3

I would like to bid for contracts where ISO27001 certification is a requirement. I build cloud based bespoke software.

Although I take security extremely seriously - I don't have any formal processes at present. I just try and follow best practice.

How feasible is this? I assume that ISO27001 is all about processes, checks and balances - can this be applied to a single person?

0

3 Answers 3

9

The short answer is that, yes, an individual can get ISO 27001 certification. As the old joke goes, you can ISO 27001 certify a chair...

All the details you wish to know you really need to ask an assessor.

You might find, however, that the costs of obtaining certification are far greater than the potential benefits because you are an individual. Writing policies, establishing processes, auditing those processes, etc. all take time and resources, which you will not be spending working or bidding for contracts.

But your assessor will have all your relevant details.

2

Unlikely, it would be a bit weird. For example one of the security controls that you would need to demonstrate is Segregation of Duties. In your case you may push unsecure software in production with no one to check after you. You may get around it by doing a risk assessment demonstrating that for your organisation the risk is low, or that you accept that risk.

However another requirement is Internal Audit of security controls. A serious assessor would not accept you auditing your own doings.

4
  • But there are ways around these and ways to provide that extra oversight.
    – schroeder
    Sep 21, 2020 at 8:03
  • It says you need a policy on Segregation of Duties, your policy might include a list of duties all assigned to the same person, you might also deem this acceptable due to the size of your organisation and you might have a foot note saying you will expand on your list as your team grows.
    – Joel Davis
    Dec 15, 2020 at 4:25
  • 1
    Adding to this - 27k1 doesn't specify how you develop software, as long as YOU believe you're doing it in a secure, audited and controlled way. If you can prove that your one-person-band development process is secure and you've noted this risk in your risk register, and believe you can justify it - then no problems. ISO = This is how we say we're secure, here's how we define that, and then finally - here is proof we do what we say we do. <--- that's it
    – Trent
    Mar 30, 2023 at 21:25
  • You are right, and after being 3 years wiser I no longer stand behind my answer back then.
    – zyked
    Mar 31, 2023 at 9:26
0

Any organization (even a single-person shop) can adopt ISO 27001/2 at various maturity levels (see below). And, any ISO 27k auditor could audit and attest to your compliance to any of those maturity levels, however, maturity levels 2-5 are considered "audit-ready" for ISO 27k compliance.

Capability Maturity Model (CMM) Levels:

  • CMM 0: Not performed, non-existent security practices (negligent)
  • CMM 1: Performed Informally, ad-hoc security practices (negligent)
  • CMM 2: Planned & Tracked, focused on compliance (vs. security)
  • CMM 3: Well defined practices, focused on security
  • CMM 4: Quantitatively controlled, with metrics
  • CMM 5: Continuously improving

Most unregulated organizations aim for CMM 3 to ensure their organization is "in control," vs. CMM 4 or 5, where the organization is "highly controlled."

I believe the Secure Controls Framework (see https://www.securecontrolsframework.com/) offers some good advice on ISO 27k adoption. I especially like the spreadsheet (hide most columns, except the ISO 27001 and 27002 columns), and descriptions of maturity levels.

1
  • Can an org get certification at CMM 0-1? Or are those there for completeness? You say that one can adopt ISO 27k at various levels. I'm assuming you meant that you can't get certified if you are 0 or 1...
    – schroeder
    Feb 9, 2022 at 17:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .