In this blog, we are going to be looking at the International Organization for Standardization (ISO) — which has developed the leading international standard focused on information security: ISO 27001. We will examine the ISO 27001 framework, how organizations can benefit from achieving ISO 27001 compliance and how Infosec IQ can help you with the required ISO 27001 security awareness training.
What is the ISO 27001 framework?
In our ISO 27001 auditing blog post, Infosec Skills Author Ralph O’Brien defines it as: “An international standard that creates an information security management system (ISMS) that an organization can be certified or badged against. […] where the 27000 family of standards really has its strength is in making sure that you have assessed the level of security you need, that you’ve delivered upon that security, and that you’re measuring and monitoring and improving the level of security you’ve put in place.” In short: ISO 27001 is part of a set of standards developed to handle information security.
What are the benefits of ISO 27001?
Being ISO 27001 compliant will help ensure that you have the tools in place to help your organization avoid security threats and lessen financial losses caused by data breaches. It will help you comply with regulatory, business, legal and contractual data protection requirements (think: GDPR, NIST and SOX). Since the ISO 27001 framework is globally recognized, it will also reduce the need for frequent audits. By putting these best practices in place, you are demonstrating to your stakeholders and customers that their information is your top priority. You are also creating structure and focus around who is responsible for which information asset — thus, creating a stronger culture of cybersecurity.
ISO 27001 awareness training for employees
If you were to dive into the ISO 27001 standards and “flip” to Section 7: Competence, clause 7.2.2 is all about information security awareness, education and training. Specifically, it states: “All employees of the organization and, where relevant, contractors shall receive appropriate awareness education and training and regular updates in organizational policies and procedures, as relevant for their job function.” This section outlines that all ISO 27001 training and awareness plan should:
Deliver up-to-date and consistent training Ensure every employee is familiarized with company policies and procedures around, but not limited to: reporting security incidents, password security, malware controls and a clean desk Provide tools to evaluate employee comprehension once training is complete
How can Infosec IQ help with ISO 27001?
Now that we understand the benefits and what is needed for a strong security awareness training program, we can explore the different tools and features in IQ to help meet your ISO 27001 staff awareness training goals.
Prebuilt training programs and campaigns
Infosec IQ offers program plans and kits that will help you quickly launch and manage your organization-wide security awareness program including simulated phishing campaigns, training and security awareness posters for all cybersecurity topics recommended by NIST.
Mandatory policy feature
If certain organizational policies need to be reviewed and acknowledged, you can administer them through our mandatory policy feature. By enabling a mandatory policy, learners will be required to review and acknowledge it before getting access to their training content.
Assess lesson retention and gauge risk
To ensure your learners are understanding and retaining the training content, we have pre-built assessments that have defined passing percentages that can be sent and reported on throughout your program; you can also create your own assessments to measure your learners’ understanding of your own organization’s policies and procedures.
Measure your security culture
During your program, you can assess your organization’s overall cybersecurity culture by using our Cybersecurity Culture Survey. This survey makes it easy for you to analyze employee attitudes and perceptions toward cybersecurity and your overall security training efforts. It also enables you to go beyond traditional success metrics like phishing click rate and add a new dimension to quantifying success, identifying weaknesses and building strategies for improvement.
Quickly report and analyze suspicious emails
If your organization is looking for a new way to report and analyze suspicious emails, our PhishNotify and PhishHunter tools will do just that. PhishNotify is our email reporting button that will positively reinforce best practices by immediately notifying the learner if the email they reported is malicious or is part of a simulated phishing campaign. PhishHunter is our lightweight SOAR platform that will help you automatically identify threats, remove false positives and launch your response the moment an employee reports a non-simulated email.
Track security awareness results easier than ever
We took the guesswork out of measuring the impact of your security awareness program. Surface your most impactful data with pre-built dashboards or build your own to display your most important data, your way. Each dashboard will display your most valuable metrics in a single view to simplify your reporting workflow and highlight strengths and opportunities for improvement. You can automatically share your program results by scheduling dashboards to be sent to specific contacts at your organization. The Infosec IQ platform gives you the resources and tools you need to not only achieve your ISO 27001 compliance but to help build a strong organizational culture around cybersecurity. It’s our mission to help you empower and engage all your employees with security awareness and privacy training to stay cyber-safe at work and home. That’s why we continue to develop new training content, materials and tools that inspire lasting behavior change, build a strong cybersecurity culture and reduce your overall cybersecurity risk.
