Adam Haskard, Jim Boekel and Thomas Kazan founded Bluerydge, an ISO-certified company that has helped numerous organisations obtain their own ISO certifications. Photo: Bluerydge.
Cybersecurity measures are no longer simply a matter of protecting your employees, clients and stakeholders – they can be the difference between winning or missing out on valuable business, according to one Canberra expert.
Bluerydge founder and CEO Jim Boekel has helped dozens of organisations implement a tried and true methodology that has not only increased their information security position but helped secure business in an increasingly anxious market – ISO 27001 Information Security certification.
He says in a time of dizzying technological advancement and existential cybersecurity threats, there is increasing demand for organisations to adopt this holistic approach to information security and reassure potential clients, customers and partners.
“More and more we’ve noticed this is a requirement when having discussions with potential partners, bidding for tenders and gaining access to work,” Jim says.
“For many potential clients, it’s mandatory you demonstrate you’re prepared and protected. Businesses who want to win more work, or work in new areas must take it seriously.
“People at the board and executive level need to see assurances, too, because they are ultimately responsible for managing the risk of the organisation. Cybersecurity incidents can result in significant remediation costs, reputational damage and worst case sink an organisation.”
A range of cybersecurity standards exists to help organisations minimise these risks and implement security controls for different contexts. Some, like the well-known Essential Eight, focusses more on information technology-specific security and is a great place to start.
The ISO 27001 standard provides a more holistic organisational framework that will cover items such as risk management, incident management, staff education and business continuity planning.
While no methodology can guarantee prevention against the slew of constantly evolving and increasingly sophisticated threats, ISO takes a comprehensive approach.
It requires companies to implement and maintain a robust information security management system and supporting processes covering the confidentiality, integrity and availability of information. Companies must meet a set of core documentation requirements and provide supporting evidence that they have implemented adequate measures to comply with different standards.
In practice, this covers everything from people (which may involve training) to processes (such as onboarding and offboarding from a security perspective) and technology, which may include IT controls such as encryption and multi-factor authentification, hardware, software and even physical security of your premises.
The process is worthwhile but onerous, and many companies are unsure where to begin, or lack expertise or capacity within their organisations. That’s when Bluerydge is called in.
A cybersecurity company that has achieved ISO certification, Bluerydge can consult and implement throughout the process – and the client takes the lead on what level of help they want.
“Some clients want us to guide them every step of the way and get it done. Others might have some capabilities in-house and just need consultation when they hit a snag, or want peace of mind that they’re on the right track because it is a very complex process with many moving parts,” Jim says.
“One of the main onerous tasks is to write ISO-compliant policies, which should be written in the specific context of your organisation. We’ve had companies engage us to assist them with the documentation and procedural components as specialists in the field.
“Having been through the process ourselves and helped numerous clients through it since, we’re very well placed to help other organisations get there.”
Once a company is confident it has met the requirements for ISO certification, it undergoes an independent audit.
As Bluerydge possesses ISO 27001 implementer and auditor-certified staff, the company has further insights to help clients obtain their certification.
“That’s the benefit of having an ISO-certified company, with ISO auditors in-house – we speak the same language and can help you avoid surprises at the final stages,” Jim says.
Bluerydge has helped multiple organisations of all sizes – including not-for-profits – through their ISO journey, taking an approach tailored to their operations and budgets.
Jim says the certification can “absolutely affect your bottom line”.
“Having a well-renowned certification for your business that people can see does impact your ability to go for new work,” he says.
“In the end, you do receive an actual certification that you can advertise as part of your value proposition. That tells your stakeholders that you’re taking cybersecurity seriously, and they’re in good hands.”
For more information visit Bluerydge.
Original Article published by Dione David on Riotact.
