4

I asked my client (a bank) why they don't certify themselves against ISO 27000 standards. The answer was that if they certified, it would increase the risk of being attacked.

Does that make any sense? Can hackers be aware that some particular company is certified? To my mind, if the company does not state it publicly, no one would ever know... Also, since this is a bank, it already inherently possesses some level of risk.

Improve this question
1
  • 3
    I call BS. It's not even about knowing if an organization is certified. Knowing or not would not make one a target.
    – schroeder ♦
    Commented Mar 13, 2015 at 23:49

1 Answer 1

Reset to default
6

I do not see an increased risk of attack due to being an ISO certified organization.

ANSI (The governing standards body) does not release ISO certified organizations business names. There are organizations that offer you the ability to look up an ISO 27001 certified organization but those organizations have elected to register voluntarily.

I would suspect that another driver (high cost, large time footprint, operational workflow implementation) is behind a lack of desire to become certified.

Improve this answer
2
  • 1
    Do other governing standards bodies also not release the ISO certified organizations' business names? I ask, because I'm not from USA so that ANSI would be applicable to us. Or is it the only governing body for ISO?
    – ZygD
    Commented Mar 14, 2015 at 14:19
  • 1
    ANSI is the only governing body. There are other private organizations that members can join with the purpose of promoting the member status as an ISO certified organization.
    – Citizen
    Commented Mar 18, 2015 at 15:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .