Category: Uncategorized

In a world where corruption is increasingly penalized and scrutinized, maintaining the integrity of an organization has become more important than any other thing. Implementing the ISO 37001 standard in the process can help you by offering a framework to detect, address, and prevent all sorts of bribery issues and provide you with a robust approach to enhance integrity across your organizational levels. The following blog post will discuss what is the ISO 37001 requirement and how to comply with it to obtain the ISO 37001 certification for your organization.

So, what is the ISO 37001 standard?

The ISO 37001 standard is internationally known for ABMS (Anti-Bribery Management Systems).

Having ISO 37001 in place shows that you take serious measures to keep your business away from corruption and bribery-related matters.

ISO 37001 sets specific requirements to promote an anti-bribery culture within your organization, including adopting an anti-bribery policy, due diligence on third parties, implementing preventive procedures, and establishing mechanisms for reporting and investigations.

What steps are you required to follow to get your organization ISO 37001 certified?

There are a few steps organizations are required to follow to implement the ISO 37001 standard in their business and obtain the ISO 37001 certification.

The following are them:

1.Commitment from top management

The path to getting your organization certified with ISO 37001 starts with a commitment from top management.

Leadership should show unequivocal support for a culture of integrity and anti-bribery policies.

2.Assessing risks

Organizations should conduct the risk assessment thoroughly to identify, address, and mitigate potential bribery risks within their processes.

The assessment involves evaluating all internal and external factors that can influence these risks.

3.Developing a customized policy related to anti-bribery

Depending on the outcome of the risk assessment, organizations should establish an anti-bribery policy, reflecting their specific requirements and contexts.

The anti-bribery policy should be concise, clear, and easily accessible to the stakeholders and staff members.

4.Training and communicating with employees

Training and effective communication are essential for implementing the ISO 37001 standard in your organization.

You must ensure that all employees and associate personnel are aware of the anti-bribery policy of your organization along with their respective responsibilities, and the potential consequences of non-compliance.

5.Implementing procedures and controls

Organizations should implement appropriate controls (both financial and non-financial) to ensure that there are clear processes and procedures to report potential bribery matters and suspicious activities.

6.Improving continuously

Monitoring and reviewing the ABMS regularly is crucial for companies to check how effectively it is working.

ISO 37001 is all about continual improvement.

Further, learning from experiences, changes, and feedback on bribery risks can help you evolve and strengthen your organization’s ABMS.

What challenges is your organization required to overcome to implement ISO 37001?

Overcoming the challenges of implementing the ISO 37001 standard requires commitment and strategic planning.

The following are some of the challenges your organization is required to overcome:

1.Resource Allocation

Implementing the ISO 37001 standard in your business process is resource-intensive.

Organizations may face challenges in allocating sufficient human and financial resources.

To overcome this challenge, it’s important to have a well-planned budget and ensure that your organization is adequately staffed and your team is properly trained.

Often, you may look for external expertise for the same.

2.Complying with the Legal Requirements

Implementing the ISO 37001 standard in your company requires compliance with both national and international legal requirements related to bribery.

The whole process can be challenging, especially for organizations operating in multiple locations.

To overcome this challenge, organizations must need internal and external legal expertise.

3.Cultural Differences

Businesses operating internationally may face many challenges due to different cultural attitudes related to bribery.

Organizations are required to have an international standard within the organization while being sensitive to differences in cultures.

Providing tailored training and communication strategies can help you address these challenges effectively.

4.Resistance to Change

One of the major challenges organizations face when implementing the ISO 37001 standard is the resistance from management and employees.

To overcome this challenge, organizations are required to establish a well-defined strategy along with robust leadership to communicate within the organization.

Alongside that, leaders must emphasize the benefits of implementing the ISO 37001 standard like legal compliance, enhanced reputation, and improved operational efficiency.

Regular employee training and awareness programs can also help.

5.Integration to Existing System

Integrating the ABMS into the existing system can also be complex.

Thus, organizations implementing ISO 37001 are required to seamlessly integrate the ISO 37001 standard to the locations, where it complements and enhances the existing processes.

Utilizing the HLS (High-Level Structure) that ISO 37001 follows can also make it easier for brands to align it with other standards such as ISO 9001, ISO 45001, and ISO 14001.

6.Continuous Monitoring and Improvement

Organizations are required to establish mechanisms to monitor, review, and improve their existing ABMS.

Even though it sounds easier, it can be a challenging procedure.

However, conducting regular audits and evaluating the reviews by top management can help you overcome this challenge and update your ABMS in response to potential bribery risks.

Take away

Are you wondering what will be the best way to improve your process and gain more customers? Well, obtaining an ISO 37001 certification may help you with that. Having ISO 37001 in place gives off your commitment to maintaining ethical practices within your organization and ensures that you meet all the legal and regulatory requirements. But before that, you must know what is the ISO 37001 requirement to implement the standard in your process and overcome challenges. We hope this blog post can help you understand everything about implementing the latest ISO 37001 standard in your business process.

Is your organization preparing for the ISO 27001 certification? Are you on your way to make the perfect ISO 27001 stage 1 audit checklist? We can help!

Making a checklist is an effective way to keep track of your progress and ensure you don’t forget anything crucial during the demanding process. However, before making that checklist, it’ll be wise to take a final look at the new controls of ISO 27001:2022.

The recent Annex A update of ISO 27001 has left many scratching their heads.

Essentially, the update intended to simplify the implementation of controls while making them more relevant to the nature of modern-day cyber crimes. Yet, the modifications might have made things more complex for you rather than streamlining it if you have been following ISO 27001:2013.

Since the stage 1 ISO audit is about assessing documentation, clearing these doubts is critical!

Hence, in today’s blog, we present a straightforward outline of all the changes to ISO 27001 controls.

This outline will help ensure you’re indeed on the correct path and ready to jump into the ISO 27001 stage 1 audit checklist.

So, dive into the section below!

A Look At The Updated ISO 27001 Controls!

Annex A is a part of ISO 27001 that contains classified security controls. Companies are responsible for determining which of these controls apply to their organization and implementing them accordingly.

In ISO 27001, the controls take a risk-based approach associated with the Statement of Applicability.

ISO 27001:2013 contained a total of 114 controls separated into 14 categories. These controls covered a wide range of information security issues.

ISO 27001:2022 aligned the Annex A controls. It merged 24 controls and revised 58 of them. Currently, the standard has 93 controls divided into four categories, including 11 new ones.

Statement of Applicability

A must-include point in your ISO 27001 stage 1 audit checklist is the Statement of Applicability or SoA. This document outlines the Annex A control your organization has implemented.

Your auditors will refer to SoA to learn about what controls you have and have not executed at your organization.

The Updated ISO 27001:2022 Annex A Controls

The current version of ISO 27001 has 4 categories for its controls instead of 14. These categories are:

• Organizational (37 controls)

• People (8 controls)

• Physical (14 controls)

• Technological (34 controls)

Now, here’s an outline of all the current controls of ISO 27001:2022 that you might want to assess before making the ISO 27001 stage 1 audit checklist.

ISO 27001:2022, Organizational Controls

• Policies for Information Security

• Information Security Roles and Responsibilities

• Segregation of Duties

• Management Responsibilities

• Contact With Authorities

• Contact With Special Interest Groups

• Threat Intelligence

• Information Security in Project Management

• Inventory of Information and Other Associated Assets

• Acceptable Use of Information and Other Associated Assets

• Return of Assets

• Classification of Information

• Labeling of Information

• Information Transfer

• Access Control

• Identity Management

• Authentication Information

• Access Rights

• Information Security in Supplier Relationships

• Addressing Information Security Within Supplier Agreements

• Managing Information Security in the ICT Supply Chain

• Monitoring, Reviewing, and Change Management of Supplier Services

• Information Security for Use of Cloud Services

• Information Security Incident Management Planning and Preparation

• Assessment and Decision on Information Security Events

• Response to Information Security Incidents

• Learning From Information Security Incidents

• Collection of Evidence

• Information Security During Disruption

• ICT Readiness for Business Continuity

• Legal, Statutory, Regulatory and Contractual Requirements

• Intellectual Property Rights

• Protection of Records

• Privacy and Protection of PII

• Independent Review of Information Security

• Compliance With Policies, Rules, and Standards for Information Security

• Documented Operating Procedures

ISO 27001:2022, People Controls

• Screening

• Terms and Conditions of Employment

• Information Security Awareness, Education and Training

• Disciplinary Process

• Responsibilities After Termination or Change of Employment

• Confidentiality or Non-Disclosure Agreements

• Remote Working

• Information Security Event Reporting

ISO 27001:2022, Physical Controls

• Physical Security Perimeters

• Physical Entry

• Securing Offices, Rooms, and Facilities

• Physical Security Monitoring

• Protecting Against Physical and Environmental Threats

• Working In Secure Areas

• Clear Desk and Clear Screen

• Equipment Siting and Protection

• Security of Assets Off-Premises

• Storage Media

• Supporting Utilities

• Cabling Security

• Equipment Maintenance

• Secure Disposal or Reuse of Equipment

ISO 27001:2022, Technological Controls

It is the lengthiest category among the four control categories. Therefore, make it a top priority in your ISO 27001 stage 1 audit checklist.

• User Endpoint Devices

• Privileged Access Rights

• Information Access Restriction

• Access to Source Code

• Secure Authentication

• Capacity Management

• Protection Against Malware

• Management of Technical Vulnerabilities

• Configuration Management

• Information Deletion

• Data Masking

• Data Leakage Prevention

• Information Backup

• Redundancy of Information Processing Facilities

• Logging

• Monitoring Activities

• Clock Synchronization

• Use of Privileged Utility Programs

• Installation of Software on Operational Systems

• Networks Security

• Security of Network Services

• Segregation of Networks

• Web filtering

• Use of Cryptography

• Secure Development Life Cycle

• Application Security Requirements

• Secure System Architecture and Engineering Principles

• Secure Coding

• Security Testing in Development and Acceptance

• Outsourced Development

• Separation of Development, Test, and Production Environments

• Change Management

• Test Information

• Protection of Information Systems During Audit Testing

What Annex A Controls Should You Include?

Now, you are prepared to create an ISO 27001 stage 1 audit checklist and carry out a thorough assessment!

Still, if you have doubts about what controls you should execute, evaluate your company’s operations, legal requirements, business goals, and information security risks.

Do any of the above controls apply to those aspects? If yes, then you should consider executing it.

Remember, if a control does not apply to your organization, you should not feel obliged to implement it. However, during the ISO 27001 stage 1 audit, your auditor will inquire about the controls you didn’t execute. At that moment, you should be prepared to justify your decision. Hopefully, this blog will help achieve your audit goal.