Why do we need information security controls?
Almost every organisation today will hold or handle the personal or financial information of their customers, as well as storing valuable intellectual property and other sensitive data in a digital environment. When cybercriminals are looking for ways to exploit system vulnerabilities, this data is at risk.
For businesses, a cyber security breach can disrupt operations, resulting in significant financial losses, reputational damage, and legal liability. Importantly, it can severely erode customer trust. To protect against these risks, organisations need to implement robust information security controls.
Which information security controls should my business implement?
Effective information security controls are essential for protecting against cyber threats. These controls are designed to prevent, detect, and respond to security incidents. There are several frameworks from Australia, New Zealand and international entities that recommend the information security controls required to address specific risks and threats, including:
- Australian Cyber Security Centre’s Essential Eight: The Essential Eight is a set of eight strategies developed by the Australian Cyber Security Centre (ACSC) to help organisations mitigate cyber risks. These strategies include application whitelisting, patching applications, disabling untrusted Microsoft Office macros, restricting administrative privileges, patching operating systems, multi-factor authentication, daily backups, and user education.
- New Zealand Government’s CERT NZ: CERT NZ is New Zealand’s national computer emergency response team. It provides guidance and support to individuals and organisations to improve their cybersecurity. CERT NZ offers a range of resources, including cybersecurity incident reporting, alerts and advisories, and best practice guidelines.
- UK Cyber Essentials: Cyber Essentials is a UK government-backed scheme that helps organisations protect against common cyber threats. It provides a set of basic cybersecurity controls that organisations can implement to reduce the risk of cyber attacks. The controls include boundary firewalls and internet gateways, secure configuration, user access control, malware protection, and patch management.
- Cloud Security Alliance (CSA) Top Threats: The CSA is a non-profit organisation that promotes best practices for cloud computing security. The CSA Top Threats report identifies the top cloud security risks and provides guidance on how to address them. The report covers ten categories of cloud security threats, including data breaches, insecure interfaces and APIs, and insufficient due diligence.
Implementing information security controls based on these recommendations can help organisations protect against cyber threats and reduce the risk of security incidents. It is important to note that a business would not be expected to implement every control outlined, but rather it would depend on the size and scope of their operation.
Can controls help my business achieve certification?
Information security controls are specific measures that are implemented to address specific risks and threats to an organisation, and are typically designed to mitigate or reduce the impact of those risks. However, they are not the same as an Information Security Management System (ISMS).
An ISMS is a comprehensive framework of policies, processes, and procedures that is designed to manage and protect an organisation’s information and IT systems in a systematic and holistic way based on risk management principles. While information security controls are important to have in place, they are only one part of a broader approach to information security.
ISO 27001 certification requires a third party audit of your ISMS to ensure it meets the global standard set by ISO for information security management. It provides a framework to manage, monitor and improve an organisation’s information security in an efficient and effective way.
Many industries and government bodies require compliance with ISO 27001 as a condition of doing business or operating within a particular jurisdiction, so gaining certification can be a requirement for organisations in certain industries, such as healthcare, finance, and government.
It can also provide a competitive advantage, as customers increasingly choose to do business with organisations that are ISO 27001 certified, regardless of the industry.
