The ISO Show

Sustainability should be a top priority for any business going into 2023. The last few years’ worth of extreme weather have proven that action needs to be taken now to protect our future. But where do you start? While there are a lot of great ideas out there, it’s becoming increasingly clear that a standardised approach is needed to keep everything on track. Which is where ISO Standards come into play – having been promoted heavily at the last few COP conferences, there are a whole range of environmental Standards to help businesses manage and reduce their impact. One of the most popular being ISO 14001 (Environmental Management), which was adopted by the subject of today’s interview – dotdigital. dotdigital is an online marketing company who specialise in email and SMS marketing automation, tailoring customer experience and providing solid data analysis tools. Mel is joined by Steve Shaw, Chief Product & Technology Officer at dotdigitial, to talk about the positive impacts following on from their successful ISO 14001 implementation, and to explain some of their fantastic sustainable initiatives introduced over the past few years. You’ll learn ●      Who are dotdigital? ●      How do dotdigital manage their Environmental Management System?   ●      What are dotdigital’s sustainable initiatives? ●      What have they learned through the implementation of ISO 14001?   Resources dotdigital Creativity Inc – by Ed Catmull ISO 14001   In this episode, we talk about: [01:07] Listen to our previous interview with dotdigital – where we discussed their ISO 27001 (Information Security) certification.   [01:32] An introduction to Steve Shaw – He is the Chief Product & Technology Officer at dotdigtal, who oversees a lot of their innovators (which comprises of software engineers and those involved with product development and support). He also manages the various acquisitions for the group. [03:15] Who are dotdigital? Dotdigital have been around since 1999, they have evolved and adapted to join the growing SaaS market. They provide a range of automated marketing solutions in addition to a customer experience and data platform. They recently celebrated reaching 400 employees and have become AIM listed. [03:52] What can dotdigital’s platform do? Data collection and analysis to build a profile for single or groups of users. This data can then be used in combination with AI and machine learning to create a tailored digital journey with a brand. [05:15] How do dotdigital manage their current ISO 14001 certified system? – Their Management System is an integrated Management System, which provides the business with a central hub to work from. They have an established team who are tasked with the management of their ISO system (this is not a dedicated role for anyone in that team). Part of their role involves looking at the businesses aspects and impacts to see where the biggest consumption of energy is happening, measuring this consumption and setting objectives to help reduce this where possible. [06:51] dotdigital was the worlds first carbon neutral marketing automation platform that was ISO 14001 certified. They also aim to be net zero by 2030! [07:10] They have a relatively small footprint as a primarily digital based company, only really having to consider the running of computers, air conditioning and standard office facilities. So it can be a challenge to reduce! [08:30] What led to the success of dotgreen? – dotdigital launched a group called dotgreen, which has since thrived into a community of likeminded individuals all working together to improve and reduce dotdigital’s impact. They were fortunate to have an Executive group sponsor who can take ideas and suggestions to other leadership for consideration. This grassroots group encourages suggestions from everyone – no idea is a bad idea. Over time, the group evolved and helped to develop a sustainability programme for the business.   [10:30] What was one of the initiatives implemented from dotgreen? – They identified that existing data centers used by the business weren’t always utilising renewable energy. So, over the course of 2 years, they worked with Microsoft to build on their Azure platform to enable dotdigital to make the switch. Azure runs on renewable energy sources, and any remaining emissions can be offset through carbon credits. [12:00] A green option for their customers – As a result of their cloud platform now being run through green partners, they can extend the environmental benefit to their customers.   [14:00] A sustainable culture shift – The introduction of dotgreen, it’s initiatives and the success of certification to ISO 14001 fostered a shift in the businesses culture. It spread to all aspects of the business – even resulting in their marketing team making the decision to not send out Christmas gifts and instead used the money to buy credits for tree planting.  [15:25] What is dotvoice? – Another pillar in the internal mechanisms of dotdigital. This voluntary group look at how they can promote awareness of different issues. One such example was organising interviews to celebrate the women in tech at dotdigital for International Women’s Day. [17:10] Adapting – Like many businesses, they had to adapt over Covid to allow for home working. Following on from feedback, they have kept up with hybrid working. This means that meeting in-person usually becomes a big event! They ensure that all employees are taken care of, even creating another pillar called dotwellbeing to offer mental health support. [21:53] Through the use of dotgreen and dotvoice, they promote voluntary days to assist with local initiatives and charities (many of which are their clients – such as the Woodland Trust). [23:20] What have dotdigital learned over the years of maintaining an ISO 14001 certified system?  Don’t rush for certification if it can be helped, take the time to put the right people and resources in place to start the process. It can be beneficial to enlist the help of a third party to guide you through your first Implementation. ISO 14001 helped to put tools in place to measure aspects and impacts – which in turn assisted with their SECR requirements Manage your system centrally. ISO Standards should be embedded into the business [23:20] Steve’s top tips: Get leadership support, look for passionate individuals to get involved, let the Standard guide you and don’t be afraid to set lofty goals. [23:20] Steve’s book recommendation: Creativity Inc – by Ed Catmull [23:20] Steve’s favorite quote: “The only constant in life is change” / “Some people want it to happen, some wish it could happen and others make it happen” You can find out more about dotdigital via their website. We’d love to hear your views and comments about the ISO Show, here’s how: ●      Share the ISO Show on Twitter or Linkedin ●      Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and we read each one. Subscribe to keep up-to-date with our latest episodes: Stitcher | Spotify | YouTube |iTunes | Soundcloud | Mailing List

With the pandemic being the driving force behind more remote working than ever before, health and safety professionals are becoming increasingly tech-savvy.  All evidence points to them increasing their reliance on Software as a Service (SaaS) solutions to keep on top of H&S compliance and the ever-changing risks that are presenting themselves to businesses the world over. Companies such as Riskex offer many software solutions to make Health and Safety Professionals’ lives easier, by streamlining compliance processes, gathering better safety data and providing total visibility on the performance of risk management. As a result, they keep a keen eye on new technology being adopted by the H&S sector. Mel is joined by James Sharp, Chief Technical Officer at Riskex, to explain the top 10 emerging Software as a Solution trends in Health and Safety.   You’ll learn ●      Who are Riskex? ●      Why are people leaning towards SaaS?   ●      What are the top 10 emerging SaaS trends in health and safety? ●      What solutions do Riskex provide?   Resources ●      Riskex ●      AssessNet ●      ISO 45001   In this episode, we talk about: [01:40] An introduction to Riskex and James Sharp’s role as Chief Technical Officer there. [02:51] What is AssessNet? AssessNet is an online Health and Safety / Risk Management System designed to help streamline compliance processes and make gathering data much easier.   [04:00] Riskex have been certified to a number of ISO Standards, including ISO 18001 (Prior Health and Safety Standard, now certifying to the latest version, ISO 45001), ISO 27001 (Information Security) and ISO 9001 (Quality Management) [06:20] Software as a Service became very popular during Covid, as business became very fragmented and were looking for solutions that could be rolled out across multiple sites. Riskex also created their own track and trace system based on established software they were already offering – helping businesses manage Covid safely. [08:40] Trend #1 – Artificial Intelligence - Artificial learning is all around us and with vast volumes of data being collected by safety management platforms.   AI allows decision engines to predict and provide guidance based on key trends or established KPI’s. For example, if accident rates were to increase but at the same time risk levels have been reducing, it could soon highlight this trend and look at other surrounding data or previous trends to establish a pattern.  This will lead to a more pro-active approach to reporting and subsequent decision-making.   [10:35] Trend #2 – API Connectivity - Providing an open API platform will allow businesses to integrate internal systems and external services to digest data. As more organisations adopt Cloud solutions, connectivity between platforms has become increasingly important. With a robust API offering, multiple business services can interact with ease and become part of the safety management space, without incurring significant cost or time.  [11:50] Trend #3 – Low-Code Optimisation - Developing generic components within software to allow for quicker builds, implementations and tailoring requests. As stand-alone and generic component development increases, solutions can offer more flexibility and self-serve options to the end user to assist them with aligning platforms with their specific processes. [13:30] Trend #4 – Mobile Optimisation - More and more end-users are accessing health and safety software via their mobiles but for various reasons, are not always able to use native apps (installed on the device). Therefore, health and safety software platforms need to adapt use on multiple devices, without the loss of features. [14:45] Trend #5 – Vertical SaaS - Configuring EHS Software to align with the specific risks, terminology and processes that are pertinent to a given sector. As systems continue to grow in terms of sophistication and the ability to customise, so does the need to ensure that they remain User-friendly.  A key factor to consider is that each industry has its own set of industry codes of practice, regulations, hazards and risks – and EHS systems need to be designed with these in mind. [15:50] Trend #6 – White Labelling - Integrating 3rd party EHS platforms into a client’s corporate brand identity. When it comes to optimising User engagement and embedding technology effectively into business operations, it is important that the look and feel of the system interface is aligned with an organisations branding, company values and mission to create a more cohesive User experience. Riskex have embraced this by offering ‘FreshNet’ to clients, which can be tailored and aligned with clients existing branding. [17:10] Trend #7 – Centralised Analytics (BI) - Robust Health and Safety management systems rely on an abundance of performance data arising from core processes – Risk Assessments, Audits, Contractor Governance, Incident Management and so on. The sheer volume of information generated by these processes can provide a wealth of positive opportunities to improve safety outcomes, if analysed correctly – which is where BI platforms come in to help provide an overall picture of risk performance management. [19:40] Trend #8 – Micro-SaaS - Deploying discreet elements of a SaaS platform to work as standalone entities to fit a specific customer requirement. Modular-based solutions or smaller SaaS platforms can meet the needs of those organisations that may only require a specific feature, not necessarily a holistic service. [20:30] Trend #9 – Machine Learning – This is a subset of AI, machine learning learns as it goes, picking up trends and offering insights for consideration. [21:27] Trend #10 – Customer Experience - Customer Experience, in terms of both useability and service will outshine complex offerings. As SaaS becoming commonplace from both consumer and commercial perspectives, User’s expectations regarding Customer Experience are growing sharply when they are looking to make technology purchase decisions. Successful EHS SaaS vendors put significant focus and investment in optimising the Customer Experience, both in terms of interface and functionality, to reduce the barriers to adoption by focusing on how Users interact with their solutions. [28:00] Businesses usually have a very limited Health and Safety resource. SaaS solutions enables informed decisions to be made despite a lack of human resources available.    You can find out more about Riskex via their website. Don’t forget to check out their Health and Safety Management software – AssessNet We’d love to hear your views and comments about the ISO Show, here’s how: ●      Share the ISO Show on Twitter or Linkedin ●      Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and we read each one. Subscribe to keep up-to-date with our latest episodes: Stitcher | Spotify | YouTube |iTunes | Soundcloud | Mailing List

To keep global warming to no more than 1.5°C  – as called for in the Paris Agreement – emissions need to be reduced by 45% by 2030 and reach net zero by 2050. Many businesses are already making great strides to reduce their Impact, and while you can reduce, achieving true carbon neutrality will involve offsetting a certain amount of emissions. Treeconomy are one of the few companies in the UK that offer credible carbon credits. Backed by principles of PAS 2060 (Carbon Neutrality), they seek to break the greenwashing cycle. Mel is joined by Harry Grocott, CEO and Co-founder of Treeconomy, to discuss their credible carbon offsetting schemes and the innovative technology they use to help quantify the value of nature. You’ll learn ●      Who are Treeconomy? ●      What is the difference between services offered for landowners and Offset buyers? ●      Can you quantify the value of nature? ●      How can people be sure that they don’t fall prey to Greenwashing? ●      How can someone go about buying and monitoring offsetting credits? ●      Are Treeconomy’s carbon offsetting schemes verified?   Resources ●      Treeconomy ●      Sherwood ●      ISO 14064 ●      PAS 2060   In this episode, we talk about: [00:30] Catch up our episodes covering the Sustainable Development Goals (Part 1 / Part 2), ISO 14064 and PAS 2060. [01:00] Treeconomy are a company that offer credible carbon offsetting schemes – they are one of the few companies who are recognised by PAS 2060 (the Standard for Carbon Neutrality) [02:05] Harry Grocott (CEO) introduces Treeconomy -  A nature based, carbon removal and restoration company that operate in the UK and Internationally. They offer schemes that work towards afforestation, peatland restoration, rewilding ect. They are also keen to enable evidencing the impact, developing a software platform, remote sensing, and AI technology to do so. [03:41] They are part of the Centre for climate change innovation which is an initiative of Imperial College London and the Royal Institution to catalyse innovation of all forms that address the causes and effects of climate change. [04:22] What is the difference in services for Landowners and Offset Buyers? For landowners, Treeconomy can help you change land use from one to another. I.e changing land used for sheep grazing into something more carbon intensive. Treeconomy will ensure that any project started with them is a verified Carbon Scheme – in-line with the woodland carbon code. Once your project set up has been completed and verified, Treeconomy will assist in the sale of credible carbon credits. [07:22] For offset buyers: Treeconomy offer a wide range of projects and varyingly priced carbon credits.   [07:45] Can we quantify the value of nature? Short answer right now is no, but there is a lot of nuance. Nature offers ecosystem services i.e. farms offer a calorific benefit, we can put a price on the value that offers. The same principle applies to resources such as wood or oil. Now we are gaining the ability to quantify CO2 removal, which is undeniably valuable to humanity. [09:18] Other more recent services such as biodiversity projects are a bit harder to quantify – as they vary so much depending on the country. However, we are starting to assign value to these. [12:15] How can people be sure that they don’t fall prey to Greenwashing? There are 2 main issues to consider: 1) Are your carbon credits credible? 2) what claims are top management making? [12:44] Tackling claims made by leadership: ISO standards are starting to solve this issue. There are clear requirements and certifications that need to be in place to back those claims.   [13:00] Tackling carbon credits: The carbon offsetting market is heavily unregulated currently. Essentially it’s a lot of people trading in invisible gas. There are a number of carbon standards (Not quite at the same level as ISO Standards), such as the Woodland Carbon Code and the Peatland Code, and Internationally there are standards such as Verra VSC – unfortunately, a lot of these standards aren’t very robust and aren’t enforced. [15:30] Many companies will often look to buy the cheapest offsets available, which are likely to be non-credible and will provide no evidence of actual offsetting occurring. But, there are a lot of new companies emerging that provide tangible evidence of offsetting (such as Treeconomy 😊) [18:30] How can someone go about buying and monitoring offsetting credits? If you don’t want to use a company like Treeconomy, you would need to directly contact and purchase credits from a company who is developing a project. [19:23] Treeconomy have created a platform called Sherwood – this displays all the projects they are helping to develop, which also tells you who the landowners are and the carbon inventory attached to each project. It can also help you evidence credits purchased, whether they are historic or future carbon removal. [21:30] Not many companies offer comprehensive reporting and evidencing of carbon credits in practice. Treeconomy use a range of methods such as drones, satellites and AI programs to report back, and aim to make getting this information as easy as possible for credit purchasers. [23:20] How did Harry get into this business? Starting off studying geography and Science – he later went onto work in finance for 3 years and qualified as a finance adviser. While working he realised that the amount of money available is rarely the issue, rather the use of it. He saw that there was a large gap in funding for climate change mitigation and adaptation – but not enough money was going towards it. He began wondering why more couldn’t be invested and so decided to study climate change management and finance (partly though Covid), where he met his co-founder. After getting some Government grant funding, investors and landowner partners, they have flourished over the last 3 years. [27:00] Are Treeconomy’s offsetting schemes verified? Yes – they work under the UK woodland carbon code (and soon the peatland carbon code). They are also working to create a new protocol to tackle rewilding, including how the value and progress can be tracked. Internationally they will be working under Verra. [29:05]  Treeconomy can help to provide detailed evidence of carbon offsetting thanks to their reporting capabilities, this can be passed onto 3rd party auditors to verify in-line with any carbon Standard.   [30:00]  You can find Treeconomy via their website, LinkedIn, Twitter and Instagram 😊  We’d love to hear your views and comments about the ISO Show, here’s how: ●      Share the ISO Show on Twitter or Linkedin ●      Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and we read each one. Subscribe to keep up-to-date with our latest episodes: Stitcher | Spotify | YouTube |iTunes | Soundcloud | Mailing List

Anyone with a current ISO 27001:2013 certificate will be required to update and add certain elements in their existing Information Security Management System to ensure compliance to ISO 27001:2022 ahead of the October 2025 deadline. Over the past few weeks, our mini-series has covered the fundamental changes to the Standard, along with tips on how to plan and Implement the required updates. Join Mel this week as she explains the final few stages of an ISO 27001 transition, including the Internal Auditing and final preparation ahead of a Certification Body visit. You’ll learn ●      What needs to be audited? ●      What do I need to do to prepare for the Certification Body visit? ●      How can you get a free copy of ISO 27001:2022?   Resources ●      Isologyhub ●      ISO 27001 Transition Programme ●      What you need to know to transition to ISO 27001:2022   In this episode, we talk about: [00:44] Catch up on the last two episodes before listening to this one: What you need to know to transition to ISO 27001:2022 / What changes need to be Implemented to transition to ISO 27001:2022 [01:00] The last stages are all about gathering evidence of compliance against new and updated clauses and controls [01:28] Make sure you plan your transition visit well in advance – If you leave it too late you may incur additional fees for more days or possibly even for a full certification if you miss the deadline. [02:15] This process for transition is fairly consistent among Certification Bodies. It typically includes a Readiness Review and a transition visit where they will review evidence of compliance against the new controls. [02:45] You can get a free copy if you sign up to our Transition Programme by April 1st 2023) [02:55] The last stage ahead of the transition visit is Internal Auditing. For those still planning their 2023 Internal Audits, you may wish to Implement the changes earlier in the year with a view to audit the changes in the later half of 2023. Ensure that you allow time to build evidence of compliance ahead of a transition visit.  [03:45] If you need a bit of extra help, we include Internal Auditing within our transition programme – this will typically take 1 day. [04:30] We can also support you during your transition visit – this could be on-line or on-site, which would depend on your Certification Bodies preference. [05:20] Currently many Certification Bodies are suggesting a half day for the Readiness Review and another day for the transition. Some may choose to include this transition as a part of their annual Surveillance visit to help save on costs. If you have a Surveillance coming up, it’s worth getting in contact with them to see what they would recommend regarding your transition.   [05:43] We advise that you also ask your Certification Body, when they will be UKAS accredited for ISO 27001:2022 – they may not be ready complete a transition visit until the later half of 2023. [06:35] For our global listeners, your Certification Body will have an Accreditation Body that needs to verify their ability to conduct transition visits. For the UK this is UKAS, but it may differ for other countries. [07:15] Don’t leave this until last minute! Based on previous experience with transitions, we’ve found companies that leave it until a few months before the deadline often can’t transition in time, and end up having to pay up for a full Stage 1 and 2 Assessment in order to keep their certification. Grab a copy of our ISO 27001:2022 Guideline to the changes here We’d love to hear your views and comments about the ISO Show, here’s how: ●      Share the ISO Show on Twitter or Linkedin ●      Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and we read each one. Subscribe to keep up-to-date with our latest episodes: Stitcher | Spotify | YouTube |iTunes | Soundcloud | Mailing List

The updated ISO 27001:2022 has had several changes, including the addition of 11 completely new controls and the merging of 56 other controls into 24 newly titled controls.   These changes mean that anyone with a current ISO 27001:2013 certificate will be required to update and add certain elements in their existing Information Security Management System to ensure compliance to ISO 27001:2022 ahead of the October 2025 deadline. Join Mel this week as she explains the changes that need to be made, including what key documentation requires updating to align with ISO 27001:2022. You’ll learn ●      What changes need to be made to your existing Information Security Management System? ●      What key documents need to be updated? ●      How can you get a free copy of ISO 27001:2022?   Resources ●      Isologyhub ●      ISO 27001 Transition Programme ●      What you need to know to transition to ISO 27001:2022   In this episode, we talk about: [00:44] In the last episode we covered the planning stages for your transition – catch up here [01:02] We have a free ‘Guide to the ISO 27001 Changes’ available – simply fill out the form at the end of the Show Notes to download your copy [01:29] You should have a copy of ISO 27001:2022 ahead of Implementing the changes (you can get a free copy if you sign up to our Transition Programme by April 1st 2023) [01:35] Before you move onto Implementation, ensure that you have: planned back from your transition date, have an understanding of the new controls and had a Discovery session / Gap Analysis to see where the gaps in your current system are [02:11] This is also a good opportunity to revamp your Management System! We have a few older episodes to help you with this: #102, #103, #104 [02:50] What needs updating? This will include:  Your Statement of Applicability Risk Assessment Objectives Action Plans Monitoring and measurement (reviewing what you are monitoring / measuring and how it’s recorded Internal Audit Schedule / Programme – To include the new controls [03:45] At this stage you need to look at what controls you have in place – there may be some you can now merge together to reduce any paperwork involved. [04:25] We have some tools available to tackle the new controls (i.e Threat Intelligence, data masking, physical security monitoring ect) if you need some extra help [04:50] It’s not just about updating documentation, you will need to fully implement and communication these new controls to the wider business. You may find that you already have some controls covered, but not yet formalised. [05:30] The main aspect of the Implementation phase is to address the gaps found during the Gap Analysis. For example, new controls such as data masking, threat intelligence and web filtering, which you may not have considered seriously before, now need to put formal documented measures in place to address it. [06:26] Communication and evidence should be at the forefront of your mind when updating your Info Sec Management System. [06:39] Don’t just implement controls for the sake of it – considering how they are going to reduce risk and how they’re going to make a difference to improve your Risk Register and Statement of Applicability. [07:00] The Implementation phase of our Transition Programme is 1-3 days depending on your level of required support [07:54] You should also consider creating a Communication Plan to share knowledge of these changes to the wider business. Make sure you also compile any evidence of training on new elements of your Management System too. We will have Coffee Break Training available on the isologyhub which could help with this.   Grab a copy of our ISO 27001:2022 Guideline to the changes here Keep an eye out for next weeks episode where we explain how to complete your ISO 27001:2022 transition. We’d love to hear your views and comments about the ISO Show, here’s how: ●      Share the ISO Show on Twitter or Linkedin ●      Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and we read each one. Subscribe to keep up-to-date with our latest episodes: Stitcher | Spotify | YouTube |iTunes | Soundcloud | Mailing List

ISO 27001 2022 is here, which means it’s time to start thinking about starting the transition process. While the deadline is set at December 2025, we recommend making a start on planning now! If this is all news to you, check out our previous three episodes, where we reviewed all the major changes to ISO 27001, including clause updates and the 11 completely new controls added. Join Mel this week as she explains what you need to know before embarking on your ISO 27001 transition journey, in addition to a summary of our transition programme. You’ll learn ●      How to plan for your ISO 27001 transition ●      How can Blackmores help you? ●      How can you get a free copy of ISO 27001:2022?   Resources ●      Isologyhub ●      ISO 27001 Transition Programme ●      High level overview of ISO 27001 2022 Control changes     In this episode, we talk about: [00:44] Businesses have until October 2025 to transition to the updated version of ISO 27001:2022 – but don’t wait until the last minute! Certification Bodies get really booked up in the last year, and you could risk losing your certification and paying for another Stage 1 and 2 Assessment.    [01:30] We recommend that you start thinking about your transition in 2023 so you have everything in place to start the process in 2024.   [02:28] As a recap – the major changes to ISO 27001:2022 are: 56 controls have been merged into 24 newly titled controls, the addition of 11 completely new controls and controls are now categorised into just 4 groups instead of the 14 from the previous version. [03:00] ISO 27001:2022 Guide to the changes available – Simply fill out the form available at the end of the show notes to grab a copy! [04:25] Over the next few episodes, Mel will talk through the process of planning, implementing and preparation for the Certification Body transition visit. [05:51] All steps of the transition process are laid out in our Transition Programme, which includes: an awareness video, a transition action plan, Implementation of changes, Internal auditing of the changes and some optional support during the Certification Body visit.   [08:45] The Planning Phase: We recommend trying to combine your transition visit with your next Surveillance visit – you can have a chat with your CB to see if that’s possible. This may not be possible if your Surveillance is coming up very soon, as you need time to implement the changes needed. Those that have it in say 6 or more months’ time would be in a good position to make the request.    [09:30] Certification Bodies are recommending an extra half day for transition -  some may require a desktop review ahead of the actual visit. Combining this visit with your Surveillance is a good way to reduce costs. [10:30] When planning out your timescales for transition, don’t forget to inform Leadership and key personnel involved in the running of the Management System about the expected changes to come – and plan in time for them to help with the implementation. [11:10] Understanding the changes: We gave a high-level overview of the 11 new controls in our last episode. We will also have 11 Coffee Break Training courses covering the controls in more detail, available from March 31st 2023 on the isologyhub. [12:11] Offer: We’re including a free copy of ISO 27001:2022 for those that sign up to our Transition Programme before April 1st 2023. [12:34] You may get asked for a copy of the Standard at your transition visit – as having a copy can come under ‘other’ legal requirements.   [13:10] Discovery Phase: We have a transition checklist which can help you identify where the gaps are in terms of compliance with the new controls. You may already have some of it in place! Grab a copy of our ISO 27001:2022 Guide to the changes here Keep an eye out for next weeks episode where we dive into how to Implement the changes… We’d love to hear your views and comments about the ISO Show, here’s how: ●      Share the ISO Show on Twitter or Linkedin ●      Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and we read each one. Subscribe to keep up-to-date with our latest episodes: Stitcher | Spotify | YouTube |iTunes | Soundcloud | Mailing List    

ISO 27001, The Information Security Standard, was updated in October 2022. While there is a 2-year grace period for transition, we would urge everyone to make a start on implementing the changes to ensure you are compliant with latest best practice standards. Over the last two episodes, we’ve gone over the key changes and explored the specific clause updates in more detail. As mentioned in the first episode of this mini-series, there have been 11 new controls added to ISO 27001:2022. Mel is once again joined by Steve Mason, Managing Consultant here at Blackmores, to discuss the 11 new controls added to ISO 27001:2022 and their purpose.   You’ll learn What are the 11 new controls in ISO 27001:2022? Why have these been added? What is their purpose?   Resources Isologyhub NIST Cyber Essentials ISO 22301   In this episode, we talk about: [01:00] A quick overview of the key changes -  56 Controls combined into 24 newly titled controls, 11 new controls added and 58 existing controls remained unchanged.  [02:30] We have been over a few of the new controls in ISO 27002:2022 in more detail in a few previous episodes: #111, #112, #113, #114 [02:50] These new controls are nothing to worry about – they are simply aligning the Standard with more modern security considerations. You may already be complying with them! [03:32] Control A.5.7 Threat intelligence – ‘To provide awareness of the organization’s threat environment so that the appropriate mitigation actions can be taken.’ – This can come from many different sources, such as the NCSC or local police websites. There are also additional tools you can add to detect possible phishing attacks. This also includes consideration to external threats – Information Security is about much more than just protecting data! It also includes physical security. [05:33] Control A.5.23 Information security for use of cloud services – “To specify and manage information security for the use of cloud services.” – More and more businesses reply on cloud-based computing. It’s important to verify the security of your service provider to ensure it’s adequate. You can check to see if they have any valid Information Security related credentials such as CSA Star, Cyber Essentials, SOC. You could also adopt principles of ISO 27017 (certification for cloud security), ISO 27018 (Protection of PII in the public cloud) and ISO 27701 (PII security Standard). [08:30] Control A.5.30 ICT readiness for business continuity –‘ To ensure the availability of the organization’s information and other associated assets during disruption’ – There a few standards that could assist with this, including ISO 27031 (ICT readiness for Business Continuity). Those that have ISO 22301 may want to look at how ISO 27001 elements can be integrated and improved in any disaster recovery plans. ISO 27001 needs to be an integral part of any business continuity plans – not just a bolt on. Small business may not want to conduct a full business impact analysis, but should carry out a risk assessment around business continuity at the very least. [11:30] Control A.5.30 ICT readiness for business continuity – further considerations: A key focus of this part of the Standard is Recovery Time Objectives and Recovery Point Objectives. Overall, the whole business continuity aspect of the updated ISO 27001:2022 may take a bit of work to implement, but you will ultimately be much better off in the event of a disaster or security incident. For further guidance, you may want to check out an older non-certifiable standard, BS 25777 (ICT continuity). [13:20] Control A.7.4 Physical security monitoring –‘ To detect and deter unauthorized physical access.’ - This can include things like CCTV, access control, swipe cards ect. This also includes the ability and regular practice of monitoring these access methods, for the purpose of detecting any anomalies. [18:56] Control A.8.9 Configuration management – ‘To ensure hardware, software, services and networks function correctly with required security settings, and configuration is not altered by unauthorized or incorrect changes’ – Configuration for things like a firewall, software, any hardware devices, passwords ect should be documented, explained and monitored on a regular basis to ensure nothing has been changed without notifying the relevant people. ISO 20000 includes a helpful section around configuration if you require further guidance.   [21:41] Control A.8.10 Information deletion – ‘To prevent unnecessary exposure of sensitive information and to comply with legal, statutory, regulatory and contractual requirements for information deletion.’ – This already existed in the Standard, it has simply been clarified further. You will now need to prove that data has been deleted as required, if you use a 3rd party for this, they will need to provide the relevant certificates.   [22:05] Control A.8.11 Data Masking – ‘To limit the exposure of sensitive data including PII, and to comply with legal, statutory, regulatory and contractual requirements.’ – You have 3 options for data masking: Obfuscation, pseudonymisation and annoymisation. This also helps to comply with GDPR requirements. [24:10] Control A.8.12 Data leakage prevention – ‘To detect and prevent the unauthorized disclosure and extraction of information by individuals or systems.’ – This control has made a return from the 2005 version of ISO 27001. Businesses should have systems in place to monitor any particularly large data downloads – or even possibly large print batches. You should also ensure that you have a secure email system in place as well as VPN’s and regular security training to sure up your security to prevent any potential leaks. [27:00] Control A.8.16 Monitoring Activities  – ‘To detect anomalous behaviour and potential information security incidents.’ – Appropriate monitoring should be in place to detect any potentially dangerous or malicious behavior.   [28:00] Control A.8.23 Web Filtering  – ‘To protect systems from being compromised by malware and to prevent access to unauthorized web resources.’ – Your systems should be set up in a way to prevent people from accessing unsecure or unsavory sites. This could include Social Media sites – but be mindful that there may have to be exceptions for marketing or communications personnel for those particular sites. [28:00] Control A.8.28 Secure Coding – ‘To ensure software is written securely thereby reducing the number of potential information security vulnerabilities in the software.’ – If you have created your own secure coding, be sure to evaluate it against industry professional standards such as OWASP and NIST.   As a reminder, we’ll be running a mini-series through January and February on the updated ISO 27001:2022 in addition to how you can transition to the new version. Keep an eye out for next weeks episode where we dive into the clause clarifications and control changes of ISO 27001:2022… We’d love to hear your views and comments about the ISO Show, here’s how: Share the ISO Show on Twitter or Linkedin Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and we read each one. Subscribe to keep up-to-date with our latest episodes: Stitcher | Spotify | YouTube |iTunes | Soundcloud | Mailing List

As many of you are aware, an updated version of ISO 27001 was published in October 2022. While there is a 2-year grace period for transition, we would urge everyone to make a start on implementing the changes to ensure you are compliant with latest best practice standards. But where do you start? In the last episode, Mel and Steve gave an overview of the updated ISO 27001:2022, including a high-level look at some of the key changes. In addition to the control changes, there have been several changes made to specific clauses within the Standard. Mel is once again joined by Steve Mason, Managing Consultant here at Blackmores, to discuss the ISO 27001:2022 clause updates and their purpose. You’ll learn What clauses have been updated from the 2013 version of ISO 27001? Why have these clauses been updated?   Resources Isologyhub NIST Cyber Essentials ISO 9001   In this episode, we talk about: [01:06] The changes to these clauses appear to align your Management System with the business more so than in the previous iteration of ISO 27001 – a key focus is integration.  [01:20] First change: Clause 4.2 Understanding the needs and expectations of Interested parties – ‘c) which of these requirements will be addressed through the information security management system.’ - This seeks to align the Management System with interested parties and identify where it may or may not be able to meet their needs and expectations. [03:30] Clause 4.4 Information Security Management System – ‘The organization shall establish, implement, maintain and continually improve an information security management system, including the processes needed and their interactions, in accordance with the requirements of this document.’ – There will be more focus on process flows and not Policies and Procedures. This can be further used to align the Management System with your business, by clearly identifying where it fits in with your business activities.  [06:14] Clause 5.1. Leadership – ‘Reference to “business” in this document can be interpreted broadly to mean those activities that are core to the purposes of the organization’s existence.’ – This acts more as a reminder to top management to ensure they include the Management System as part of the business and not just a bolt-on. It should be a part of the strategy and part of the business (part of the ship, part of the crew) [07:42] Clause 6.1.3  Information Security Risk Treatment –‘ Note 2 in sub-clause ‘c’ now states ‘Annex A contains a list of possible information security controls.’ (it had previously read Annex A contains a comprehensive list of control objectives and controls.) – This simply means that you can add references to other controls outside of the list provided within Annex A i.e. NIST or Cyber Essentials. Though, do be careful to avoid doing this at minutia level, as that just increases Management System maintenance. [09:15] Clause 6.2  Information security objectives and planning to achieve them –‘ A couple of extra points have been added to this clause: d) be monitored g) be available as documented information’  - The monitoring was previously a given, but not really specified. So now, you’ll have to demonstrate how you’re monitoring objective planning and achievements. [10:24] Clause 6.3 Planning of Changes – ‘When the organization determines the need for changes to the information security management system, the changes shall be carried out in a planned manner.’ – This has now been aligned more with ISO 9001’s approach to changes. All changes should be planned before implementation, and this now includes information security consideration. Fun fact – they forgot to include this clause in the Standard table of contents! (as of January 2023, this will probably be added later!) [11:55] Clause 9.3.2  Management Review Inputs –‘ c) changes in needs and expectations of interested parties that are relevant to the information security management system’ – This just ensures that the needs and expectations of your Interested Parties are reviewed and not just left stagnant. [13:20] To help you revamp your Management Review, check out episodes #99 and #100 As a reminder, we’ll be running a mini-series through January and February on the updated ISO 27001:2022 in addition to how you can transition to the new version. Keep an eye out for next weeks episode where we dive into the clause clarifications and control changes of ISO 27001:2022… We’d love to hear your views and comments about the ISO Show, here’s how: Share the ISO Show on Twitter or Linkedin Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and we read each one. Subscribe to keep up-to-date with our latest episodes: Stitcher | Spotify | YouTube |iTunes | Soundcloud | Mailing List

The long-awaited update of ISO 27001 arrived in October 2022, having gone 9 years since its previous 2013 iteration. Needless to say, it was much overdue. The new 2022 version of the Standard includes 11 new controls and sees around 56 other controls combined into 24 newly titled controls. In order to cover every aspect of the new Standard, we’ll be running a mini-series through January and February on the updated ISO 27001:2022 in addition to how you can transition to the new version. Starting off the series strong, Mel is joined once again by Steve Mason, our very own Information Security guru, to broadly discuss the changes to ISO 27001:2022. You’ll learn Who is ISO 27001:2022 applicable to? An overview of the changes to ISO 27001:2022 What is Steve’s favorite change to ISO 27001:2022? What are the challenges involved with updating to the 2022 version?   Resources Isologyhub ISO 27031 (Guidelines for information and communication technology readiness for business continuity) ISO 27005 (Risk assessment) ISO 22301 (Business Continuity)   In this episode, we talk about: [01:50] Steve Gives an overview of what’s new in ISO 27001:2022 – The updated version of ISO 27001 was released on the 26th Oct 2022. The new version included 24 changes and clarifications within the main clauses.  [02:50] The controls for the new standard are now categorised into 4 groups: Organisation, People, Physical and Technology   [05:50] We covered some of the new controls in more detail in previous episodes: #109, #110, #111, #112, #113 and #114 [06:17] The 24 changes and clarifications to Clauses include older existing clauses which have been tidied up to be more transparent. We recommend reviewing to ensure that you are complying in a way that aligns with the Standard. [06:35] There are 11 new Controls. 56 controls from the 2013 version have been reduced to 24 with 58 remaining unchanged. So, in short, Annex A has been simplified with less duplication of controls. [07:44] Steve highlights section A.9 for Access Control as one of the much-improved controls – due to the lack of repetition and simplified requirements for compliance. [08:35] Steve’s favourite update to the Standard: The whole Standard now collectively encourages incorporation into your business. Your ISMS should not feel like a bolt on, it should be a part of your businesses DNA. [10:36] Steve’s favourite update to the Standard #2: It’s not a static Standard, it encourages development and continual improvement.   [13:45] For those completely new to ISO 27001 – check out our 3-part Steps to Success series which explains the Implementation process from start to finish. [14:38] Listen to some of our client interviews to hear the challenges others faced when Implementing ISO 27001 in addition to the benefits gained as a result of adopting the Standard:    [14:50] Why would the business continuity elements of ISO 27001:2022 pose a challenge?  There used to be a clause in the 2005 version of the standard which documented the need for a business impact analysis – this was removed in the 2013 version. The new ‘ICT readiness for business continuity’ control will require at the very least, a risk assessment.    [16:48] Steve recommends checking out the Plan, Do, Act, Check diagram in ISO 27031 (Guidelines for information and communication technology readiness for business continuity). It also includes some great guidance on business impact analysis. [18:40] The ICT readiness control is not designed to be an all encompassing business continuity strategy – it’s designed to work in tandem with as existing one (you may already be certified to ISO 22301 Business Continuity Management).  [19:50] It’s highly recommended that if you don’t have a Business Continuity Plan or strategy – at least have a framework in place. Disasters by their nature are unpredictable, as is the resulting damage to an extent. You will not know the full extent until you’ve lived it – so don’t write an exhaustive 80+ page manual that no-one will read, document the what, who and how of getting yourself back up and running again. [21:11] There has also been an update to ISO 27005 (Risk assessment in relation to info sec). It includes a new set of threat categories: physical threats, natural threats, infrastructure failures, technical failures, human actions, compromised services or functions and organisational threats. These may help you when putting a business continuity framework in place. [22:05] Above all else – ISO 27001:2022 has modernised and aligned itself more with the likes of cyber essentials and NIST. Keep an eye out for next weeks episode where we dive into the clause updates… We’d love to hear your views and comments about the ISO Show, here’s how: Share the ISO Show on Twitter or Linkedin Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and we read each one. Subscribe to keep up-to-date with our latest episodes: Stitcher | Spotify | YouTube |iTunes | Soundcloud | Mailing List

Happy New Year! We at Blackmores hope you all managed to have a break over the holiday season and are gearing up for many challenges and successes in 2023. As a reminder, we signed off last year by highlighting the top 5 podcasts as dictated by you, the listeners. Before we dive into a brand-new year full of top tips, expert advice with industry leaders and client interviews, we’d like to take a step back and let the host share her reflections on 2022. Join Mel as she shares her personal top 5 ISO Show episodes from last year.    You’ll learn What are Mel’s top 5 episodes of 2022?   Resources ISO Show Archive Isologyhub   In this episode, we talk about: [00:30] A reminder to listen to our last podcast, covering the top 5 podcasts as dictated by the listeners. [01:21] #1 Episode 102 – What’s in a name? This episode features our Senior Isologist, Sarah Ball, as she explains the importance of giving a meaningful name to your Management System.  [03:40] What’s in a Name snippet – Full episode available in the ISO Show Archive    [08:01] #2 Episode 94 – The 7 Steps of Carbonology_ Reduce – Part 4 of the 7 Steps of Carbonology series, featuring our Carbonologist, David Algar. This episode delves into the creation and communication of a carbon reduction plan, and the benefits of reducing your footprint rather then relying on offsetting alone. [10:14] The 7 Steps of Carbonology - Reduce snippet – Full episode available in the ISO Show Archive    [16:48] #3: Episode 117 PMC’s journey and ongoing success with ISO 27001– This is an interview with Philip Bailey, the Managed Services Director at PMC Retail, talking about their ISO 27001 journey. Philip shares his lessons learned and gives some top tips for anyone considering implementing the Information Security Standard   [17:58] PMC’s journey and ongoing success with ISO 27001 snippet – Full episode available in the ISO Show Archive  [24:00] #4: Episode 100 How to get the most out of your Management Review – Featuring Rachel Churchman, Managing Consultant here at Blackmores, this episode explores how added value can be gained from doing a Management Review. Mel and Rachel discuss various ways you can conduct a Management Review and what should be your key inputs and outputs.    [26:14] How to get the most out of your Management Review snippet – Full episode available in the ISO Show Archive    [30:41] #5: Episode 108 How to align your Management System with the Sustainable Development Goals– Following on from the Sustainable Development Goals summary episodes, Mel shares how you can align your Management System right now without the need for any ISO certification.   [32:37] How to align your Management System with the Sustainable Development Goals snippet – Full episode available in the ISO Show Archive  We look forward to bringing you even more amazing content in 2023, so stay tuned! 😊 We’d love to hear your views and comments about the ISO Show, here’s how: Share the ISO Show on Twitter or Linkedin Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and we read each one. Subscribe to keep up-to-date with our latest episodes: Stitcher | Spotify | YouTube |iTunes | Soundcloud | Mailing List