ISO/IEC 27001: Information Security Management system

ISO/IEC 27001 Certification is designed to ensure the compliance and effectiveness of an information security management system, in terms of protecting their confidentiality, integrity and availability.

Who is the service for?

The certification standard is aimed at organisations of all sizes and types. Indeed, information security does not only concern privacy and personal data, but also intellectual property, process data and the output of computer and telematic services. Every company that handles information is potentially affected.

ISO/IEC 27001 helps organisations assess the risks to the confidentiality, integrity and availability of the information they wish to protect, in order to select the organisational and technical countermeasures to be taken to reduce these risks to acceptable levels.

What are the advantages? 

• Effective management of the entire information life cycle through a risk-based approach
• Management of adverse situations with a view to prevention and continuous improvement
• Monitoring the implementation of risk management policies and procedures
• Containment of economic and reputational risks related to data breaches
• Enhancement of investments related to information processing
• Gaining a reputational advantage with its customers by demonstrating attention to the security of their information
• Strengthening of the company's image with stakeholders and competitive market positioning

Certification process 

• Completion of the information questionnaire
• Receipt of the technical-economic offer which, once accepted, constitutes the service provision contract
• Carrying out the audit activities (on-site and off-site), and issuing the final report
• If the previous stages are successful, certification is assessed by a Technical Committee
• If the previous steps are successful, issue of the certificate of conformity
• Annual audit to maintain the certificate.

Following the issue of the certificate, "Surveillance Audits" must be carried out annually from the date of first certification. The duration of ISO/IEC 27001 certification is three years, renewable at the end of the three-year period.

Why RINA?

RINA is accredited by Accredia for ISO/IEC 27001 certification, and with this accreditation can extend certification to the Guidelines for Cloud Services (ISO/IEC 27017, ISO/IEC 27018), Incident Management (ISO/IEC 27035) and Privacy Management (ISO/IEC 27701).

Our audit teams are made up of professionals with high expertise in IT and Security, ICT auditing (CISA auditors, ITIL certified), technical experts in the technology fields, and experts in industry regulations.