The ISO Show

ISO 27001 2022 is here, which means it's time to start thinking about starting the transition process. While the deadline is set at December 2025, we recommend making a start on planning now! If this is all news to you, check out our previous three episodes, where we reviewed all the major changes to ISO 27001, including clause updates and the 11 completely new controls added. Join Mel this week as she explains what you need to know before embarking on your ISO 27001 transition journey, in addition to a summary of our transition programme. You'll learn ● How to plan for your ISO 27001 transition ● How can Blackmores help you? ● How can you get a free copy of ISO 27001:2022? Resources ● Isologyhub ● ISO 27001 Transition Programme ● High level overview of ISO 27001 2022 Control changes In this episode, we talk about: [00:44] Businesses have until October 2025 to transition to the updated version of ISO 27001:2022 – but don't wait until the last minute! Certification Bodies get really booked up in the last year, and you could risk losing your certification and paying for another Stage 1 and 2 Assessment. [01:30] We recommend that you start thinking about your transition in 2023 so you have everything in place to start the process in 2024. [02:28] As a recap – the major changes to ISO 27001:2022 are: 56 controls have been merged into 24 newly titled controls, the addition of 11 completely new controls and controls are now categorised into just 4 groups instead of the 14 from the previous version. [03:00] ISO 27001:2022 Guide to the changes available – Simply fill out the form available at the end of the show notes to grab a copy! [04:25] Over the next few episodes, Mel will talk through the process of planning, implementing and preparation for the Certification Body transition visit. [05:51] All steps of the transition process are laid out in our Transition Programme, which includes: an awareness video, a transition action plan, Implementation of changes, Internal auditing of the changes and some optional support during the Certification Body visit. [08:45] The Planning Phase: We recommend trying to combine your transition visit with your next Surveillance visit – you can have a chat with your CB to see if that's possible. This may not be possible if your Surveillance is coming up very soon, as you need time to implement the changes needed. Those that have it in say 6 or more months' time would be in a good position to make the request. [09:30] Certification Bodies are recommending an extra half day for transition - some may require a desktop review ahead of the actual visit. Combining this visit with your Surveillance is a good way to reduce costs. [10:30] When planning out your timescales for transition, don't forget to inform Leadership and key personnel involved in the running of the Management System about the expected changes to come – and plan in time for them to help with the implementation. [11:10] Understanding the changes: We gave a high-level overview of the 11 new controls in our last episode. We will also have 11 Coffee Break Training courses covering the controls in more detail, available from March 31st 2023 on the isologyhub. [12:11] Offer: We're including a free copy of ISO 27001:2022 for those that sign up to our Transition Programme before April 1st 2023. [12:34] You may get asked for a copy of the Standard at your transition visit – as having a copy can come under 'other' legal requirements. [13:10] Discovery Phase: We have a transition checklist which can help you identify where the gaps are in terms of compliance with the new controls. You may already have some of it in place! Grab a copy of our ISO 27001:2022 Guide to the changes here Keep an eye out for next weeks episode where we dive into how to Implement the changes… We'd love to hear your views and comments about the ISO Show, here's how: ● Share the ISO Show on Twitter or Linkedin ● Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and we read each one. Subscribe to keep up-to-date with our latest episodes: Stitcher | Spotify | YouTube |iTunes | Soundcloud | Mailing List

ISO 27001, The Information Security Standard, was updated in October 2022. While there is a 2-year grace period for transition, we would urge everyone to make a start on implementing the changes to ensure you are compliant with latest best practice standards. Over the last two episodes, we've gone over the key changes and explored the specific clause updates in more detail. As mentioned in the first episode of this mini-series, there have been 11 new controls added to ISO 27001:2022. Mel is once again joined by Steve Mason, Managing Consultant here at Blackmores, to discuss the 11 new controls added to ISO 27001:2022 and their purpose. You'll learn What are the 11 new controls in ISO 27001:2022? Why have these been added? What is their purpose? Resources Isologyhub NIST Cyber Essentials ISO 22301 In this episode, we talk about: [01:00] A quick overview of the key changes - 56 Controls combined into 24 newly titled controls, 11 new controls added and 58 existing controls remained unchanged. [02:30] We have been over a few of the new controls in ISO 27002:2022 in more detail in a few previous episodes: #111, #112, #113, #114 [02:50] These new controls are nothing to worry about – they are simply aligning the Standard with more modern security considerations. You may already be complying with them! [03:32] Control A.5.7 Threat intelligence – 'To provide awareness of the organization's threat environment so that the appropriate mitigation actions can be taken.' – This can come from many different sources, such as the NCSC or local police websites. There are also additional tools you can add to detect possible phishing attacks. This also includes consideration to external threats – Information Security is about much more than just protecting data! It also includes physical security. [05:33] Control A.5.23 Information security for use of cloud services – "To specify and manage information security for the use of cloud services." – More and more businesses reply on cloud-based computing. It's important to verify the security of your service provider to ensure it's adequate. You can check to see if they have any valid Information Security related credentials such as CSA Star, Cyber Essentials, SOC. You could also adopt principles of ISO 27017 (certification for cloud security), ISO 27018 (Protection of PII in the public cloud) and ISO 27701 (PII security Standard). [08:30] Control A.5.30 ICT readiness for business continuity –' To ensure the availability of the organization's information and other associated assets during disruption' – There a few standards that could assist with this, including ISO 27031 (ICT readiness for Business Continuity). Those that have ISO 22301 may want to look at how ISO 27001 elements can be integrated and improved in any disaster recovery plans. ISO 27001 needs to be an integral part of any business continuity plans – not just a bolt on. Small business may not want to conduct a full business impact analysis, but should carry out a risk assessment around business continuity at the very least. [11:30] Control A.5.30 ICT readiness for business continuity – further considerations: A key focus of this part of the Standard is Recovery Time Objectives and Recovery Point Objectives. Overall, the whole business continuity aspect of the updated ISO 27001:2022 may take a bit of work to implement, but you will ultimately be much better off in the event of a disaster or security incident. For further guidance, you may want to check out an older non-certifiable standard, BS 25777 (ICT continuity). [13:20] Control A.7.4 Physical security monitoring –' To detect and deter unauthorized physical access.' - This can include things like CCTV, access control, swipe cards ect. This also includes the ability and regular practice of monitoring these access methods, for the purpose of detecting any anomalies. [18:56] Control A.8.9 Configuration management – 'To ensure hardware, software, services and networks function correctly with required security settings, and configuration is not altered by unauthorized or incorrect changes' – Configuration for things like a firewall, software, any hardware devices, passwords ect should be documented, explained and monitored on a regular basis to ensure nothing has been changed without notifying the relevant people. ISO 20000 includes a helpful section around configuration if you require further guidance. [21:41] Control A.8.10 Information deletion – 'To prevent unnecessary exposure of sensitive information and to comply with legal, statutory, regulatory and contractual requirements for information deletion.' – This already existed in the Standard, it has simply been clarified further. You will now need to prove that data has been deleted as required, if you use a 3rd party for this, they will need to provide the relevant certificates. [22:05] Control A.8.11 Data Masking – 'To limit the exposure of sensitive data including PII, and to comply with legal, statutory, regulatory and contractual requirements.' – You have 3 options for data masking: Obfuscation, pseudonymisation and annoymisation. This also helps to comply with GDPR requirements. [24:10] Control A.8.12 Data leakage prevention – 'To detect and prevent the unauthorized disclosure and extraction of information by individuals or systems.' – This control has made a return from the 2005 version of ISO 27001. Businesses should have systems in place to monitor any particularly large data downloads – or even possibly large print batches. You should also ensure that you have a secure email system in place as well as VPN's and regular security training to sure up your security to prevent any potential leaks. [27:00] Control A.8.16 Monitoring Activities – 'To detect anomalous behaviour and potential information security incidents.' – Appropriate monitoring should be in place to detect any potentially dangerous or malicious behavior. [28:00] Control A.8.23 Web Filtering – 'To protect systems from being compromised by malware and to prevent access to unauthorized web resources.' – Your systems should be set up in a way to prevent people from accessing unsecure or unsavory sites. This could include Social Media sites – but be mindful that there may have to be exceptions for marketing or communications personnel for those particular sites. [28:00] Control A.8.28 Secure Coding – 'To ensure software is written securely thereby reducing the number of potential information security vulnerabilities in the software.' – If you have created your own secure coding, be sure to evaluate it against industry professional standards such as OWASP and NIST. As a reminder, we'll be running a mini-series through January and February on the updated ISO 27001:2022 in addition to how you can transition to the new version. Keep an eye out for next weeks episode where we dive into the clause clarifications and control changes of ISO 27001:2022… We'd love to hear your views and comments about the ISO Show, here's how: Share the ISO Show on Twitter or Linkedin Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and we read each one. Subscribe to keep up-to-date with our latest episodes: Stitcher | Spotify | YouTube |iTunes | Soundcloud | Mailing List

As many of you are aware, an updated version of ISO 27001 was published in October 2022. While there is a 2-year grace period for transition, we would urge everyone to make a start on implementing the changes to ensure you are compliant with latest best practice standards. But where do you start? In the last episode, Mel and Steve gave an overview of the updated ISO 27001:2022, including a high-level look at some of the key changes. In addition to the control changes, there have been several changes made to specific clauses within the Standard. Mel is once again joined by Steve Mason, Managing Consultant here at Blackmores, to discuss the ISO 27001:2022 clause updates and their purpose. You'll learn What clauses have been updated from the 2013 version of ISO 27001? Why have these clauses been updated? Resources Isologyhub NIST Cyber Essentials ISO 9001 In this episode, we talk about: [01:06] The changes to these clauses appear to align your Management System with the business more so than in the previous iteration of ISO 27001 – a key focus is integration. [01:20] First change: Clause 4.2 Understanding the needs and expectations of Interested parties – 'c) which of these requirements will be addressed through the information security management system.' - This seeks to align the Management System with interested parties and identify where it may or may not be able to meet their needs and expectations. [03:30] Clause 4.4 Information Security Management System – 'The organization shall establish, implement, maintain and continually improve an information security management system, including the processes needed and their interactions, in accordance with the requirements of this document.' – There will be more focus on process flows and not Policies and Procedures. This can be further used to align the Management System with your business, by clearly identifying where it fits in with your business activities. [06:14] Clause 5.1. Leadership – 'Reference to "business" in this document can be interpreted broadly to mean those activities that are core to the purposes of the organization's existence.' – This acts more as a reminder to top management to ensure they include the Management System as part of the business and not just a bolt-on. It should be a part of the strategy and part of the business (part of the ship, part of the crew) [07:42] Clause 6.1.3 Information Security Risk Treatment –' Note 2 in sub-clause 'c' now states 'Annex A contains a list of possible information security controls.' (it had previously read Annex A contains a comprehensive list of control objectives and controls.) – This simply means that you can add references to other controls outside of the list provided within Annex A i.e. NIST or Cyber Essentials. Though, do be careful to avoid doing this at minutia level, as that just increases Management System maintenance. [09:15] Clause 6.2 Information security objectives and planning to achieve them –' A couple of extra points have been added to this clause: d) be monitored g) be available as documented information' - The monitoring was previously a given, but not really specified. So now, you'll have to demonstrate how you're monitoring objective planning and achievements. [10:24] Clause 6.3 Planning of Changes – 'When the organization determines the need for changes to the information security management system, the changes shall be carried out in a planned manner.' – This has now been aligned more with ISO 9001's approach to changes. All changes should be planned before implementation, and this now includes information security consideration. Fun fact – they forgot to include this clause in the Standard table of contents! (as of January 2023, this will probably be added later!) [11:55] Clause 9.3.2 Management Review Inputs –' c) changes in needs and expectations of interested parties that are relevant to the information security management system' – This just ensures that the needs and expectations of your Interested Parties are reviewed and not just left stagnant. [13:20] To help you revamp your Management Review, check out episodes #99 and #100 As a reminder, we'll be running a mini-series through January and February on the updated ISO 27001:2022 in addition to how you can transition to the new version. Keep an eye out for next weeks episode where we dive into the clause clarifications and control changes of ISO 27001:2022… We'd love to hear your views and comments about the ISO Show, here's how: Share the ISO Show on Twitter or Linkedin Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and we read each one. Subscribe to keep up-to-date with our latest episodes: Stitcher | Spotify | YouTube |iTunes | Soundcloud | Mailing List

The long-awaited update of ISO 27001 arrived in October 2022, having gone 9 years since its previous 2013 iteration. Needless to say, it was much overdue. The new 2022 version of the Standard includes 11 new controls and sees around 56 other controls combined into 24 newly titled controls. In order to cover every aspect of the new Standard, we'll be running a mini-series through January and February on the updated ISO 27001:2022 in addition to how you can transition to the new version. Starting off the series strong, Mel is joined once again by Steve Mason, our very own Information Security guru, to broadly discuss the changes to ISO 27001:2022. You'll learn Who is ISO 27001:2022 applicable to? An overview of the changes to ISO 27001:2022 What is Steve's favorite change to ISO 27001:2022? What are the challenges involved with updating to the 2022 version? Resources Isologyhub ISO 27031 (Guidelines for information and communication technology readiness for business continuity) ISO 27005 (Risk assessment) ISO 22301 (Business Continuity) In this episode, we talk about: [01:50] Steve Gives an overview of what's new in ISO 27001:2022 – The updated version of ISO 27001 was released on the 26th Oct 2022. The new version included 24 changes and clarifications within the main clauses. [02:50] The controls for the new standard are now categorised into 4 groups: Organisation, People, Physical and Technology [05:50] We covered some of the new controls in more detail in previous episodes: #109, #110, #111, #112, #113 and #114 [06:17] The 24 changes and clarifications to Clauses include older existing clauses which have been tidied up to be more transparent. We recommend reviewing to ensure that you are complying in a way that aligns with the Standard. [06:35] There are 11 new Controls. 56 controls from the 2013 version have been reduced to 24 with 58 remaining unchanged. So, in short, Annex A has been simplified with less duplication of controls. [07:44] Steve highlights section A.9 for Access Control as one of the much-improved controls – due to the lack of repetition and simplified requirements for compliance. [08:35] Steve's favourite update to the Standard: The whole Standard now collectively encourages incorporation into your business. Your ISMS should not feel like a bolt on, it should be a part of your businesses DNA. [10:36] Steve's favourite update to the Standard #2: It's not a static Standard, it encourages development and continual improvement. [13:45] For those completely new to ISO 27001 – check out our 3-part Steps to Success series which explains the Implementation process from start to finish. [14:38] Listen to some of our client interviews to hear the challenges others faced when Implementing ISO 27001 in addition to the benefits gained as a result of adopting the Standard: [14:50] Why would the business continuity elements of ISO 27001:2022 pose a challenge? There used to be a clause in the 2005 version of the standard which documented the need for a business impact analysis – this was removed in the 2013 version. The new 'ICT readiness for business continuity' control will require at the very least, a risk assessment. [16:48] Steve recommends checking out the Plan, Do, Act, Check diagram in ISO 27031 (Guidelines for information and communication technology readiness for business continuity). It also includes some great guidance on business impact analysis. [18:40] The ICT readiness control is not designed to be an all encompassing business continuity strategy – it's designed to work in tandem with as existing one (you may already be certified to ISO 22301 Business Continuity Management). [19:50] It's highly recommended that if you don't have a Business Continuity Plan or strategy – at least have a framework in place. Disasters by their nature are unpredictable, as is the resulting damage to an extent. You will not know the full extent until you've lived it – so don't write an exhaustive 80+ page manual that no-one will read, document the what, who and how of getting yourself back up and running again. [21:11] There has also been an update to ISO 27005 (Risk assessment in relation to info sec). It includes a new set of threat categories: physical threats, natural threats, infrastructure failures, technical failures, human actions, compromised services or functions and organisational threats. These may help you when putting a business continuity framework in place. [22:05] Above all else – ISO 27001:2022 has modernised and aligned itself more with the likes of cyber essentials and NIST. Keep an eye out for next weeks episode where we dive into the clause updates… We'd love to hear your views and comments about the ISO Show, here's how: Share the ISO Show on Twitter or Linkedin Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and we read each one. Subscribe to keep up-to-date with our latest episodes: Stitcher | Spotify | YouTube |iTunes | Soundcloud | Mailing List

Happy New Year! We at Blackmores hope you all managed to have a break over the holiday season and are gearing up for many challenges and successes in 2023. As a reminder, we signed off last year by highlighting the top 5 podcasts as dictated by you, the listeners. Before we dive into a brand-new year full of top tips, expert advice with industry leaders and client interviews, we'd like to take a step back and let the host share her reflections on 2022. Join Mel as she shares her personal top 5 ISO Show episodes from last year. You'll learn What are Mel's top 5 episodes of 2022? Resources ISO Show Archive Isologyhub In this episode, we talk about: [00:30] A reminder to listen to our last podcast, covering the top 5 podcasts as dictated by the listeners. [01:21] #1 Episode 102 – What's in a name? This episode features our Senior Isologist, Sarah Ball, as she explains the importance of giving a meaningful name to your Management System. [03:40] What's in a Name snippet – Full episode available in the ISO Show Archive [08:01] #2 Episode 94 – The 7 Steps of Carbonology_ Reduce – Part 4 of the 7 Steps of Carbonology series, featuring our Carbonologist, David Algar. This episode delves into the creation and communication of a carbon reduction plan, and the benefits of reducing your footprint rather then relying on offsetting alone. [10:14] The 7 Steps of Carbonology - Reduce snippet – Full episode available in the ISO Show Archive [16:48] #3: Episode 117 PMC's journey and ongoing success with ISO 27001– This is an interview with Philip Bailey, the Managed Services Director at PMC Retail, talking about their ISO 27001 journey. Philip shares his lessons learned and gives some top tips for anyone considering implementing the Information Security Standard [17:58] PMC's journey and ongoing success with ISO 27001 snippet – Full episode available in the ISO Show Archive [24:00] #4: Episode 100 How to get the most out of your Management Review – Featuring Rachel Churchman, Managing Consultant here at Blackmores, this episode explores how added value can be gained from doing a Management Review. Mel and Rachel discuss various ways you can conduct a Management Review and what should be your key inputs and outputs. [26:14] How to get the most out of your Management Review snippet – Full episode available in the ISO Show Archive [30:41] #5: Episode 108 How to align your Management System with the Sustainable Development Goals– Following on from the Sustainable Development Goals summary episodes, Mel shares how you can align your Management System right now without the need for any ISO certification. [32:37] How to align your Management System with the Sustainable Development Goals snippet – Full episode available in the ISO Show Archive We look forward to bringing you even more amazing content in 2023, so stay tuned! 😊 We'd love to hear your views and comments about the ISO Show, here's how: Share the ISO Show on Twitter or Linkedin Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and we read each one. Subscribe to keep up-to-date with our latest episodes: Stitcher | Spotify | YouTube |iTunes | Soundcloud | Mailing List

It's been a busy year here at Blackmores! Somehow, we managed to fit in the time to publish 37 new ISO Show episodes. It's been a mix of knowledge sharing, top tips, advise and stories from our very own consultants and clients – and we're looking forward to sharing even more with you next year! We thought it'd be good to end this year on a look back at 2022 and highlight 5 of the most listened to episodes of the ISO Show across its many platforms. Join Mel as she shares some snippets from our top 5 most popular episodes this year. You'll learn What are the most listened to episodes of the ISO Show for 2022? Resources ISO Show Archive Isologyhub In this episode, we talk about: [00:30] The top 5 episodes of 2022 have been selected based on which episodes have been listened to the most. [01:00] #1 98 What is a Management Review? This is an episode that appeals to a more general audience as Management Review is a requirement of many ISO's. This was the 1st of a 3-part series and explains the basics of what a Management Review is and what it typically includes. [02:47] What is a Management Review snippet – Full episode available in the ISO Show Archive [05:40] #2 100 How to get the most out of your Management Review – Part of the Management Review series – this episode includes Rachel Churchman, a Managing Consultant here at Blackmores. The episode explored various ways in which you can make your Management Review both more engaging and successful in achieving tangible outcomes. [06:55] How to get the most out of your Management Review snippet – Full episode available in the ISO Show Archive [13:20] #3: 106 What are the Sustainable Development Goals – This is a 2-part series which explores the 17 SDG'S and how ISO Standards can meet certain goals. In both episodes, Mel gives specific examples of the many ISO's that align with the SDG's. [15:08] What are the Sustainable Development Goals snippet – Full episodes available in the ISO Show Archive - Part 1 / Part 2 [22:08] #4 and #5: 109 What's new with ISO 27002:2022? / 110 What are the 11 new controls in ISO 27002? – Both of these episodes shortly followed the release of ISO 27002 – A guidance document for ISO 27001. While not certifiable, it did give us an insight to the changes in ISO 27001 that were published later in the year. Episode 109 summarises how ISO 27002 works in relation to ISO 27001, along with a very brief summary of the changes. Episode 110 goes into more detail on each of the 11 new controls – and features our very own Managing Consultant, Steve Mason. [24:38] What are the 11 new controls in ISO 27002 snippet – Full episode available in the ISO Show Archive That's it from us for 2022! We hope you all have a wonderful Christmas and New year - See you on the other side in 2023 😊 We'd love to hear your views and comments about the ISO Show, here's how: Share the ISO Show on Twitter or Linkedin Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and we read each one. Subscribe to keep up-to-date with our latest episodes: Stitcher | Spotify | YouTube |iTunes | Soundcloud | Mailing List

Currently, there are around 1,077,884 valid ISO 9001 certificates globally – which beats the second runner ISO 14001 by over 600,000! There is no doubt that the Quality Management Standard, ISO 9001, is still the most widely adopted ISO Standard – and for good reason! ISO 9001 is basically a model for running a successful and profitable business. It provides a common framework for things that all businesses should have in place, including defining your companies unique 'way of working'. In addition to being a blueprint for a business's operation, there are many other benefits to be gained from implementing ISO 9001. Today, Mel explains a few of these benefits in greater detail. You'll learn What is ISO 9001? Why Implement ISO 9001? The benefits of ISO 9001 Resources What is ISO 9001? Isologyhub In this episode, we talk about: [00:30] Why talk about ISO 9001 benefits? Often times, Mel gets asked for benefits of ISO 9001 so a business case can be put forward. [01:00] What is ISO 9001? For a detailed break down of the Standard, go back and watch 'Episode 36 – What is ISO 9001?' [01:45] For those that have Implemented ISO 9001, what are the benefits? We'd love to hear from you! If you have some stories to share – feel free to leave a comment on which ever media player you're listening on – or email us. We'd love to share some of your experiences in a future episode. [02:09] Benefit #1: Win new business – From a sales and marketing perspective, ISO 9001 is essentially a passport to trade. It demonstrates credibility to Stakeholders as it's a mark of quality. [02:55] Benefit #2: A framework that can fit any business – This can be for any industry sector and business size. It helps businesses figure out what is working well and what's not working so well. [03:10] Benefit #3: Identify opportunities for Improvement - It helps businesses figure out what is working well and what's not working so well. It can help identify issues such as: Bottlenecks in processes, resourcing and external factors. [04:05] ISO 9001 helps you to look at your business – warts and all. It does no one any good to bury their head in the sand and ignore issues, especially as Stakeholders and clients will see through this. [04:40] Benefit #4: Put quality controls in place to mitigate risk and raise your standards – If you have complaints or need to do a product recall – you need processes in place to handle this. ISO 9001 gives you the tools to do so, creating an effective framework everyone can follow. [05:40] Benefit #5: Improve efficiency – ISO 9001 helps you identify the best way of working and pushes you to optimise that. That could include eliminating aspects of you business that waste time, or create burdens. [06:05] Benefit #6: Creating a unique Blueprint – ISO 9001 isn't an out of the box solution – it can be tailored to your way of working. It helps to establish relevant Policies and Procedures that improve your business operations. [06:24] Benefit #7: Enhancing customer satisfaction and employee retention – Good quality business practices will inevitably help you to keep ahold of good clients – and good employees too! This can be achieved by having clear roles and responsibilities in addition to vision and goals for the business. [07:20] Benefit #8: Increase profitability – Businesses often look at the cost of poor quality – where is your business leaking money? Addressing those issues is a direct cost saving. [08:21] Businesses who have grown through acquisition often find ISO 9001 a great tool to help standardise their way of working, so they can easily integrate other businesses and services. We'd love to hear your views and comments about the ISO Show, here's how: Share the ISO Show on Twitter or Linkedin Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and we read each one. Subscribe to keep up-to-date with our latest episodes: Stitcher | Spotify | YouTube |iTunes | Soundcloud | Mailing List

Data breaches have risen by 70% globally in Q3 of 2022, reenforcing the requirement for many to seek out Information Security solutions, especially those within the tech space. Today we speak to Triaster, who have been in operation since 1994, providing businesses with process mapping and execution software to help drive business improvement. Triaster's Business Operations Manager, Jane Duncan, explains why they sought to implement ISO 27001, what challenges they faced and what they learned during their certification journey. You'll learn Who are Triaster? Why Triaster Implemented ISO 27001 What did they learn from their experience? What benefits have they seen as a result of Implementing ISO 27001? Resources Triaster What is ISO 27001? Internal Auditing in plain English: A simple guide to super effective ISO Audits by Craig Cochran In this episode, we talk about: [00:54] Get to know Jane Duncan – Triaster's Business Operations Manager who has recently started fostering dogs for a local charity. [01:41] Who are Triaster? In short, they build software solutions that drive business improvement. They are a thought leader in their field and strive to create new software to meet business needs. [02:25] What was the main driver for achieving ISO 27001? In 2020, they had certified to the Quality Standard, ISO 9001, and saw the many benefits that come with ISO certification. They saw ISO 27001 as both an opportunity and a necessity due to their work within the IT industry. ISO 27001 is seen as a mark of trust and provides a central framework to improve data security. [04:28] How long did It take to implement ISO 27001? They started looking at certification bodies and consultants to help with implementation in March 2021. The project overall lasted six months, with their assessments taking place in September and October of the same year. They also chose to recertify to ISO 9001 at the same time – this aligned both Standards under one Integrated Management System. [06:35] If you are considering implementing multiple ISO's, it's recommended to integrate them into a single Management System. This reduces the costs of implementation and is overall easier to maintain. [07:17] What was the biggest gap identified in Triaster's initial Gap Analysis? They had a lack of security policies in place in addition to a lack of processes that would have mitigated potential data security risks. [08:00] What was the biggest difference ISO 27001 made? They now do regular annual SWOT and PESTLE's that are evaluated at Management Reviews. Risks identified during those reviews are added to a risk register and are used to develop the necessary objectives and controls needed to mitigate future risk. [08:38] Other differences include the ability to track non-conformities, security risks and opportunities for improvement. They also have the confidence to prove their data security credentials to clients and have the required documentation to back it up. Tendering processes are also made easier by having ISO 27001 as it is often a requirement that can now be ticked off. [09:25] Triaster use Infrastructure partner (who are also ISO 27001 certified) and can now hold them accountable for the services they provide. [09:50] Jane states that they are now a much better business following the Implementation of both ISO 9001 and ISO 27001 – continually improving their processes and scrutinising working practices. [10:54] All of the same security practices can be done by those who are homeworking at Triaster [11:05] What has been the main lesson learned? The process if certification is a journey – it's about continually improving and truly adopting the ethos of Information Security into every aspect of the business. [11:52] What are the main benefits? They hope their clients can see their efforts and have confidence in Triaster's ability to keep their data secure. They also now have the processes in place that drive continual Improvement. [12:33] Jane's top tip: Document what you do as a business and look for gaps. Also, certification is a journey, and you shouldn't stop striving to improve once you achieve certification. [13:00] What book would you recommend and why? Internal Auditing in plain English: A simple guide to super effective ISO Audits by Craig Cochran [14:15] Jane's favorite quote: "No one is you, and that is your superpower" We'd love to hear your views and comments about the ISO Show, here's how: Share the ISO Show on Twitter or Linkedin Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and we read each one. Subscribe to keep up-to-date with our latest episodes: Stitcher | Spotify | YouTube |iTunes | Soundcloud | Mailing List

All companies have a legal obligation to comply with existing legislation – it's the law! Failure to comply to legal requirements can be costly in terms of fines and reputational damage if an incident occurs. So, it's in your best interest to ensure you can identify all applicable compliance requirements. Most ISO's specify a requirement to identify legal compliance requirements, and in our experience, the most effective way to do so is through the creation of a Legal Register. Mel is joined by Sarah Ball, A QHSE Consultant here at Blackmores, to discuss how you can create your own Legal Register and keep up-to-date with changes in legislation. You'll learn The importance of Legal Compliance How to identify what legislation is applicable to you What is a Legal Register? How can you create a legal Register? How can you keep up with changes in Legislation? Resources isologyhub gov Productivity Ninja In this episode, we talk about: [01:06] Why do you need to comply with Legislation – quite simply, it is the law! It can be very costly for you in both a financial and reputational respect. [01:25] There is a requirement for identifying legal compliance requirements in most ISO's i.e. ISO 45001 (Health and Safety) and ISO 14001 (Environmental) [02:33] A Legal Register is not a requirement of any ISO – but we find it is the most effective way of documenting and keeping track of changes in applicable legislation. [03:05] Why is it so important to manage legal compliance? Besides the financial and reputational cost of not complying with the law – it's a way to protect your business. The law is there for a reason and it is often times to protect individuals or communities. [04:35] You will need to take a proactive approach to find out what legislation is applicable to you. [05:40] How can you identify your legal obligations? Firstly, do some basic research, start by visiting reputable industry authorities as they will likely have some guidance available i.e. The HSE Website or the Legislation.gov website. There are also subscription services available that give you an overview of what may be applicable to you and notify you of any updates. Finally, you can look to a specialist consultancy to help you. [09:05] We do have a module on Legal Compliance available in the isologyhub! [10:05] Why is it important to have a legal register? You will have to keep track of a lot of legislation! By documenting it, you have full visibility and can identify any gaps. You can also assign accountability against each piece of legislation, so the responsibility can be shared and managed. [11:40] Your brain is for thinking and processing, not remembering. By documenting information, you create a 'second brain' to free up your brain for more important tasks – We recommend checking out the 'Productivity Ninja' series of books for more helpful organisation and prioritisation tips! [12:28] What does a Legal Register look like? It's typically a table of information – we use spreadsheets but any format is fine. Key columns we use identify the name of the legislation or contractual obligation, a link to the legislation, the requirements and purpose (what does this legislation mean to you?), A link to any further guidance and description of what good looks like to you i.e an example of evidence of compliance. You could include a column for accountability. [16:00] How do you create a Legal Register? First, set up your table, next go out and find your applicable legislation, confirm and document your requirements in regard to the legislation, then assign accountability within the organisation. You may want to consult stakeholders to complete the obligations and figure out what good looks like. It is also good practice to do a legal compliance audit to ensure you are meeting obligations and identify any gaps. [17:50] You can document other requirements in the Legal Register – this can include Service Level Agreements or even any ISO standards you're certified to. It is advised to add any contractual requirements with customers or possibly landlords or suppliers. If you are a trade body that has a code of conduct, we recommend you include that too. [21:00] Sarah's top tip: When creating new processes or updating existing ones, it's always good to look back at the Legal Register and check that any changes you're making aren't going to affect anything in terms of compliance. We'd love to hear your views and comments about the ISO Show, here's how: Share the ISO Show on Twitter or Linkedin Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and we read each one. Subscribe to keep up-to-date with our latest episodes: Stitcher | Spotify | YouTube |iTunes | Soundcloud | Mailing List

We have over 17 years experience of implementing various ISO's – and we'd like to share some insight into our proven methodology. Our regular listeners may be familiar with the term 'isology' from previous episodes where we've highlighted our online platform – the isologyhub. But what is isology exactly? Put simply, isology is our 7-step method for implementing any ISO Standard. Join Mel this week as she breaks down each of the 7 steps, including the planning, creation and review of an ISO Management System. You'll learn Our experience implementing ISO's The origin of isology What is isology? The seven steps of isology Resources isologyhub How to choose a Certification Body In this episode, we talk about: [00:31] An overview of isology – a methodology for implementing any ISO. Find out more over on the isologyhub [01:08] How the isology methodology was created – 17 years in the making with the help of our consultants. [01:33] A brief overview of the 7 Steps of isology [03:05] 1st Step - Plan: Get a copy of the Standard, determine your scope, timescales, leadership commitment, resources and selecting a Certification Body. Some choose to implement the system but leave out the badge. There are ISO's that aren't certifiable but good to have i.e. ISO 20400 Sustainable Procurement. [05:38] 2nd Step – Discover: Time to understand what you have in place already and what you're missing – this is done through a Gap Analysis. [06:35] 3rd Step - Expose: This is where we look at risks and opportunities related to your desired Standard (both internally and externally). This is typically done through a SWOT and PESTLE. A Risk Register may be created to capture the findings to be addressed later. Companies are also encouraged to create a Legal Register to keep track of all their statutory, regulatory and contractual requirements. [08:41] 4th Step - Create: Time to review the requirements of the Standard in terms of documentation – and create what's needed. This includes capturing your way of working with documented Procedures – make sure you have the relevant staff involved in their creation. [10:05] 5th Step - Launch: Once the Management System has found it's home (usually an intranet or SharePoint) – you need to communicate it. Consider the type of launch you want and who will be involved. Make sure you encourage engagement with the Management System. [11:18] 6th Step - Engage: There's little point in having a Management System if people don't know about it or have little interest in it. You should train your staff on the Management system, so that they are aware of your policies and procedures and where to find key documents. You must verify compliance through Internal Audits – this is a requirement of any ISO Standard. [13:09] 7th Step - Review: Time to take a step back and look at what's been achieved and what's been highlighted as areas for improvement through your Internal Audits. There's a set list of criteria in each ISO Standard to help you plan an agenda for the Review. We'd love to hear your views and comments about the ISO Show, here's how: Share the ISO Show on Twitter or Linkedin Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and we read each one. Subscribe to keep up-to-date with our latest episodes: Stitcher | Spotify | YouTube |iTunes | Soundcloud | Mailing List