If you are an IT manager this year, you have one of the most stressful jobs out there. There is so much talk about cybersecurity risks and ransomware, and the implication is that if your company is breached it is because you did something wrong or because you did not train someone adequately.

If you are an IT manager at a defense contractor, not only do you have regular internet security to worry about, but now you also have governmental information (Controlled Unclassified Information) to worry about. The environment around these issues is tense. With the fate of CMMC 2.0.1 now being tied into government shutdowns and many looming questions, companies are feeling like the future is uncertain, as are the expectations they need to meet. 

Meanwhile, in the world of ISO 27001…

Companies pursuing compliance with ISO 27001 are not nearly as distracted. ISO 27001 has been around since 2005, it is not tied to the government in any way, and it is a rather universal standard because it is internationally accepted.

What is ISO 27001 and how can you get into this more peaceful world?

ISO 27001:2022

ISO 27001 was created in 2005 by the ISO, but its roots go back into the late 1990s, when commercial organizations in the UK began to call for ways to measure and track information security. Unlike GDPR, which focuses on personal data, or NIST/CMMC, which focuses on federal data, ISO 27001 focuses on the information security management system, or ISMS.

ISO defines ISO 27001 as follows:

Conformity with ISO/IEC 27001 means that an organization or business has put in place a system to manage risks related to the security of data owned or handled by the company, and that this system respects all the best practices and principles enshrined in this International Standard.
 

This definition shows ISO 27001 is nestled somewhere between GDPR, which protects personal data, ISO 9001, which is a management standard, and NIST/CMMC, which is focused on a different kind of network security. Because it exists among these other more talked about or better known standards, ISO 27001 sometimes gets lost in the shuffle. In reality, however, it is a highly beneficial standard for companies to work toward. In addition to ISO being a more peaceful world than the NIST/CMMC world, pursuing compliance with ISO 27001 can actually give companies a small boost toward complying with other standards as well, if the planning is done well.

If you feel like you are starting with a blank slate in regard to creating a secure cyber environment, contact us today about pursuing ISO 27001 while you watch what is happening in the NIST/CMMC space. We can offer you advice on how to plan ahead for what you will need to comply with before and after CMMC 2.0 goes into effect, and we will also offer efficient and effective ways for you to achieve compliance with everything you are looking at now.

Contact us today to learn more.