Scanning documents and ISO-27001

Question

We are planning to submit a project to our managers about scanning all our office papers and deal with PDF instead of physical-format documents.

For doing that, we are loooking for some support, if there is any, for claiming that scanning documents is a good practice that is aligned to ISO/IEC-27001 policies.

We know that the main purpose of an ISMS, based on ISO/IEC 27001 requirements, is to reduce the risk of losing information or unauthorized access to it.

However, do you think that we could align the activity of scanning documents with ISO/IEC 27001 recommendations?

We were thinking that getting PDF files reduce the risk of losing physical-format documents, because file backup procedures are more secure than protecting papers.

Answer 1

In theory it is entirely possible that digitising paper documents could improve their overall security, but it depends on the specifics and how well protected/controlled the current environment is, and whether that will be improved once the new project is rolled out.

If you're looking to make this case, you could look at your organisations current risk register to see if there is anything there relating to storage and management of physical documents and then assess whether your project will address these risks. If it will then you could easily claim that the project is in-line with the goals of ISO27001.

Of course that could be slightly disingenuous as it doesn't take account of new risks being introduced by the project, but then hopefully you'll already have those under control in the project risk register.

Answer 2

Where you would want to align would mostly be with your Information Security Management System's:

• Statement of Applicability: are there additional legal/regulatory requirements and contractual obligations of interested parties in scope of your ISMS (e.g. storing certain cardholder data electronically is out of compliance with PCI DSS requirements, a contractual agreement with your client states that data should not be duplicated without their permission).
• Risk Assessment/Treatment: (is there greater, unacceptable risk to CIA if storing/transmitting/disclosing information electronically vs. via hard copy)
• Business Continuity: (how does storing information one way or the other affect the ability to operate critical business functions if the media becomes unavailable)

Your ISMS Statement of Applicability should probably already cover Media Handling (A.8), Access Control (A.9) and Cryptography (A.10) controls that would include information in both physical and electronic format.