Why ISO 27001 Accreditation is Crucial When Selecting a Managed Service Provider

Summary

This blog post, "Why ISO 27001 Accreditation is Crucial When Selecting a Managed Service Provider", is a blueAPACHE article from 2021 covering security. Cybersecurity breaches have become common place headlining our news; even the highest profile of brand names is not immune, most recently witnessed with the massive data breach involving 500 million Facebook users’ personal information1. The reality is your information security posture is only as strong as your weakest link. It is written for readers evaluating emPOWER Security, Managed Detection and Response. The underlying security practice it describes, reducing attack surface and improving detection and response, is not tied to a specific product version and remains relevant to any organisation managing cyber risk today.

Key facts

Article

Cybersecurity breaches have become common place headlining our news; even the highest profile of brand names is not immune, most recently witnessed with the massive data breach involving 500 million Facebook users’ personal information1. The reality is your information security posture is only as strong as your weakest link. With remote working arrangements becoming the standard, hackers continue to find new and sophisticated ways in accessing vulnerabilities and causing major business disruption. The complex nature surrounding secure delivery of data and applications can be a minefield, and over the past 12 months many organisations have discovered the benefits of partnering with a Managed Services Provider (MSP). Selecting the right provider who follows a robust security program can be a critical commercial decision, after all, your MSP will have access to highly sensitive company data from intellectual property, to financials and employee information. It’s imperative in today’s landscape that your provider follows strict Information Security Management System (ISMS) governance to minimise your risk and ensure business continuity by pro-actively limiting the impact of a security breach. ISO 27001, formally known as ISO/IEC 27001:2013 ISMS is a gold standard for cybersecurity frameworks. It is vendor-neutral, technology agnostic, nonaligned with a specific industry sector, and therefore, provides an excellent framework for establishing, implementing, maintaining and continually improving information security program for any organisation. Why select an ISO 27001 accredited MSP? Partnership with ISO 27001 accredited MSP ensures that your information is stored and processed in a risk-managed environment using the best practices. When you choose an ISO 27001 accredited IT services provider as your MSP, you eliminate uncertainty about how your data is being stored and managed. ISO 27001 accreditation requires organisations to go through a rigorous external third-party audit of the entire security program followed by two yearly surveillance audits. To stay compliant, organisations must recertify every three years. When you partner with an MSP with the accreditation, you get a slew of advantages:

• Confidentiality through protection from unauthorised access and disclosure.
• Integrity by ensuring data has not been altered without approval.
• Availability and prevention of disastrous events that can put your organisation data at risk.

Cybersecurity threats and online crimes are constantly evolving. The major benefit of working with an ISO 27001 certified MSP is that you are assured of an independently third party audited accreditation. At blueAPACHE, we are committed to information security; continually improving our security program to challenge the current and upcoming threats. Our security program goes beyond our ISO 27001 security certifications; we invest in security so that our clients have secure and efficient access to their systems wherever they are, all the time. This enables our clients to achieve success, be agile and dynamic and support their client communities. Continue reading: How cybercriminals are exploiting the COVID-19 crisis – what you need to know to strengthen your human firewall! blueAPACHE is a proud supporter of this week’s Privacy Awareness Week (PAW), an annual online event run by the Office of the Australian Information Commissioner (OAIC) highlighting the importance of securing personal information. 1Paul Haskell-Dowland, The Conversation, 2021 – Available at: https://theconversation.com/facebook-data-breach-what-happened-and-why-its-hard-to-know-if-your-data-was-leaked-158417

Related

• emPOWER Security
• emPOWER Security (pillar hub)
• Managed Detection and Response
• emPOWER Managed Services (pillar hub)
• blueAPACHE Security (case study)

Frequently asked questions

What data breach does the article cite as proof that even major brands are not immune to cybersecurity failure?

The article points to the breach that exposed the personal information of 500 million Facebook users, citing Paul Haskell-Dowland writing in The Conversation (2021). It uses this example to argue that no organisation, however well known, is automatically safe from a security incident.

Which version of the ISO 27001 standard does the article reference, and what does it stand for?

The article references ISO/IEC 27001:2013, an Information Security Management System (ISMS) standard. It describes this standard as vendor-neutral, technology agnostic, and not aligned to any one industry sector.

What three advantages does the article say a business gains by partnering with an ISO 27001 accredited MSP?

The article lists confidentiality (protection from unauthorised access and disclosure), integrity (assurance that data has not been altered without approval), and availability (prevention of disastrous events that put organisational data at risk). These three form the core benefits it attributes to working with an accredited provider.

How often does the article say an ISO 27001 accredited organisation must be audited to stay compliant?

The article states that accreditation requires an initial rigorous external third-party audit followed by two yearly surveillance audits, with full recertification required every three years. It presents this audit cycle as the mechanism that keeps the accreditation meaningful over time.

What event does the article say blueAPACHE was a proud supporter of, and who runs it?

The article says blueAPACHE was a proud supporter of that week's Privacy Awareness Week (PAW) 2021, an annual online event run by the Office of the Australian Information Commissioner (OAIC) that highlights the importance of securing personal information.

Why does the article say a business's own data is at risk through its choice of MSP?

The article explains that an MSP has access to highly sensitive company data, from intellectual property to financials and employee information. It argues that strict Information Security Management System governance from the provider is what minimises this risk and limits the impact of any breach.

What follow-up article does this post direct readers to for more detail?

The post links to "How cybercriminals are exploiting the COVID-19 crisis – what you need to know to strengthen your human firewall!" as further reading. It frames that piece as expanding on the idea that an organisation's security posture is only as strong as its weakest link.

Is the ISO 27001 accreditation principle in this article tied to a specific technology or industry?

No. The article describes ISO 27001 as vendor-neutral and technology agnostic, applicable to any organisation regardless of sector, which is why the underlying selection criteria it describes still apply when evaluating an MSP today.

Source

• origin post (2021)

Knowledge Base