How to improve your compliance with ISO 27001 information security policies

Security policies aren’t just for show. There’s no point creating a series of policies to improve your company’s information security if nobody follows them. Every new regulation requires the company to put controls in place to make sure employees follow the new guidelines.

Compliance is the process of making sure laws and regulations are respected and followed, and that misconduct is properly dealt with if it happens. And believe me, it will happen, at every level of the organization.

ISO 27001 makes the importance of compliance in information security processes very clear:

“To avoid breaches of legal, statutory, regulatory or contractual obligations related to information security and of any security requirements.” ISO 27001

Why should we take regulatory violations seriously?

Picture this: your company has a dedicated internet link. The internet provider’s contract sets a Service Level Agreement (SLA) saying the internet must be available 99% of the time. If your company’s internet goes down for more than 8 hours in a month, the internet provider must cover the losses and fines set out in the contract.

The internet provider needs tight controls to make sure its employees follow internal security rules and to prevent failures in its process, because breaching contractually agreed regulations leads to losses, operational impact, lawsuits and even damage to the company’s reputation with its customers.

How do I make sure my company complies with the law?

Every company has a different kind of operation, and the laws vary from business to business. Still, we can draw a few principles that will help employees comply with policies and laws:

1. Understand the requirements

It’s very common to break a law simply because you don’t know it exists. Unintentional violations are common, but they pose risks to the company just the same. The first step is to find out which laws and regulations the company must follow, and to document them for each of the organization’s information systems.

If there are no specialists in-house, outside professionals can be hired to gather and document these requirements. They’ll analyze the company’s processes, contracts and the applicable national and international laws, and document them properly.

2. Create internal policies

With the requirements in hand, the next step is to create internal compliance policies. Policies formally state what must be done for employees to comply with the law. Remember that a policy is a formal statement by senior management of the path everyone in the company must follow, and so it applies to everyone.

3. Analyze risks and monitor adherence

There’s no perfect security measure, however robust your internal policy. It’s essential to study the probability and impact of violations, threats and every other risk involved in the company’s operations.

Setting up controls that ensure employees adhere to the company’s internal policy is one way to reduce the likelihood of the identified violations and risks happening.

4. Document results

If there’s no evidence, it didn’t happen.

That’s right: actions, risk analysis results, measures taken and handling of violations, when not documented, are bound to happen again. The company can’t afford to repeat past mistakes, and formalizing all these information security efforts is how all the knowledge gained gets captured.

5. Deal with deviations

As the saying goes, “rules are made to be broken”. Violations are a natural part of implementing policies and standards. Misconduct and policy violations must be dealt with according to how serious they are, and must be documented too.

6. A continuous process

The sixth step is really a reminder that none of the steps above is static. Laws keep changing, employees come and go, new risks appear and others disappear, the company’s operation grows, and so on.

Keeping the process cyclical prevents it from becoming obsolete or unsuited to the constant changes the organization goes through over time, whether from internal or external factors.