IT Management System

Information Security Management System.

Information is the lifeblood of all organizations and can exist in many forms. It can be printed or written on paper, stored electronically, transmitted by mail or by electronic means, shown in films, or spoken in conversation. In today's competitive business environment, such information is constantly under threat from many sources. These can be internal, external, accidental, or malicious.

There is a need to establish a comprehensive Information Security Policy within all organizations. You need to ensure the confidentiality, integrity, and availability of both vital corporate information and customer information.

An Information Security Management System (ISMS) is a systematic approach to managing sensitive company information so that it remains secure. It encompasses people, processes and IT systems.

ISO/IEC 27001:2013 establish best practices of control objectives and controls in the following areas of information security management:

Security policy;
Organization of information security;
Asset management;
Human resources security;
Physical and environmental security;
Communications and operations management;
Access control;
Information systems acquisition, development and maintenance;
Information security incident management;
Business continuity management;
Compliance.

SCOPE

This International Standard covers all types of organizations (e.g. commercial enterprises, government agencies, not-for profit organizations). This International Standard specifies the requirements for establishing, implementing, operating, monitoring, reviewing, maintaining and improving a documented ISMS within the context of the organization’s overall business risks. It specifies requirements for the implementation of security controls customized to the needs of individual organizations or parts thereof.

The ISMS is designed to ensure the selection of adequate and proportionate security controls that protect information assets and give confidence to interested parties.

References to ‘business’ in this International Standard should be interpreted broadly to mean those activities that are core to the purposes for the organization’s existence.

APPLICATION

The requirements set out in this International Standard are generic and are intended to be applicable to all organizations, regardless of type, size and nature.

Any exclusion of controls found to be necessary to satisfy the risk acceptance criteria needs to be justified and evidence needs to be provided that the associated risks have been accepted by accountable persons. Where any controls are excluded, claims of conformity to this International Standard are not acceptable unless such exclusions do not affect the organization’s ability, and/or responsibility, to provide information security that meets the security requirements determined by risk assessment and applicable regulatory requirements.

If an organization already has an operative business process management system (e.g. in relation with ISO 9001 or ISO 14001), it is preferable in most cases to satisfy the requirements of this International Standard within this existing management system.

FEATURES OF ISO 27001(ISMS)

ISO 27001 is the standard generic in nature applicable to all business sectors which globally recognized standard for information security management systems. Information security management system certification may be combined with certification to other management system standards, e.g. ISO 9001, ISO 14001 and OHSAS 18001.

The standard provides a comprehensive approach to security of information needing protection, ranging from digital information, paper documents, and physical assets (computers and networks) to the knowledge of individual employees. Subjects to address include competence development of staff, technical protection against computer fraud, information security metrics and incident management as well as requirements common to all management system standards such as internal audit, management review and continuous improvement.

General Requirements

Documentation shall include records of management decisions, ensure that actions are traceable to management decisions and policies, and the recorded results are reproducible.

It is important to be able to demonstrate the relationship from the selected controls back to the results of the risk assessment and risk treatment process, and subsequently back to the ISMS policy and objectives.

Documentation Requirements

The ISMS documentation shall include:

Documented statements of the ISMS policy and objectives
The scope of the ISMS
Procedures and controls in support of the ISMS
A description of the risk assessment methodology
The risk assessment report
The risk treatment plan

ISO 27001:2013 IMPLEMENTATION BENEFITS

ISO/IEC 20000 certification demonstrates that an organization has adequate controls and procedures in place to consistently deliver a cost effective, quality IT service. ISO 27001 implementation improves / leads to

Management Understanding of the Value of Organisational Information
Customer Confidence, Satisfaction and TRUST
Business Partner Confidence, Satisfaction and TRUST e.g. Handling Sensitive Information of Customers & Business Partners
Level of Assurance in Organisational Security & QUALITY
Conformance to Legal and Regulatory Requirements
Organisational Effectiveness of Communicating Security Requirements
Organisational Effectiveness of Communicating Security Requirements
Employee Motivation and Participation in Security (Best Practices)
Organisational Profitability
Management and Handling of Security Incidents
Ability to Differentiate Organisation for Competitive Advantage
Organisational Credibility & Reputation
Ability to Differentiate Organisation for Competitive Advantage
Organisational Credibility & Reputation

WHY CHOOSE SGQ Innovations?

Team SGQ Innovations has IRCA certified 27001:2013 auditors for Consulting Services
Hands on experience of Team SGQ Innovations in implementing other information security tools such as ISO 20000, CMMi would help to gain early benefits

TRAINING

We offer a customized training program on ISO 27001:2013 for

ISO 27001 - Implementation and documentation requirements
ISO 27001 - Internal Auditor training

SGQ Innovations is one of the leading professional consulting firm for ISO/IEC 27001 Information Security Management System (ISMS) certification. We are the ISO/IEC 27001 consultant and consulting for ISO/IEC 27001 Certification, ISO/IEC 27001 Training, ISO/IEC 27001 Implementation, ISO/IEC 27001 Documentation in Hyderabad, India

IT Service Management requires an integrated approach to effectively deliver those services that truly meet customer and business requirements. To do this, established and professional methods and processes are needed.

A recognized solution to this problem is to use an IT Service Management System (ITSMS) based on ISO/IEC 20000, the international standard for IT service management. Certification to this standard enables you to independently demonstrate to your customers that you meet best practice.

ISO/IEC 20000 is based on and replaces BS 15000, the internationally recognized British Standard. ISO 20000 is the world's standard for IT service management. The standard specifies a set of inter-related management processes, and is aligned with and complementary to the process approach defined within the IT Infrastructure Library (ITIL) from The Office of Government Commerce (OGC).

The standard defines a comprehensive and closely related set of service management processes and comprises two parts:

Part One is the specification for service management which covers the IT service management. It is this part which you can be audited against and it sets out minimum requirements that must be achieved in order to gain certification.

Part Two is the code of practice for service management, which describes the best practices for service management processes within the scope of the specification.

ISO/IEC 20000 defines the requirements for a service provider to deliver managed services of an acceptable quality for its customers.

It may be used:

by businesses that are going out to tender for their services;
by businesses that require a consistent approach by all service providers in a supply chain;
by service providers to benchmark their IT service management;
as the basis for an independent assessment;
by an organization which needs to demonstrate the ability to provide services that meet customer requirements; and
by an organization which aims to improve service through the effective application of processes to monitor and improve service quality.

SCOPE

This part of ISO/IEC 20000 represents an industry consensus on quality standards for IT service management processes. These service management processes deliver the best possible service to meet a customer’s business needs within agreed resource levels, i.e. service that is professional, cost-effective and with risks which are understood and managed.

The variety of terms used for the same process, and between processes and functional groups (and job titles) can make the subject of service management confusing to the new manager. Failure to understand the terminology can be a barrier to establishing effective processes. Understanding the terminology is a tangible and significant benefit from ISO/IEC 20000. This part of ISO/IEC 20000 recommends that service providers should adopt common terminology and a more consistent approach to service management. It gives a common basis for improvements in services. It also provides a framework for use by suppliers of service management tools.

As a process based standard this code of practice is not intended for product assessment. However, organizations developing service management tools, products and systems may use both the specification and the code of practice to help them develop tools, products and systems that support best practice service management.

This part of ISO/IEC 20000 provides guidance to auditors and offers assistance to service providers planning service improvements or to be audited against ISO/IEC 20000-1.

APPLICATION

ISO 20000 is applicable to any organization, large or small, in any sector or part of the world which relies on IT services. The standard is particularly suitable for internal IT service providers, such as IT departments, and external IT service providers, such as IT outsourcing organizations.

The standard is already making a positive impact in some of the leading IT-dependent sectors, such as the business process outsourcing, telecommunications, finance and public sectors.

FEATURES OF ISO 20000:2011

Documentation Requirements

The senior responsible owner should ensure that evidence is available for an audit of service management policies, plans and procedures, and any activities related to these.

Much of the evidence of service management planning and operations should exist in the form of documents, which may be any type, form or medium suitable for their purpose.

The following documents are normally considered suitable as evidence of service management planning.

Policies and plans
Service documentation
Procedures
Processes
Process control records.

There should be a process for the creation and management of documents to help ensure that the characteristics described are met.

ISO 20000:2011 IMPLEMENTATION BENEFITS

ISO/IEC 20000 certification demonstrates that an organization has adequate controls and procedures in place to consistently deliver a cost effective, quality IT service.

Some of the key benefits are listed below:

ISO/IEC 20000 is fully compatible with the ITIL (IT Infrastructure Library) framework of best practice guidance for ITSM processes
IT service providers become more responsive to services which are business led rather than technology driven
External service providers can use certification as a differentiator and win new business as this increasingly becomes a contractual requirement
Gives you the ability to select and manage external service providers more effectively
More opportunities to improve the efficiency, reliability and consistency of IT services impacting costs and service
Certification audits enable the regular evaluation of the service management processes, which helps to maintain and improve effectiveness
The certification process can reduce the amount of supplier audits, thereby reducing costs

WHY CHOOSE SGQ Innovations?

Team SGQ Innovations has IRCA certified ISO 20000 auditors for Consulting Services
Hands on experience of Team SGQ Innovations in implementing other information security tools such as ISO 27001, CMMi would help to gain early benefits

TRAINING

We offer a customized training program on ISO 20000 for

ISO 20000 - Implementation and documentation requirements
ISO 20000 - Internal Auditor training

ISO 22301:2012 - Societal security -- Business continuity management systems

ISO 22301:2012 specifies requirements to plan, establish, implement, operate, monitor, review, maintain and continually improve a documented management system to protect against, reduce the likelihood of occurrence, prepare for, respond to, and recover from disruptive incidents when they arise.

The requirements specified in ISO 22301:2012 are generic and intended to be applicable to all organizations, or parts thereof, regardless of type, size and nature of the organization. The extent of application of these requirements depends on the organization's operating environment and complexity.

Maximize quality and efficiency

ISO 22301 provides a framework based on international best practice based around the 'Plan, Do, Check, Act'. concept.

Resilience

Whether its an international disaster or localised disruption, your organization will be robust enough to be able to get up and running again quickly, or minimize disruption until normal service is resumed.

Reputation

Keep your reputation secure.

Competitive advantage

Opens new markets and helps you win new business. Gain client confidence through the universal acceptance of ISO standards that open up global opportunities.

Win more contracts more cost effectively

Provides you with a marketing edge and, coupled with certification, can help reduce the cost of tendering.

Business improvement

Certification requires a clear understanding of your entire organization which can identify opportunities for improvement.

Continuous improvement

The certification process involves regular audits that ensure your management system is up to date

Compliance

Demonstrate that you meet the requirements of applicable laws and regulations.

Cost savings

You'll have the opportunity to reduce the burden of internal and external BCM audits, improve financial performance and reduce business disruption insurance premiums.

Delivery

Your BCMS framework supports rehearsed management processes that allow you to supply an agreed level of critical services and products within a specified timeframe after disruption.

Management

A BCMS provides proven management capability during times of disruption.

CMMI for Development (CMMI-DEV), provides a comprehensive integrated set of guidelines for developing products and services.

The CMMI-DEV model provides guidance for applying CMMI best practices in a development organization. Best practices in the model focus on activities for developing quality products and services to meet the needs of customers and end users. The CMMI-DEV, V1.3 model is a collection of development best practices from government and industry that is generated from the CMMI V1.3 Architecture and Framework. CMMI-DEV is based on the CMMI Model Foundation or CMF (i.e., model components common to all CMMI models and constellations) and incorporates work by development organizations to adapt CMMI for use in the development of products and services.

Based on the understanding of the requirements, SGQ INNOVATIONS proposes the following four phase approach for achieving CMMI-DEV Maturity Level 3/5.

o Phase 1: Process Analysis and Project Planning

o Phase 2: Process Definition and Release

o Phase 3: Process Piloting and Deployment

o Phase 4: Process Verification

The CMMI-SVC model provides guidance for applying CMMI best practices in a service provider organization. Best practices in the model focus on activities for providing quality services to customers and end users. CMMI-SVC integrates bodies of knowledge that are essential for a service provider.

The CMMI-SVC, V1.3 model is a collection of service best practices from government and industry that is generated from the CMMI V1.3 Architecture and Framework.

CMMI-SVC is based on the CMMI Model Foundation or CMF (i.e., model components common to all CMMI models and constellations) and incorporates work by service organizations to adapt CMMI for use in the service industry.

CMMI-SVC provides a comprehensive set of best practices for providing services. CMMI for Development (CMMI-DEV) can be treated as a reference for the development of the service system, which supports delivery of the service [SEI 2010a].

The CMMI-ACQ model provides guidance for applying CMMI best practices in an acquiring organization. Best practices in the model focus on activities for initiating and managing the acquisition of products and services to meet the needs of customers and end users. Although suppliers can provide artifacts useful to the processes addressed in CMMI-ACQ, the focus of the model is on the processes of the acquirer.

The CMMI-ACQ, V1.3 model is a collection of acquisition best practices from government and industry that is generated from the CMMI V1.3 Architecture and Framework.

CMMI-ACQ is based on the CMMI Model Foundation or CMF (i.e., model components common to all CMMI models and constellations), the CMMI Acquisition Module, and the Software Acquisition Capability Maturity Model (SA-CMM) [SEI 2002].CMMI-ACQ also incorporates work by acquisition organizations to adapt CMMI for use in an acquisition organization.