What does ISO 27001 cover?
The standard describes a management system for information security. An organisation working to it
- identifies and assesses risks to its information,
- defines safeguards, for example for access, backups and emergencies,
- reviews and improves these safeguards regularly
- and has the system audited by an external body for certification.
What do confidentiality, integrity and availability mean?
Information security protects three properties of information:
- Confidentiality: only authorised people can see the data.
- Integrity: data is complete and is not changed unnoticed.
- Availability: systems and data are available when they are needed.
Why does it matter for SMEs?
Many SMEs hand over the operation, hosting or support of their IT to a partner. Part of their data and access then lies in that partner’s hands. A management system built to ISO 27001 shows that the partner implements information security systematically.
ISO 27001 and data protection: what is the difference?
The Swiss Data Protection Act governs how personal data may be processed. Its revised version has applied since 1 September 2023. ISO 27001, by contrast, is a voluntary standard for protecting all of a company’s information. Certification does not replace data protection obligations, but it supports them: an organisation that manages risks, access and emergencies systematically covers an important part of the required data security.
How does certification work?
An accredited certification body examines the management system in an audit. The certificate is valid for three years, with annual surveillance audits during that period, followed by recertification. The current version of the standard is ISO/IEC 27001:2022.
Which questions should you ask an IT partner?
- Which standard is the information security built on?
- Who has access to our data, and how is that controlled?
- Where is our data stored?
- Are there defined procedures for emergencies?
- Is backup recovery tested regularly?
What can SMEs do themselves?
- Enable multi-factor authentication for email, remote access and key applications.
- Install updates for devices and programs promptly.
- Keep backups separate and test recovery.
- Review permissions regularly, especially when people leave.
- Raise employee awareness of phishing and fraud attempts.
- Write down who does what in an emergency and whom to inform.
What does the Data Protection Act require after an incident?
If a data security breach is likely to result in a high risk for the people affected, it must be reported to the Federal Data Protection and Information Commissioner (FDPIC) as soon as possible. This requires procedures that are defined in advance: who detects the incident, who assesses it and who reports it? ISO 27001 requires exactly these kinds of procedures.
How do you detect attacks in time?
Many attacks start inconspicuously, often at night or at the weekend. A Security Operations Center monitors connected systems around the clock, assesses alerts and informs the agreed contacts. As an Arctic Wolf Premium Partner, elvadata offers this monitoring, tailored to your IT. Find out more on our security page.
How does elvadata put this into practice?
ELVADATA AG’s information security management system is built to the requirements of ISO 27001. Access is governed by clear concepts, backups run on a jointly agreed schedule and recovery is tested regularly. CISO expertise is available for your questions.
The article ISO 27001: information security with a system describes how we implement information security ourselves. To discuss your situation, you can reach us via Work with us.