The Schellman Blog

Imagine you’ve been asked to renovate two kitchens. At the end, each of your two customers want to have a fully functioning room so you roll up your sleeves.

What is ISO 27001? At a basic level, ISO/IEC 27001:2022 (ISO 27001) is a management system framework for an information security management system (ISMS) that a company can be certified against by conforming to the ISO 27001 standard. Structured primarily around how a company manages information security and its related risk, this standard is a powerful one, as almost every company in the modern age now “manages information security” of some sort.

When building out your information security management system (ISMS) which will ultimately become certified, it can be tricky to know where to draw the boundaries of what should be included in your scope.

As a holistic security standard that has become popular worldwide, ISO 27001 can help any organization seeking to prove their cybersecurity measures are sound while also providing a market differentiator among other gained advantages. But the comprehensive nature of the standard—and the heavy lift it requires—can also put off organizations considering it, especially those in sectors that have yet to really be affected, like law firms.

Cloud computing technologies have revolutionized the way organizations manage and store their information. Where companies used to house and maintain their own data, a host of organizations have now made the switch to a cloud-based model due to the ease of use and cost-saving benefits promised by the cloud.

NOTE: Schellman has since updated and expanded this information in an article found here.