging in 2021. Newsworthy attacks on SolarWinds and Colonial Pipelines have prompted the White House to release an executive order dictating a new set of collective cybersecurity standards for government agencies and contractors. Following that, private companies associated with the supply chain have also begun to adopt stricter security controls based on their risk profiles and reliance on cloud-based service providers. All of these organizations, from agencies to contractors to utility companies, are turning to cybersecurity as-a-service models to meet these demands. 

It seems like everything is “a service” these days, but it is important to realize that as modern cybersecurity threats evolve, it’s nearly impossible for individual organizations to keep up. Dedicated, expert compliance and security firms are rising to fill the gap and keep our systems safe. 

Read More