Information security with a system
在數字化轉型的過程中,“資訊安全”這個話題對企業來說越來越緊迫。如果沒有足夠的安全預防措施,則存在數據丟失和黑客竊取數據、網絡攻擊或數據濫用導致業務崩潰的風險。結構化方法的一個選項是根據 ISO 27001 的資訊安全管理系統 (ISMS)。
什麼是 ISMS?
ISMS 是一種管理組織的敏感信息以確保其安全的系統方法。它應用風險管理流程,包括人員、流程和 IT 系統。
它可以幫助任何行業的小型、中型和大型企業保持信息資產的安全。
ISO 27001 如何運作?
大多數組織都有一些資訊安全控制措施。然而,如果沒有資訊安全管理系統 (ISMS),控制往往會有些雜亂無章和脫節,通常作為針對特定情況的點解決方案來實施,或者只是作為慣例而實施。
運作中的安全控制通常專門針對資訊科技 (IT) 或數據安全的某些方面;使非 IT 信息資產(如文書工作和專有知識)總體上受到較少保護。
此外,業務連續性管理和物理安全的管理可能完全獨立於 IT 或資訊安全,而人力資源實踐可能很少提及在整個組織中定義和分配信息安全角色和職責的需要。
ISO/IEC 27001 要求管理層:
- 考慮威脅、漏洞和影響,系統地評估組織的資訊安全風險;
- 建立並實施一套全面的資訊安全控制和風險處理(例如風險規避、降低或轉移),以解決那些被認為不可接受的風險;和
- 採用管理過程以確保資訊安全控制和殘餘風險持續滿足組織的資訊安全需求。
Demonstrable data and information security
Information security as part of the corporate culture
Effective implementation of a risk management process
Continuous improvement of your security level

What is ISO 27001?
ISO/IEC 27001 規定了在組織範圍內建立、實施、維護和持續改進信息安全管理系統的要求。它還包括根據組織需要對信息安全風險進行評估和處理的要求。
ISO 27000 系列標準可幫助組織保持信息資產的安全。使用這一系列標準將幫助您的組織管理資產的安全性,例如財務信息、知識產權、員工詳細信息或第三方委託給您的信息。 ISO 27001 是該系列中最廣泛應用的標準,為資訊安全管理系統 (ISMS) 提供了要求。
ISO/IEC 27001 是實施信息安全整體管理系統的領先國際標準。它側重於識別、評估和管理信息處理過程的風險。機密信息的安全性被強調為一項重要的戰略要素。

Who is a certification to ISO 27001 suitable for?
誰適合 ISO 27001 認證?
ISO 27001 資訊安全管理系統標準適用於全球。它為各種規模和行業的公司提供了規劃、實施和監控其信息安全的框架。 ISO/IEC 27001:2013 或 ISO/IEC 27001:2022中規定的要求是通用的,旨在適用於所有組織,無論其類型、規模或性質如何。
實際上,有些人可能認為 ISO 27001 只能應用於 IT 部門,但這是一種誤解。毫無疑問,IT 行業的公司可能容易受到規模可擴展的數據洩露的影響。因此,不少 IT 密集型運營企業率先申請 ISO 27001 認證。
隨著時間的推移,越來越多的其他行業的公司意識到信息安全對他們來說同樣重要,因此他們也開始針對 ISO 27001 進行信息安全管理體系 (ISMS) 認證。
資訊無處不在,是每個過程的一部分。有時它可能無關緊要,但它往往是關鍵和機密的。為了為您的組織做出這一重要區分,有必要對信息進行分類。這是因為根據 ISO/IEC 27001 的資訊安全管理系統 (ISMS) 的保護措施基於此分類。
ISMS 創建了保護操作數據及其機密性的框架。同時,全球公認的標準確保了企業流程中涉及的 IT 系統的可用性。在這種情況下,ISO 27001 認證向市場發出了強烈的信號:即獨立的外部評估和確認您的 ISMS 的有效性。
如何使用 ISO 27001?
本標準旨在為建立、實施、維護和持續改進信息安全管理體系提供要求。採用信息安全管理系統是組織的戰略決策。
信息安全管理體系通過應用風險管理過程來保持信息的機密性、完整性和可用性,並使相關方相信風險得到了充分管理。
本國際標準可供內部和外部各方使用,以評估組織滿足組織自身信息安全要求的能力。
ISO 27001 ISMS 認證
越來越多的組織採用 ISO/IEC 27001 認證,以便從其中包含的最佳實踐中受益,從而使客戶和客戶確信其建議已得到遵循。
ISO 27001標準的正式名稱是“信息技術——安全技術——信息安全管理系統——要求”。
ISO/IEC 27001 有10個條款和1個附件,包括:
- 標準範圍
- 如何引用文檔
- 重複使用 ISO/IEC 27000 中的術語和定義
- 組織環境和利益相關者
- 信息安全領導力和對政策的高層支持
- 規劃信息安全管理系統;風險評估;風險處理
- 支持信息安全管理體系
- 使信息安全管理系統運行
- 審查系統的性能
- 糾正措施
附件 A:控制清單及其目標

What makes the ISO 27001 standard useful for my company?
什麼使 ISO 27001 標準對我的公司有用?
根據 ISO/IEC 27001 引入 資訊安全管理體系是貴公司的戰略決策。標準的一般要求的實現必須反映公司的具體情況。公司的實施取決於需求和目標、安全要求和組織流程,以及公司的規模和結構。
對實踐特別有價值的是標準附錄 A 中措施的實施。除了面向管理系統的要求部分(第 4 章至第 10 章)外,ISO 標準還包含 35 個措施目標(控制)的詳盡列表,其中包含 114 項具體措施,涉及附件 A 中的 14 個章節中的各種安全方面。措施必須在管理系統的框架內實施。這些措施必須作為管理系統的一部分實施,只要它們與您的公司相關。
事實證明,公司流程與 ISO 27001 保持一致可帶來許多好處:
- 安全等級持續提升
- 降低現有風險
- 遵守合規要求
- 提高員工的意識
- 提高客戶滿意度
高層管理人員參與的內部審核和管理評審是實現這一目標的內部有效槓桿。
其他積極方面是監管機構、保險公司、銀行、合作夥伴公司等利益相關方對貴公司建立了更高水平的信任。這是因為經過認證的管理體系表明您的組織以結構化的方式處理風險並支持持續改進,從而使其更能抵抗不必要的影響。
國際標準 ISO/IEC 27001 也可以結合或獨立於 ISO 9001(質量管理)等其他管理體係來實施、操作和認證。

Who is allowed to carry out certification according to ISO 27001?
誰可以根據 ISO 27001 提供認證服務?
為了認證信息安全管理體系,相應的認證機構本身必須獲得 ISO/IEC 17021 和 ISO/IEC 27006 的認可。ISO/IEC 17021 規定了與合格評定相關的主題,特別是對審核和認證管理的檢查機構的要求系統。此外,ISO/IEC 27006 定義了認證機構必須遵守的嚴格要求,以便根據 ISO 27001 認證 ISMS。這些包括:
- 特定審核工作的證據;
- 對審核員資格的要求。
DQS 已獲得國家認可機構 ANAB 和 DAkkS 的認可,因此獲得授權根據 ISO 27001 進行審核和認證。
無論您的公司在哪個行業運營,您都可以依賴 DQS 審核員的獨特專業知識。他們在各個行業的信息安全管理系統評估方面擁有多年的經驗。
與 ISO 27701:2019 隱私資訊管理系統標準的關係
ISO 27701:2019 是 ISO 27001 和 ISO 27002 的擴展,用於隱私資訊的管理。
如果個人數據管理對您的業務很重要,您可以考慮同時申請 ISO 27701 PIMS 認證和 ISO 27001 ISMS 認證,以應對歐盟 GDPR、美國的CPRA、香港的PDPO、中國大陸的 個人信息保護法 等大量隱私資訊相關法規帶來的重大風險和挑戰。

ISO 27001 vs ISO 27002
ISO 27001 vs ISO 27002
- ISO 27001 規定了在組織範圍內建立、實施、維護和持續改進資訊安全管理系統 (ISMS) 的要求。
- ISO 27002 是一個用作選擇和實施 ISO 27001 附件 A 中列出的資訊安全控制措施的參考的國際標準。它被用作資訊安全管理最佳實踐的參考和指導,幫助組織實施信息安全管理的要求和控制措施。 ISO 27001。
- 組織可以獲得 ISO 27001 認證,但不能獲得 ISO 27002 認證。
ISO 27002 於 2022 年 2 月 15 日更新。信息安全控制的數量從 114 個控制減少到 93 個控制,涵蓋 4 個部分,而不是之前版本的 14 個部分。
- 組織控制(第 5 條)
- 人員控制(第 6 條)
- 物理控制(第 7 條)
- 技術控制(第 8 條)
合併的控制项目
ISO 27002:2022 未排除先前版本中的任何控制,但其中一些已被合併。
例如:
- 控制 5.1.1 信息安全政策 和 5.1.2 信息安全政策審查 併入 5.1 信息安全政策。
- 控制 11.1.2 物理進入控制 和 11.1.6 交付和裝載區域 併入 7.2 物理進入。
新控制项目
ISO 27002:2022 引入了 11 項新控制:
- 5.7 威脅情報
- 5.23 使用雲服務的信息安全
- 5.30 確保業務連續性的ICT準備
- 7.4 物理安全監控
- 8.9 配置管理
- 8.10 信息刪除
- 8.11 數據屏蔽
- 8.12 數據洩露防護
- 8.16 監測活動
- 8.23 網頁過濾
- 8.28 安全編碼
ISO 27002:2022 引入了兩個附件:
- 附錄 A – 使用屬性
- 附錄 B – 與 ISO/IEC 27002:2013 的對應關係
ISO 27002:2022 對 ISO 27001 的影響
ISO 27001:2013的修訂已經在進行,並將於2022年發布ISO 27001:2022。
- ISO 27002:2022 的變更將反映在 ISO 27001 的附錄 A 中;
- ISO 27001 的主要部分(即第 4 至 10 條)將基本保持不變;
- 控制數量從 114 減少到 93;
- 控件分為 4 個部分,而不是之前的 14 個;
- 新增11個控件,沒有刪除任何控件,合併了一些控件。

Relations Between GDPR and ISO 27001 ISMS
Introduction to GDPR
The General Data Protection Regulation (GDPR), EU’s new regulation for data protection will become effective from 25 May 2018. The GDPR applies to the handling of personal identification information of EU citizens. It not only applies to the organizations in EU, but also to the organizations, out of EU, processing and keeping above mentioned personal data.
The local organizations shall have a full and serious review on its practice in the handling of personal data in its business operation. Significant changes may be necessary to the operation related to personal data, from collection, storage, identification, analysis, usage, transferring, etc.
Depending on the impact and its due diligence, the offending organization to GDPR may be subject to a fine up to the higher amount of EUR 20,000,000 and 4% of its annual global revenue.
Key Terms in GDPR:
- Personal data: “Any information that relates to an identified or identifiable living individual.”
- Data controller: “The entity that determines the purposes, conditions and means of the processing of personal data.”
- Data processor: “An entity which processes personal data on behalf of the controller.”
Key Requirements of GDPR
As compared to Directive 95/46/EC, the requirements are enhanced. The key points include, but are not limited to:
- Territorial scope: Not limited to organizations within EU.
- Purpose limitation: Collected for specified, explicit and legitimate purpose.
- Data minimization: Adequate, relevant and limited to what is necessary in relation to the purpose.
- Accuracy: Accurate and, where necessary, kept up to date.
- Storage limitation: Kept in a form which permits identification of data subjects for no longer than is necessary.
- Integrity and confidentiality: Processes in a manner to ensure security.
- Conditions for consent: Organizations must request permission using easy-to-understand terms. Assuming consent or requiring users to opt out is not allowed.
- Right to access: Increased transparency by requiring controllers to provide data subjects with confirmation of data processing.
- Right to be forgotten: Data subjects can request controllers to erase their personal data and stop distributing the data.
- Automated processing: Data subject have right not to be subject to a decision solely on automated processing.
- Data portability: Data subjects have right to receive their data upon request and to transfer that data to another controller.
- Data protection officers: Some organizations, such as those with a primary purpose for processing personal data or sensitive information, shall appoint Data Protection Officer(s) — an employee or a third party.
- Data breach notification: Within 72 hours after a data breach, the controller shall notify supervisory authorities and data subjects affected, “unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons.” Data processors shall also inform the controllers for a known data breach.
- Parental consent: Processing the personal data of children under age of 16 for online services shall obtain parental consent. Member states can designate a lower required age (down to 13) for consent.
- Special categories of data: Some types of data have more stringent requirements for consent, such as the data that reveals “racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation.”
- Third countries: Specific rules for transferring data to third countries or international organizations.
- Due diligence: Establish technical and organizational measures to demonstrate compliance to GDPR.
- Subcontractor Control: Data Controllers shall ensure Data Processors have ability to fulfil the requirements of GDPR.
- Certification: Voluntary data protection certification to show compliance to this regulation.

How does ISO 27001 certification work?
Once all requirements of ISO 27001 have been implemented, you can have your management system certified. You will go through a multi-stage certification process at DQS. If a certified management system is already established in the company, the process can be shortened.
In the first step, you discuss your company and the goals of ISO 27001 certification with us. On this basis, you will receive a detailed offer tailored to the individual needs of your company.
A project planning meeting can be useful for larger projects, for example, in order to better coordinate schedules and the performance of audits with multiple locations or divisions. The pre-audit offers you an opportunity to identify the strengths and potential for improvement of your management system in advance. Both services are optional.
The certification audit starts with the system analysis and evaluation of your ISMS (audit stage 1). Here, your auditor determines whether your management system is sufficiently developed and ready for certification. In the next step (system audit stage 2), your auditor assesses the effectiveness of all management processes on site, applying the ISO 27001 standard. The audit result is presented at a final meeting. If necessary, action plans are agreed upon.
After the certification audit, the results are evaluated by the independent certification board of DQS. If all standard requirements are met, you will receive the ISO 27001 certificate.
After successful certification, key components of your ISMS are re-audited on site at least once a year to ensure continuous improvement.
The ISO 27001 certificate is valid for a maximum of three years. Recertification is performed in good time before expiry to ensure ongoing compliance with the applicable standard requirements. Upon compliance, a new certificate is issued.
Please refer to below blog about the arrangement of transition to the new standard ISO/IEC 27001:2022:
https://www.dqsglobal.com/en-hk/blog/hk/publication-of-iso-iec-27001-2022

What does ISO 27001 certification cost?
The costs for certification according to ISO 27001 are established according to the following four criteria, among others:
1. The complexity of your information security management system.
The critical values (for example patents, personal data, facilities, processes) of your company are taken into account. The cost of certification is based primarily on the information security requirements and the extent to which confidentiality, integrity and availability (VIV) of information are affected.
2. The core business of your company within the scope of the ISMS
At this point, the risks associated with your business processes in particular play an important role in determining the necessary audit effort. Legal requirements are taken into account as well as complex, individual customer requirements.
3. The main technologies and components used in your ISMS
During the audit, the technology as well as the individual components of your ISMS are examined. These include IT platforms, servers, databases, applications as well as network segments. The basic rule here is: The higher the proportion of standard systems and the lower the complexity of your IT, the lower the effort. The costs of an ISO 27001 certification also depend on this.
4 The proportion of in-house developments in your ISMS
If there is no internal development and you mainly use standardized software platforms, the effort of an assessment is lower. If your ISMS is characterized by intensive use of self-developed software and if this software is used for central business areas, the effort for certification will be higher.
In order for us to be able to give you an overview of the costs for an ISMS certification, we need precise information about your business model and the area of application in advance. This way we can provide you with a tailor-made offer.

What you can expect from us
Training Courses
Internal Auditor Courses, Lead Auditor Courses, Standard Understanding Courses, GDPR related Courses, etc.