ISO 27001:2007 Certification Service Orissa

ISO/IEC 27001:2013part of the growing ISO/IEC 27000 family of standards, is an information security management system (ISMS) standard published in September 2013 by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC). Its full name is ISO/IEC 27001:2013 – Information technology – Security techniques – Information security management systems 

ISO/IEC 27001:2013 formally specifies a management system that is intended to bring information security under explicit management control. Being a formal specification means that it mandates specific requirements. Organizations that claim to have adopted ISO/IEC 27001 can therefore be formally audited and certified compliant with the standard

The standard contains 11 domains (apart from introductory sections):

  1. 1. Security policy - management direction
  2. 2. Organization of information security - governance of information security
  3. 3. Asset management - inventory and classification of information assets
  4. 4. Human resources security - security aspects for employees joining, moving and leaving an organization
  5. 5. Physical and environmental security - protection of the computer facilities
  6. 6. Communications and operations management - management of technical security controls in systems and networks
  7. 7. Access control - restriction of access rights to networks, systems, applications, functions and data
  8. 8. Information systems acquisition, development and maintenance - building security into applications
  9. 9. Information security incident management - anticipating and responding appropriately to information security breaches
  10. 10. Business continuity management - protecting, maintaining and recovering business-critical processes and systems
  11. 11. Compliance - ensuring conformance with information security policies, standards, laws and regulations.
  • Certification:

  • An ISMS may be certified compliant with ISO/IEC 27001 by a number of Accredited Registrars worldwide. Certification against any of the recognized national variants of ISO/IEC 27001 (e.g. JIS Q 27001, the Japanese version) by an accredited certification body is functionally equivalent to certification against ISO/IEC 27001 itself.
  • In some countries, the bodies that verify conformity of management systems to specified standards are called "certification bodies", while in others they are commonly referred to as "registration bodies", "assessment and registration bodies", "certification/ registration bodies", and sometimes "registrars".
  • The ISO/IEC 27001 certification, like other ISO management system certifications, usually involves a three-stage external audit process defined by the ISO/IEC 17021[4] and ISO/IEC 27006[5] standards:
    Stage 1: is a preliminary, informal review of the ISMS, for example checking the existence and completeness of key documentation such as the organization's information security policy, Statement of Applicability (SoA) and Risk Treatment Plan (RTP). This stage serves to familiarize the auditors with the organization and vice versa.
    Stage 2: is a more detailed and formal compliance audit, independently testing the ISMS against the requirements specified in ISO/IEC 27001. The auditors will seek evidence to confirm that the management system has been properly designed and implemented, and is in fact in operation (for example by confirming that a security committee or similar management body meets regularly to oversee the ISMS). Certification audits are usually conducted by ISO/IEC 27001 Lead Auditors. Passing this stage results in the ISMS being certified compliant with ISO/IEC 27001.
    Stage 3: involves follow-up reviews or audits to confirm that the organization remains in compliance with the standard. Certification maintenance requires periodic re-assessment audits to confirm that the ISMS continues to operate as specified and intended. These should happen at least annually but (by agreement with management) are often conducted more frequently, particularly while the ISMS is still maturing.


Other Links

Services Overview

CE Marking Gujrat Auditors are highly experienced and trained to carry out assessments with minimal disruption of work at client place. Our clients are assured with the competency and integrity of Auditors. They are qualified and meet all requirements of the International Register of Certified Auditors (IRCA) of the United Kingdom.

Contact Us

Address: Punjabi Bagh  ,                                New Delhi
Mobile: 09999620867, 09810557489