Login 
The ISO 27001 Standard is the international standard for information security, helping to protect organisations with measures for identifying security risks to combat potential cyber-attacks and security-related issues.
Data and information protection is now a hot topic for the government, businesses and the public, particularly after significant cyber-attacks have drawn attention to the security weaknesses of large businesses and organisations such as NHS hospitals and local councils.
To help all organisations of all sizes keep their information safe and their reputations intact, the ISO (International Organisation for Standardisation) developed ISO 27001, the Standard for information security management.
This Standard helps organisations to create a framework for an information security management system (ISMS), which helps to protect your information from cyber-attack, hacks, theft and data leaks by developing best practice.
But ISO 27001 goes beyond IT. To give organisations the security they need, this comprehensive Standard encompasses all aspects of a business, developing risk management throughout that helps your business demonstrate a robust culture of security.
This means that you will develop processes that cover the legal, physical, human and technical aspects of your organisation, protecting both digital and physical assets.
To do this, the Standard includes a diverse set of controls.
What are the different ISO 27001 controls?
The wide and in-depth scope of this Standard contains 93 controls. Each control has been developed to help businesses cover the various aspects of information protection. All controls are implemented unless they’re not relevant to your organisation’s particular activities.
These controls are gathered together in a section known as Annex A, which is then split up into four ISO 27001 control sets known as ‘Themes’. These controls cover everything from developing an information policy to creating access processes.
Below are the four different ISO 27001 control sets, with a selected example from each control that outlines what you should do to adhere to each control.
Annex A.5: Organisational controls
Control Example – A.5.1 Policies for information security
This control outlines the requirements for you to set out management support and direction for information security, with defined security policies and how they will be communicated to your wider organisation. You should also consider the review process for your security policies, ensuring they remain applicable to identified risks, such as data protection breaches.
Annex A.6: People controls
Control Example – A.6.7 Remote working
Organisations should have a policy on remote working as well as an information security management system that includes procedures for securing remote access to information systems and networks.
Annex A.7: Physical controls
Control Example – A.7.2 Physical entry
Organisations need to protect secure areas by using appropriate entry controls and access points.
Annex A.8: Technological controls
Control Example – A.8.12 Data leakage prevention
Data leakage prevention measures should be applied to systems, networks and any other devices that process, store or transmit sensitive information.
Find out more about the ISO 27001 controls and check out our dedicated page which includes a comprehensive summary of each control featured in the ISO 27001 Standard.
What are the consequences of not implementing ISO 27001 controls?
Each business will have a varying degree of threats and risks that could occur if the appropriate controls outlined in the ISO 27001 Standard are not implemented sufficiently. As technology advances rapidly, cybercriminals are quick to adapt to exploit any loopholes in new and emerging technologies, often at the expense of businesses. Without appropriate controls and measures in place, this can leave your business exposed to cyber attacks, with different security breaches that can have long-lasting consequences for your business.
Some of the negative consequences include:
- Loss of revenue – Any disruptions to your security will incur costly repairs and downtime to put right any issues that need fixing. For example, if your business has an e-commerce website that isn’t functioning due to maintenance to fix security, your customers may look at competitors as a viable alternative for the product or service you’re offering.
- Loss of intellectual property – Data protection is an increasingly important aspect of security that your business must consider. Hackers are prone to targeting data information that can lead to competitive disadvantages for your business. Organising your information security effectively as outlined in Annex A will help control the overall information security of your business.
- Damage to brand reputation – If private data is leaked, then this can lead to mistrust in your services and damage the reputation of your business. It will invite hesitancy from clients and customers to continue to trust your business if you can’t demonstrate that private information will remain safe and secure.
Find out more about the ISO 27001 controls and what they involve, which includes a comprehensive summary of each control featured in the ISO 27001 Standard.
Protect your business from security breaches with ISO 27001 certification
By applying these ISO 27001 controls, you can help make sure that your organisation remains compliant with the latest data protection regulations and legislation. The ISO 27001 Standard will get you to stay up to date with the criteria outlined in the Standard by demonstrating continual improvement and robust risk management.
By partnering with Citation ISO Certification, we can help you become ISO 27001 certified with our simple three-step process. What’s more, you’ll gain access to our smart online management tool Atlas, where you can view your reports, templates and documents in one place. Our streamlined process helps your business get certified quickly, boosting your business to bring new work opportunities so it can expand.
To obtain a quote today, simply contact us and speak to our expert team of ISO 27001 consultants who can assist you with any queries you may have. We’re here to help you become certified so you can grow and expand your business opportunities.
For further reading on the benefits of ISO 27001 and how we can help implement it, check out our dedicated pages on ISO 27001 below.
