ISO 27001 Aligned: What Large Organisations Now Expect From Their IT Partners

Large organisations increasingly want IT partners who work to a recognised standard for cybersecurity. Here is what ISO 27001 is, what being aligned means, and what to ask an IT partner.

What we keep hearing

Over the last 12 months we have heard the same thing from large organisations, most recently in a meeting with a blue-chip multinational. They want IT partners who work to a recognised global standard for cybersecurity and network configuration. Few IT service companies in the UAE operate to one, and business is being lost because of it.

What ISO 27001 is

ISO/IEC 27001 is the international standard for an information security management system: the policies, risk assessments and controls an organisation uses to protect information. The current edition, ISO/IEC 27001:2022, lists 93 controls in its Annex A, grouped into four themes: organisational, people, physical and technological.

Certified or aligned?

Certification means an accredited body has audited the organisation against the standard and issued a certificate. Being aligned means the organisation works to the standard's requirements and controls without holding a certificate.

OPS IT Infrastructure is ISO 27001 aligned. We are not certified, and we say so.

What it looks like in practice

For us, working to the standard includes:

• multi-factor authentication on every account, with administrator accounts kept separate from day-to-day accounts;
• conditional access and encrypted laptops;
• our own data hosted in the UAE, backed up in the UAE, with restores tested;
• confidentiality agreements signed by every member of staff and every subcontractor;
• security requirements, breach notification and right to audit written into supplier agreements;
• a written security incident response procedure and a risk register reviewed by management;
• security awareness training for our team.

What to ask an IT partner

1. Do you work to a recognised standard, and are you certified or aligned?
2. How do your engineers access our systems, and is every change recorded?
3. Who else (subcontractors, offshore support) can reach our environment, and under what agreements?
4. What happens, and who tells us, if there is a security incident?

Sources

• ISO/IEC 27001 controls explained: a guide to Annex A (Secureframe)

Full transcript

Morning guys, Andrew from OPS here, just came out of a really really stellar meeting with a blue chip multinational company and we're hearing things from them that we've been hearing over the last 12 months but now I think it's time for us to pay attention. It seems that there's not a lot of IT service companies here in the UAE that are operating to the ISO framework of compliance structures. What that basically means is business is walking out of the door because companies are looking for a higher level of global standard when it comes to cyber security and network configuration and there doesn't seem to be anyone here who is rising to the standard in the numbers that the market requires and so if you are looking for an ISO 27001 aligned organisation, look no further, reach out to me, we'd be more than happy to talk about how we can help you with your global standardization goals.