Measuring the Effectiveness of ISO/IEC 27001 ISMS

Introduction

Recent cybersecurity studies indicate that, of the organisations that suffered a data breach, nearly 60% of them had a security framework established. This alarming statistic indicates that the world of information security suffers from a lack of control, as implementation, in the case of the security framework, does not equal effectiveness. Sophisticated cyber threats demand more than an Information Security Management System (ISMS). The actual challenge comes from the need to do more than create the framework; it comes from the need to prove that the framework will be effective in the cases that it is most needed.

The ISO/IEC 27001 ISMS is the internationally accepted standard for information security risk management, and it is the most reliable framework for trusted data protection. However, using a standard in a checklist manner is a risky approach. Keeping the standard’s goal of stakeholder satisfaction in mind, it is important to note that compliance with a standard is not assumed to create an effective ISMS. This article discusses the best means to ensure that the ISMS will be a framework of protection that is both dynamic and effective.

Increasing Interest in Security Performance Analytics

Stakeholder interest has moved beyond simple demonstrable compliance of practices evidenced by a certificate. They want proof of operational effectiveness of the security practices. With rapid changes in cyber threats, any risk assessment completed 6 months ago could be outdated. This means that measuring the performance of the ISO/IEC 27001 ISMS has become a necessity for the business rather than a mere technical need.

Across the world, and in particular Australia, regulators are progressively increasing the requirements for public and private sector organisations regarding data privacy and security. The question is moving from, ‘are you compliant?’ to ‘how effective is your compliance?’ This is a very important distinction. Organisations that do not withstand the measurable effectiveness of compliance will face regulatory and reputational consequences. Businesses are then able to focus on measuring effectiveness and monitoring to shift the ISMS from a cost centre to a trust and resiliency building instrument.

Understanding Core Concepts of ISMS Measurement

When measuring a system, it is crucial to comprehend what is being measured. ISO/IEC 27001 ISMS applies a risk management process to protect the confidentiality, integrity, and availability of the information. In this measurement context, the term effectiveness refers to the achievement of intended activities and intended outcomes. Effectiveness is verifying that the chosen controls are indeed mitigating risk to an acceptable level.

At this stage, key definitions are often misunderstood. Monitoring is the act of ascertaining the state of a system, process, or activity. Measurement is the act of determining a numerical value. Analysis is the act of studying information to identify patterns or relationships, and evaluation is the act of comparing the outcomes of the analysis against a predetermined standard to determine whether the objectives have been achieved. Successful organisations are those that develop systems to integrate all four components as a feedback loop to facilitate ongoing improvement.

The “Plan-Do-Check-Act” Reality
“You cannot manage what you cannot measure.” — Peter Drucker.

While often quoted, this principle is the heartbeat of ISO/IEC 27001. Clause 9.1 specifically mandates that organizations must determine what needs to be monitored and measured. Without this data, your Check phase in the PDCA cycle is essentially guesswork, making the Act phase impossible to execute effectively.

Common Pitfalls in Security Performance Tracking

There may be less time and effort available to be spent on implementing certain measurement techniques and methodologies which are vital to capturing performance measures. One measurement system that organisations fall victim to is metric overload, which is when organisations begin to measure everything that is easy to measure instead of what is actually important. For example, measurement reports that state, 10,000 packets from a firewall were dropped, may sound impressive at face value; however, this report does very little to communicate the state of security or the usefulness of an implementation of an ISO/IEC 27001 ISMS when it comes to the mitigation of specific business risks.

A primary challenge is the disconnect between the technical metrics and the business objectives. Reports from the IT teams are often laden with technical terms and jargon that the executive teams are unable to convert into business risks. This gap in alignment contributes to a security investment being poorly funded because management does not see the ROI. Also, the reliance on manually collecting data adds costs in terms of erroneous data, and the lag time in a report, which means the data is often too old to be actionable. The cost of inaction is significant; measurement strategies that are out of date by the time an analysis is performed surface gaps that are ripe for vulnerabilities.

Bridging the Gap Between Compliance and Reality

It’s understandable to feel anxiety over the necessity to assess efficacy. Organisations consistently cite the Performance Evaluation section of ISO/IEC 27001 as one of the more troublesome elements of audit preparation. This is understandable as the internal audit system’s primary failure appears to be the inducing of failure. However, finding weaknesses through self-imposed internal measurements is actually a success. It indicates that the system failed.

The initial step is validating the concern to mature. Over time, the desired state shifts from an emphasis on measuring inputs and metrics to a focus on risks and the identification of gaps. It is a shift away from a view of measuring everything as an obstacle, to a desire and embracing measurement as a tool to capture and expose system deficiencies. When ISO/IEC 27001 ISMS is utilised to capture weaknesses and make gaps visible, the best use of the standard has been accomplished. This shift helps to relieve the fear of non-compliance and build confidence toward more effective security management.

A Roadmap to Rigorous ISMS Evaluation

Strong metrics building has to do with KPIs and what you are trying to accomplish with security goals. KPIs must be Smart, Measurable, Achievable, Relevant, and Time-defined. For each KPI, try to demonstrate what each KPI is measuring with specific risk treatment objectives. An example of an objective and relevant KPI is reduce the effect of phishing attacks and measuring the efficacy of training based on the documented metrics of the percentage of employees who clicked on a test phishing link, instead of counting how many phishing emails were clicked.

Structuring this scenario means that you perform internal audits, management reviews, and do your technical tasks like vulnerability scans. You have to be sure that the collection of this data is actionable. For example, if a metric describes a control as being unable to work, then the control mechanism should be adjusted and worked on. Featured below is a comparison between standard metrics and the metrics that focus on value that ascribe relevance to work.

Standard vs. Value-Added ISMS Metrics

By shifting focus to these value-added metrics, you ensure your ISO/IEC 27001 ISMS provides actionable intelligence that strengthens your organization’s defense posture.

How RACERT can help

Understanding the details of the process evaluation can be difficult, but it does not need to be done alone. At RACERT, we appreciate how a genuinely good ISMS is one that grows alongside your organisation. For us, certification is not about ticking boxes. We place importance on the benchmarking and credibility of your evaluation to the management system to ensure it is working.

RACERT has the independent, non-biased certification offerings for your initial audit preparation, and for those of you looking to advance your system to the next level. We assess the compliance and integrity mechanisms of your system so you can prove to your stakeholders that you are doing security the right way. We acknowledge that the certification is an operational milestone, not the end of the road.

Frequently Asked Questions

Recent Post