![]()
CHAPTER 1: WHAT ARE ASSESSMENTS?
Assessments are a way of finding out whether an organisation’s internal management policies and processes match up to the requirements laid down in certain management standards. It is the same as an audit. If an assessment finds the specification is being met then the organisation being assessed can be certificated or registered as conforming to that standard. This means that the organisation is awarded a certificate to demonstrate compliance with the requirements of the standard against which the assessment was conducted.
Each standard addresses one discipline, and has a document defining the requirements that have to be met for certification to be awarded – this document is the Specification. Each specification describes the requirements that must be satisfied in order to provide a sound structure and approach to provide a degree of assurance over the practices and arrangements in the specific discipline the standard addresses.
The following is a list of some of the disciplines that are most commonly recognised as management system standards:
- Quality Management: ISO9001
- Environmental Management: ISO14001
- Information Security Management: ISO27001
The ‘ISO’ number indicates that the standard is published by the International Standards Organisation, and thus is recognised world-wide as the specification for that discipline.
By inviting an approved ‘third party accredited certification body’ to come and assess its systems and arrangements against one of these standards, your organisation gives itself the opportunity, if successful, to demonstrate to your stakeholders, customers and the public, as well as staff, that you operate good practice. There is an increasing tendency for corporate clients to demand that potential suppliers are, or become, ISO27001 certificated in order to win contracts, providing an assurance that the supplier can be trusted with their data.
The auditor works for a ‘third party accredited certification body’, which is itself monitored and approved (accredited), in the UK by the United Kingdom Accreditation Service (UKAS). UKAS is one of a network of national accreditation bodies who have all signed up to an agreement which means that a UKAS endorsed certificate will be recognised world-wide. There are equivalents to UKAS all around the world, including ANAB in the United States, INAB (Ireland) and CNAS (China) as examples.
A UKAS recognised certificate will have the following mark on it:
![]()
CHAPTER 2: WHY INFORMATION SECURITY?
The specification for information security management, ISO27001, defines information security as:
Information Security: The “preservation of confidentiality, integrity and availability of information; in addition, other pro...
