ISO 27001 is a cybersecurity certification created and maintained by the International Organization for Standardization (ISO). It is a somewhat rigid set of controls that, when properly implemented by any given organization, will ensure a good level of cybersecurity.
Many business-to-business customers are now demanding that their suppliers have strong cybersecurity programs – they will refuse to do business with vendors that can’t prove their security. Some are even requiring that their vendors obtain an ISO 27001 certification to provide proof and assurance that best practices are being followed.
This is particularly true in Europe, while SOC 2 is the preferred compliance standard in North America. However, many American companies are beginning to request ISO 27001 from their vendors now too.
To get an ISO 27001 certification, an organization must build a cybersecurity program that meets the standard, then complete an audit with an ISO 27001-certified auditor.
If you’re already SOC 2 compliant, then your security program is in pretty good shape and earning an ISO 27001 certification will be more about small tweaks and creating lots of ISO 27001-specific documentation.
If you aren’t already SOC 2 compliant, then there will likely be a number of gaps in your cybersecurity program that need to be filled. Additionally, lots of ISO 27001 documentation will need to be created.
This takes some specialized talent and information, which few growing and midsize companies have access to.
Fractional CISO (Chief Information Security Officer) helps organizations earn their ISO 27001 certification by providing them with a cybersecurity team consisting of an experienced Virtual CISO and a skilled cybersecurity analyst.
Fractional CISO plugs this cybersecurity team into your organization, giving you additional talent and bandwidth needed to build out a cybersecurity program and earn an ISO 27001 certification while reducing the overall cybersecurity workload that existing personnel are required to do.
This case study is about one of our SOC 2 clients, WayPath Consulting. While SOC 2 and ISO 27001 aren’t identical, the services we provide are similar to each. This case study will help you understand our methodology and the positive impact we have on companies when we help them improve their security programs and complete cybersecurity audits.