Information security with a system
Demonstrable data and information security
Security as part of the corporate culture
Effective implementation of a risk management process
Continuous improvement of your security level
Loading...
What is ISO 27001?
Information surrounds us everywhere and is part of every process. Sometimes it may be inconsequential, but all too often it is critical and confidential. In order to make this important distinction for your organisation, it is necessary to classify information. This is because the protective measures of an Information Security Management System (ISMS) according to ISO 27001 are based on this classification.
An ISMS creates the framework for protecting operational data and its confidentiality. At the same time, the globally recognised standard ensures the availability of the IT systems involved in corporate processes. In this context, ISO 27001 certification in Australia and New Zealand sends a strong signal to the market: namely, independent external evaluation and confirmation of the effectiveness of your ISMS.
Show more
Show less
Loading...
Who is certification to ISO 27001 suitable for in Australia and New Zealand?
Increasingly, governments and other critical industries are requiring their partners and any business accessing their data, to provide evidence of how they ensure their information security. Internationally recognised standards such as ISO 27001 can be an effective tool to help protect critical information and ensuring you have a system to manage data security and as a framework which sits around ISM control frameworks. Both Australia and New Zealand governments have introduced Cyber Security frameworks including Information Security Manuals - Australian here: https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/ism and New Zealand here: https://www.ncsc.govt.nz/resources/ncsc-cyber-security-framework/.
Show more
Show less
Loading...
What makes the ISO 27001 standard useful for my company?
Annex A of ISO 27001, which is to be used in connection with section 6.1.3 on the basis of company-specific risk analyses, is particularly valuable in practice. The information security controls listed in Annex A are directly derived from and aligned with the measures listed in the current ISO 27002, Sections 5 to 8.
The consistent alignment of company processes with ISO 27001 has been proven to lead to a number of benefits:
- Continuous improvement of the security level
- Reduction of existing risks
- Adherence to compliance requirements including regulatory requirements in Australian and New Zealand
- Greater awareness among employees
- Increased customer satisfaction
Internal audits and management reviews with the participation of top management are the internal levers for achieving this.
Other positive aspects are that interested parties such as supervisory authorities, insurance companies, banks, partner companies build up a higher level of trust in your company. This is because a certified management system signals that your organisation deals with risks in a structured manner and subscribes to continuous improvement (CIP), making it more resistant to unwanted influences.
The international standard ISO/IEC 27001 can also be implemented, operated and certified independently of other management systems such as ISO 9001 (quality management) or ISO 14001 (environmental management).
Show more
Show less
Loading...
Who is allowed to carry out certification according to ISO 27001?
In addition, ISO/IEC 27006 defines strict requirements that certification bodies must comply with in order to certify an ISMS according to ISO 27001.
These include:
- Evidence of specified audit effort
- Requirements for the qualification of auditors.
DQS Australia New Zealand is accredited by the national German accreditation body DakkS (Deutsche Akkreditierungsstelle GmbH) and therefore authorised to perform audits and certifications according to ISO 27001.
Regardless of the industry in which your company operates, you can rely on the distinctive expertise of the DQS auditors in Australia and New Zealand. They have many years of experience in the assessment of information security management systems in various industries.
Show more
Show less
Loading...
ISO 27001 has Changed
An update to ISO 27001 was published in October 2022 to reflect the changes associated with the increased digitisation of the organisations. The changes include a consolidation and simplification of how organisations can map controls for different stakeholders.
As part of the update, the standard has some changes to reflect the "harmonised" structure of ISO standards. Additionally, the information security controls in Annex A of ISO 27001, have been modernised. There are now 4 categories of controls, containing 93 controls, of which 58 have been updated or modified, 24 have been merged from ISO 27001:2013 and 11 new controls introduced.
By adopting these changes, you will be bringing your organisation up to date with the latest global standard for Information Security, better protecting and building trust in your organisation and everyone you interact with.
The revision is an inevitable consequence after ISO/IEC 27002, as the implementing guidance governing Annex A of ISO 27001, was comprehensively revised and published in February 2022.
The transition period for existing ISO 27001 certificates is three years from the last day of the publication month of the new ISO 27001:2022, meaning that all certificates according to ISO 27001:2013 must have been converted to the 2022 version of ISO 27001 by October 31, 2025, You can read about the new features of the ISO 27001 update in our article "The new ISO/IEC 27001:2022 - key changes".
Show more
Show less
Loading...
More Resources
Loading...
How does ISO 27001 certification work in Australia and New Zealand?
Once all requirements of ISO 27001 have been implemented, you can have your management system certified. You will go through a multi-stage certification process with DQS Australia / New Zealand. If a certified management system is already established in the company, the process can be shortened.
In the first step, you discuss your company and the goals of ISO 27001 certification with us. On this basis, you will receive a detailed offer tailored to the individual needs of your company.
A project planning meeting can be useful for larger projects, for example, to better coordinate schedules and the performance of audits with multiple locations or divisions. The pre-audit offers you an opportunity to identify the strengths and potential for improvement of your management system in advance. Both of these services are optional.
The certification audit starts with the system analysis and evaluation of your ISMS (audit stage 1). Here, your auditor determines whether your management system is sufficiently developed and ready for certification. In the next step (system audit stage 2), your auditor assesses the effectiveness of all management processes on site, applying the ISO 27001 standard. The audit result is presented at a final meeting. If necessary, action plans are agreed upon.
After the certification audit, the results are evaluated by the independent certification board of DQS. If all requirements of the standard are met, you will receive the ISO 27001 certificate.
After successful certification, key components of your ISMS are re-audited on site at least once a year to ensure continuous improvement.
An ISO 27001 certificate is valid for a maximum of three years. Recertification is performed in good time before expiry to ensure ongoing compliance with the applicable requirements of the standard. Upon successful completion of the recertification audit, a new certificate is issued.
Transition from ISO 27001:2013 to ISO 27001:2022 requires a transition audit to assess that the changes have been effectively implemented. This can be completed during the surveillance or recertification cycle, with the addition of minimal time, or scheduled as a separate upgrade audit if necessary. Once the transition audit is successfully completed the certificate is updated. The expiration of the current certification cycle will not be changed.
Loading...
What does ISO 27001 certification cost in Australia and New Zealand?
The four assessment criteria
The costs for certification according to ISO 27001 are established according to the following four criteria, among others:
1. The complexity of your information security management system.
The critical values (for example patents, personal data, facilities, processes) of your company are taken into account. The cost of certification is based primarily on the information security requirements and the extent to which confidentiality, integrity and availability (CIA) of information are affected.
2. The core business of your company within the scope of the ISMS
At this point, the risks associated with your business processes in particular play an important role in determining the necessary audit effort. Legal requirements are taken into account as well as complex, individual customer requirements.
3. The main technologies and components used in your ISMS
During the audit, the technology as well as the individual components of your ISMS are examined. These include IT platforms, servers, databases, applications as well as network segments. The basic rule here is: The higher the proportion of standard systems and the lower the complexity of your IT, the lower the effort. The costs of an ISO 27001 certification also depend on this.
4 The proportion of in-house developments in your ISMS
If there is no internal development and you mainly use standardised software platforms, the effort of an assessment is lower. If your ISMS is characterised by intensive use of self-developed software and if this software is used for central business areas, the effort for certification will be higher.
In order for us to be able to give you an overview of the costs for an ISMS certification, we need precise information about your business model and the area of application in advance. This way we can provide you with a tailor-made offer.
Show more
Show less
Loading...
Why DQS Australia / New Zealand
The new ISO 27001:2022 - key changes
In this DQS blog post you will find the most important information about the key changes and additions in the revised ISO 27001:2022 standard.