Tomorrow we will board Elon Musk's new rocket, the one equipped with "anti-gravity" technology and not limited by the speed of light. Together with the group we have put together – the people we love and appreciate – we will emigrate to the new planet we have chosen. We will leave Earth behind and design our lives from scratch on the new, completely vacant planet, just as we dreamed and planned.
After we have landed, safe and sound, we realize that apart from the name we have already chosen for the new place (after endless discussions and arguments in the group WhatsApp chat), before we can start to relax, there is a sea of matters to sort out.
What is allowed and what is forbidden, how it is determined who owns what, who lives where, how the space is divided, who is responsible for order, who will manage the place and how they are replaced, what happens when someone does not comply with the rules the group has set – and so on and so on.
It is almost certain that we will very quickly reach the conclusion that, with all due respect to the beautiful dreams of "starting everything from scratch", if we really want to move forward – we should adopt a known method, an existing rulebook, that people have racked their brains over for dozens or hundreds of years. Maybe the American one, maybe the Israeli one, maybe something European. A method that has been "shaved" from every direction, that has experienced successes and failures, corrections and improvements, until it took shape into what it is. At most, we will make targeted adjustments later on.
How is this related to ISO 27001?
For an organization, ISO standards such as 27001 are like the rulebook for the new colony in a fantasy story. Standards of this kind – in this case ISO 27001, which deals with information security and cyber management – serve as an efficient and convenient framework on whose basis the relevant area of the firm can be organized systematically, without having to reinvent everything from scratch. This lets the company focus on its own unique needs and characteristics, while drawing on experience accumulated over many years by experts, organizations and consultants.
Not magic, but order
Contrary to what many think, the ISO 27001 standard is not a closed list of technical instructions and controls. It does not tell an organization which antivirus to use, how to protect endpoints, or what risk level is "right" for the organization. What it does offer is a method – flexible and dynamic – a structured way to think about, analyze and manage the field of information protection according to the organization's structure, resources and needs, and according to its specific risk management considerations. These characteristics make it suitable for organizations of different types and sizes.
Let's take a small and fairly simple business: an online flower shop. The shop owner is aware of cyber and privacy risks and tries to minimize them: she changes passwords, makes backups from time to time, and limits access permissions for employees. She also consults with a lawyer, so on the face of it things seem fairly under control. But if she were asked: what is the biggest risk to your business? What will you do if your customers' details leak?
How long will it take to restore the site in the event of a crash or breach? How will she know who was logged in to the system at the time of the incident? She may not have answers. Using a framework standard such as 27001 makes it possible to think about these and other things and try to prepare for them better. It offers, for example, a method that divides the organization into areas of responsibility (employees, suppliers, customers, information systems, critical assets, etc.), helps the organization ask the question of criticality in advance, try to identify the risks, and build mechanisms that make it possible to manage information security efficiently and thoughtfully. Instead of intuition, it encourages building an orderly plan.
Is an official "certificate" needed?
If we put commercial and image considerations aside (and also ignore regulatory considerations relating to specific sectors), there is no obligation to hold an official certificate in order to enjoy the benefits of using the framework produced by the ISO 27001 standard, or by other standards and methods. Implementing the principles of the standard – even without formal recognition – gives real value in itself. Relying on principles and structures that have been tried and tested over many years, and adhering to a logical and up-to-date system, will contribute a great deal. It is understood, however, that being subject to audit and examination by external parties will usually make the process and the approach deeper and more binding for the organization. Formal recognition, known in professional jargon as "accreditation", is granted by certain accreditation bodies (for example, the Standards Institution of Israel). Either way, we stress, the main thing is in no case the certificate itself.
To sum up: The ISO 27001 standard offers a logical framework and structure for establishing the organizational protection system and for managing information risks systematically. It does not purport to define for an organization what the right risk is or what the appropriate scope of protection is, nor does it constitute "proof" of its level of protection. It gives the firm an effective and convenient tool for organizing the protection domain thoroughly and for pouring into the framework the contents, preferences and protection levels that are right for it.
