Does Your Market Research/Data Analytics Company
Have an Adequate Information Security Program?
If the answer is NO — you need one, now.
If the answer is YES — how do you communicate that fact quickly & easily to clients?
ISO 27001 Certification Can Help —No matter the state of your information security infrastructure
WEBINAR RECORDING - Keeping your Client Data Safe: Updates to ISO 27001 & ISO 27002 – In late 2022, the global information security management system standard, and the standard that serves as its normative reference, were updated. Learn how changes to ISO 27001:2022 effect certified companies and those thinking about getting certified from Juliana Wood, Managing Director, Certification Insititute for Research Quality (CIRQ), and Ron Bernard-Rivera, ISO 27001 Lead Auditor for CIRQ.
WEBINAR RECORDING - Getting to Know the ISO 27001 Information Security Standard – Learn about the preparation, process, and many benefits of certification from those who have done it - featuring Bill Baird, Chief Security Officer, Phoenix Marketing International & Chanttel Allen, Managing Director, The Olinger Group.
The Insights Association has embraced the ISO 27001 Information Security standard as the recommended option for research and analytics companies to use as a framework to implement an Information Security Management System (ISMS). The New York Stock Exchange came to the same conclusion as noted in its recently published Guide to Cybersecurity: "ISO 27001… is a comprehensive standard and a good choice for any size of organization because it is globally-accepted and is the one most commonly mapped against other standards.”
Securing the data that research and analytics companies collect, store and transmit is not solely a technology issue. Effective data security requires a comprehensive plan that includes educating your people and formulating processes to avoid mishandling or unauthorized access.
Is your company bombarded with lengthy data security/data protection questionnaires from current and potential clients? Are you uncertain how to answer these inquiries completely and correctly? Failure to respond to such requests or doing so insufficiently or inaccurately can lead to lost business and/or risk exposure for your company.
ISO 27001 implementation and certification provides your company with a strategic information security framework that can help you win business and educate your staff on key measures for protecting your valuable data. An information security management system (ISMS) consultant can be a valuable resource to help with an implementation timeline, and IA can recommend providers who have worked with company members through their successful audit and certification.
Even if you don’t pursue certification, this globally recognized standard can guide you in identifying your company’s information flow and vulnerabilities and provide you with best practices for implementing and managing an Information Security Management System.
The Certification Institute for Research Quality (CIRQ)'s ISO 27001:2013 program is accredited by the ANSI National Accreditation Board to ISO 17021-1:2015, the ISO standard for certification bodies that provide audit and certification of management systems. CIRQ was formed to provide auditing and certification services globally to market research firms in order to assess their compliance with ISO 20252 and ISO 27001.
What Is ISO 27001?
ISO/IEC 27001 provides a framework for companies to manage their data security. It establishes requirements for information security controls that manage people, processes and technology and protect valuable company data. Certification to this standard demonstrates to existing clients and potential new clients that your company takes information security seriously.
PURCHASE THE ISO 27001 STANDARD
Why is ISO 27001 relevant?
Umbrella framework to meet requirements of:
- Federal – HIPAA, GLB, SOX
- State – MA, CA Privacy laws
- Industry – PCI, DSS
- Contracts – Your Clients
- ISO/IEC 27001 & ISO/IEC 27002 IT Security Techniques Package
Overview of ISO 27001 and ISO 27002 (the controls applicable to ISO 27001)
ISO/IEC 27001
The information security management system preserves the confidentiality, integrity and availability of information by applying a risk management process and gives confidence to interested parties that risks are adequately managed. It is important that the information security management system is part of and integrated with the organization’s processes and overall management structure and that information security is considered in the design of processes, information systems, and controls. The standard can be used by internal and external parties to assess the organization’s ability to meet the organization’s own information security requirements. The order in which requirements are presented in this International Standard does not reflect their importance or imply the order in which they are to be implemented. The list items are enumerated for reference purpose only. ISO/IEC 27000 describes the overview and the vocabulary of information security management systems, referencing the information security management system family of standards (including ISO/IEC 27003[2], ISO/IEC 27004[3] and ISO/IEC 27005[4]), with related terms and definitions.
ISO/IEC 27002 - Relationship to ISO/IEC 27001
ISO/IEC 27001 formally defines the mandatory requirements for an Information Security Management System (ISMS). It uses ISO/IEC 27002 to indicate suitable information security controls within the ISMS, but since ISO/IEC 27002 is merely a code of practice/guideline rather than a certification standard, organizations are free to select and implement other controls, or indeed adopt alternative complete suites of information security controls as they see fit. ISO/IEC 27001 incorporates a summary (little more than the section titles in fact) of controls from ISO/IEC 27002 in Annex A. In practice, most organizations that adopt ISO/IEC 27001 also adopt ISO/IEC 27002.
Role of the Insights Association and ISO quality standards
The Insights Association recognized industry trends regarding information security and data privacy, and directed CIRQ to add ISO/IEC 27001:2013 to its audit and certification sevices in 2016 to specifically support the unique needs of market research and data analytics companies to protect their data, comply with GDPR, and increasingly, US State-level data security legislation. In 2022, CIRQ added ISO/IEC 27701 to its offerings. The standard is a security extension to ISO 27001 and maps to GDPR as the only organizational-level 3rd party certification to meet the EU law.
Visit CIRQ here or contact Juliana Wood, CIRQ's Managing Director, to learn about audit and certification services for your business.