*Edit - Replies so far are re-stating what ISO 27K is and is not. We are aware of this, however the perception of ISO 27K is different. We do not have infosec professionals so we just want to know what other options are out there regardless of subjective opinion.
Example: (UK) Cyber Essentials Scheme. This requires implementing basic essential IT security controls, self-assessment and external review.
A similar question has been asked but without satisfactory reply. Full background:
- We are a business of around 100 people in a few global locations.
- We have been externally certified for ISO 27001, we have only excluded one item from the statement of applicability;
- We do not have a dedicated Information Security professional.
We have become quite dissatisfied with the ISO 27K Standard for the following reasons:
- Assessors are too focused on procedure and documentation rather than actual security
- At no point during any external visits has any assessor even asked about actual web and IT security
- Infractions in documentation generate far too much paperwork in addition to fixing any issues.
- Inconsistency in approach by assessors in different countries
- The amount of time required for maintaining the standard detracts from working on actual cyber security that is not required by the standard such as vulnerability scanning, port scanning, encryption etc etc.
We are mainly a UK/US business. We would like a more IT focused security standard that is recognised in those locations. The only real driver for our ISO standard is its appeal and recognition to our customers. All opinions welcome