Acrelia, an ISO 27001 certified email marketing platform

1. What is the ISO 27001?
   1. History and Evolution
   2. Structure of the ISO 27001
   3. Importance of ISO 27001
      1. Confidentiality, Integrity and Availability
      2. Continuous Improvement
      3. Risk management
2. Who is Obliged to Comply with the ISO 27001?
3. New developments introduced in 2022 (ISO 27001:2022)
   1. Focus on Cyber Resilience
   2. Integration with Other Standards
   3. Update of Controls
   4. Simplification and Clarity
   5. Improvements in Risk Management
   6. Review of Security Documentation and Policy
   7. Assessment and Audit
4. Acrelia, platform certified in ISO 27001 and ENS

1. What is the ISO 27001?

The ISO 27001 is an international standard developed by the International Organisation for Standardisation (ISO) and the International Electrotechnical Commission (IEC), which specifies the requirements for establishing, implementing, maintaining and continually improving an Information Security Management System (ISMS). This standard is part of the ISO/IEC 27000 series, which covers various aspects of information security. The ISO 27001 is widely recognised and used throughout the world as a guideline for the protection of sensitive information.

1.1. History and Evolution

The ISO 27001 was first published in 2005, in response to the growing need to protect information in an increasingly digitalised world. Since then, it has been revised and updated to keep up with new technologies and security threats. The latest version, published in 2022, introduced significant improvements to the structure and requirements of the standard, making it easier to integrate with other management systems.

1.2. Structure of the ISO 27001

The ISO 27001 is organised in several sections covering all aspects necessary to manage information security in an organisation. These sections ensure a holistic and structured approach to protect information. The main sections of the standard are described below:

• Organisational Context: This section requires the organisation to understand its internal and external context, identifying the needs and expectations of stakeholders. This includes defining the scope of the ISMS and the applicable boundaries.
   
• Leadership: The ISO 27001 emphasises the importance of leadership and top management commitment. Management must demonstrate commitment to information security and assign clear responsibilities within the organisation.
   
• Planning: Planning involves identifying risks and opportunities related to information security. The organisation should conduct a risk assessment and plan how to address them by implementing appropriate security controls.
   
• Support: This section covers the management of resources needed to implement and maintain the ISMS, including staff competence and training, communication and required documentation.
   
• Operation: The operation section details the implementation of security controls, risk management and the conduct of internal audits to ensure that the ISMS is functioning properly.
   
• Performance Evaluation: This section focuses on monitoring, measuring and evaluating the performance of the ISMS. This includes conducting periodic management reviews and internal audits to identify areas for improvement.
   
• Improvement: The ISO 27001 promotes continual improvement of the ISMS. Organisations should identify non-conformities and take corrective actions to continually improve information security.

1.3. Importance of ISO 27001

The ISO 27001 is crucial for organisations wishing to protect their data and that of their customers effectively. Adopting this standard enables companies to demonstrate their commitment to information security, which can increase the confidence of their customers and business partners. It also helps organisations to comply with legal and contractual regulations related to data protection.

1.3.1. Confidentiality, Integrity and Availability

• Confidentiality: Ensuring that information is only available to authorised persons.
• Integrity: Maintaining the accuracy and completeness of information and processing methods.
• Availability: Ensuring that authorised users have access to information when required.

The ISO 27001 provides a systematic and structured approach to information security management. This includes the identification of risks, the implementation of controls to mitigate those risks and the continual review of the effectiveness of those controls. In addition, the ISO 27001 certification is an independent process conducted by an accredited body, which provides additional assurance that an organisation has implemented an effective ISMS.

1.3.2. Continuous Improvement

The continuous improvement approach of the ISO 27001 ensures that organisations not only implement security controls, but also regularly review and improve them to adapt to new threats and emerging technologies. This creates a culture of security within the organisation, where all employees understand the importance of protecting information and actively participate in improving the ISMS.

1.3.3. Risk management

Risk management is a key component of the ISO 27001. The standard requires organisations to conduct periodic risk assessments to identify potential threats to information security. Based on the results of these assessments, organisations must implement appropriate measures to mitigate the identified risks. This ensures that information security is not a static endeavour, but a dynamic process that evolves over time.

2. Who is Obliged to Comply with the ISO 27001?

Although the ISO 27001 certification is not mandatory by law, many organisations choose to comply with it to demonstrate their commitment to information security and to gain the trust of their customers and partners. Implementing the ISO 27001 is particularly beneficial for companies that handle sensitive data or operate in sectors where information security is critical.

3. New developments introduced in 2022 (ISO 27001:2022)

In 2022, the ISO 27001 was updated to better address emerging threats and new technologies. Here are some of the main new features:

3.1. Focus on Cyber Resilience

One of the most notable new features of the ISO 27001:2022 is the increased emphasis on cyber resilience training. This update recognises the need for organisations to not only prevent security incidents, but also to develop the ability to recover quickly and maintain continuity of operations in the event of a security breach. Cyber resilience focuses on incident preparedness, response and recovery, ensuring that organisations can minimise the impact of attacks and restore their critical services efficiently.

3.2. Integration with Other Standards

The 2022 revision has also facilitated the integration of the ISO 27001 with other management standards, such as the ISO 9001 (quality management) and the ISO 22301 (business continuity management). This alignment improves consistency and efficiency in the implementation of multiple management systems within an organisation. By integrating these standards, companies can leverage synergies and reduce redundancy in their management processes, resulting in more effective administration and a greater focus on continuous improvement.

In summary, the ISO 27001 is a comprehensive standard that provides organisations with an effective framework for managing information security. By adopting this standard, organisations can better protect their data, comply with regulations and increase the confidence of their customers and business partners. Implementing an ISMS based on the ISO 27001 not only improves information security, but also contributes to the long-term success and sustainability of the organisation.

3.3. Update of Controls

The list of security controls in Annex A of the ISO 27001 has been updated to better reflect current threats and vulnerabilities. New controls related to key areas such as cloud security, mobile device management and privacy protection have been introduced. These additional controls ensure that organisations are better prepared to meet modern security challenges and more effectively protect sensitive data in constantly evolving technology environments.

3.4. Simplification and Clarity

The structure and language of the ISO 27001 has been simplified to make it more accessible and understandable to all stakeholders. This simplification facilitates the adoption and implementation of the standard, allowing organisations of all sizes and sectors to benefit from a robust ISMS. By clarifying requirements and reducing complexity, the ISO 27001:2022 helps organisations focus on the most critical aspects of information security management.

3.5. Improvements in Risk Management

The 2022 revision also includes improvements in the approach to risk management. Organisations are now required to adopt a more dynamic and adaptive approach to risk identification, assessment and mitigation. This involves conducting more frequent risk assessments and adjusting security measures according to changes in the threat landscape. Proactive risk management ensures that organisations can anticipate and respond quickly to new threats, thereby protecting the integrity, confidentiality and availability of information.

3.6. Review of Security Documentation and Policy

The ISO 27001:2022 has also placed greater emphasis on security documentation and policy. Organisations should regularly review and update their security documentation and policies to ensure that they are relevant and effective. This includes reviewing internal procedures, guidelines and policies to ensure they are aligned with current best practice and regulatory requirements.

3.7. Assessment and Audit

The update of the standard has also introduced changes to the assessment and audit requirements. Organisations must carry out more rigorous and frequent internal audits to assess the effectiveness of their ISMS and ensure continued compliance with the requirements of the ISO 27001. These internal audits, together with external audits by accredited bodies, ensure that organisations maintain a high level of information security and continue to improve their management practices.

4. Acrelia, platform certified in ISO 27001 and ENS

Working with an ISO 27001 and ENS certified email marketing platform such as Acrelia, provides an additional guarantee of security, compliance and trust.

These certifications not only demonstrate our emailing tool's commitment to data protection, but also give customers peace of mind knowing that their data is managed in accordance with the highest international standards.

Both the ISO 27001 and the ENS promote continuous improvement in information security management. At Acrelia, as a certified platform, we are committed to constantly reviewing and updating our security policies and procedures to adapt to new threats and emerging technologies. In addition, we have processes in place for the identification, assessment and mitigation of risks, which ensures that any potential threat to information security is managed proactively and effectively.