All businesses come across data that they have to store. For example, companies will gather information on their clients, the various stakeholders they collaborate with, and their employees. How do they protect this data from being stolen and misused?
At Fourthline, we’re proud to have secured the ISO 27001 certification. Certification to ISO 27001 is a globally recognized sign that we are following best practices to protect the security of the information we hold.
This certification is not mandatory, and it takes time, money, and a concerted company-wide commitment to implement and maintain all its requirements. So why do we believe it makes business sense? And what can you do to obtain it? Laura Sumajow, Fourthline’s Security Officer, answers.
How can ISO 27001 certification help protect your company data?
The ISO 27001 standard approaches information security from a risk-based perspective: what information should be protected to what extent in order to prevent negative consequences for your organization?
As an organization, you have to understand what information is critical to keep your business running: What information is needed by your employees on a day-to-day basis to perform their jobs and deliver your product/service to your customers? What information should be protected at all times to be compliant with applicable laws and regulations or contractual agreements?
Once your organization has a clear picture of this, it can define the appropriate measures for protecting the information it wants and needs to protect. This is where the ISO 27001 comes into play and can be of essential value.
What does it take to reach ISO 27001 standard?
The ISO 27001 standard contains generic and internationally recognized guidelines, not only on how to continuously manage your information security but also on how to continually improve it.
If this is something of interest to your organization, you can pay to receive a copy of the ISO 27001 standard. The experts responsible for data security within your organization will then follow the instructions from the standard by implementing an effective system (called Information security management system or ISMS) which has to follow two core elements.
The first one concerns the security controls around the information your organization holds. For instance, ISO 27001 imposes that you prevent unauthorized access to confidential information. Moreover, conflicting duties and areas of responsibility must be clearly defined and separated to avoid data misuse. They are more requirements. If you would like to explore them further, they’re available here.
The second core element requires that processes are put in place to ensure that the controls are tailored to your organization's specific needs and are continuously monitored, updated, and improved to provide adequate protection of your data.
How do you obtain the ISO 27001 certification?
To obtain the ISO 27001 certification, an accredited third party comes over to perform an external audit and confirms that your implementation of the processes and controls from the standard is compliant. This is a way to increase customers’ trust in the effectiveness of your information security and the safety of their data in your hands.
Fourthline is proud to have EY CertifyPoint as their certification body, which will return each year to perform an audit.
Does ISO 27001 make business sense?
Absolutely. Obtaining the ISO 27001 certification is a real commitment. For example, at Fourthline, it took a team of three dedicated security team members and the whole company's support.
However, by getting certified, we are able to demonstrate that we have the best information security controls in place. For customers and other stakeholders, it provides confidence that their sensitive data is adequately protected.
ISO accreditation is an essential gateway to ensuring your business and its reputation are protected. It can safeguard the assets of your existing customer base, unlock new opportunities, and improve efficiencies across all areas.
For a company like Fourthline, which authenticates millions of identities for banks and fintechs daily, it is considered a non-negotiable and dovetails into compliance with related security standards, such as GDPR and local AML regulations.
We are proud to have achieved ISO 27001 certification because it underscores our commitment to providing an excellent standard of service to our KYC/AML partners.
Laura Sumajow
