ISO 27001 Audits
ISO 27001 Audits Team Lead
ISO 27001 Audits Team Lead
Former DOJ Attorney
ISO 27001 Audits Team Lead
Former Senior DOJ Trial Attorney
We Help Companies Conduct Internal ISO 27001 Audits and Prepare for External ISO 27001 Certification Audits
With concerns about cybersecurity continuing to grow, regulators are placing increased emphasis on ensuring that companies within their enforcement jurisdiction do enough to protect their customers, clients, patients, and employees’ personal data. Many companies are establishing similar expectations for their vendors as well. In many cases, meeting these expectations means complying with ISO 27001, which the International Organization for Standardization describes as, “the world’s best-known standard for information security management systems (ISMS).” Conducting ISO 27001 audits is an important part of this process.
What FDA-Regulated Companies Need to Know About ISO 27001
As the International Organization for Standardization goes on to explain, ISO 27001 compliance, “means that an organization or business has put in place a system to manage risks related to the security of data owned or handled by the company . . . . With cyber-crime on the rise and new threats constantly emerging, it can seem difficult or even impossible to manage cyber-risks. ISO 27001 helps organizations become risk-aware and proactively identify and address weaknesses.”
While federal agencies like the U.S. Food and Drug Administration (FDA) do not strictly require that regulated entities comply with ISO 27001, they do expect companies to be able to affirmatively demonstrate their efforts to protect individuals’ private data. The FDA has recognized the validity of ISO 27001 as a means of implementing effective cybersecurity protocols, and demonstrating compliance with ISO 27001 is one way that companies can satisfy the FDA’s (and other federal agencies’) expectations in some cases.
As noted above, an important part of managing ISO 27001 compliance is conducting internal audits. While ISO 27001 certification doesn’t require an annual recertification audit, you will need to complete periodic surveillance audits in the off years as part of your effort to maintain continuous compliance. For companies that need ISO 27001 certification, undergoing an external audit is a necessary step in the process as well, so you will need both internal and external auditors. Our lawyers and consultants help companies nationwide conduct internal ISO 27001 audits, and we help companies prepare for external ISO 27001 initial certification audit as well.
Put our highly experienced team on your side
Dr. Nick Oberheiden
Founder
Attorney-at-Law
Lynette S. Byrd
Former DOJ Trial Attorney
Partner
Brian J. Kuester
Former U.S. Attorney
Hon. Kevin McCarthy
55th Speaker, U.S. House of Representatives (ret.)
Government Consultant
Mike Pompeo
Of Counsel
Former U.S. Secretary of State
John W. Sellers
Former Senior DOJ Trial Attorney
Linda Julin McNamara
Federal Appeals Attorney
Nicholas B. Johnson
Former Prosecutor
Roger Bach
Former Special Agent (DOJ)
Chris J. Quick
Former Special Agent (FBI & IRS-CI)
Michael S. Koslow
Former Supervisory Special Agent (DOD-OIG)
Ray Yuen
Former Supervisory Special Agent (FBI)
Conducting an Internal ISO 27001 Audit: Tips, Strategies, and Key Considerations
There are two main reasons to conduct an internal ISO audit. First, internal auditing is itself part of the ISO 27001 standard. Under Clause 9.2, companies must maintain a consistent audit program that is sufficient to critically assess compliance with the standard’s other requirements.
Second, auditing is an essential step in self-assessing compliance with ISO 27001. As a result, even if Clause 9.2 didn’t exist, it would still be prudent for companies to conduct periodic ISO 27001 audits.
When we help companies conduct internal ISO 27001 audits, we take a comprehensive and custom-tailored approach to the internal audit process focused on ensuring not only that our clients can “check the box” under Clause 9.2, but also serving as risk assessment so they have a clear and accurate understanding of their cybersecurity risks. If our clients need to update their information security management system and security controls, we assist them with this as well.
This two-part approach is essential. Simply conducting an internal ISO 27001 audit isn’t enough. If a company ignores (or overlooks) risks uncovered during an internal audit—or that should have been uncovered during an internal audit—this can be just as costly as failing to conduct an audit at all.
When conducting internal ISO 27001 audits, thorough documentation also is critical. Not only must companies conduct internal audits to maintain compliance with ISO 27001, but they must also be able to demonstrate that they have conducted internal audits to maintain compliance with ISO 27001. When a regulator like the FDA or another company wants to know whether a company is doing enough to protect the data in its possession, having documentation on hand to demonstrate a successful audit is critical for avoiding unnecessary adverse outcomes.
At Oberheiden P.C., our lawyers and consultants guide our clients step-by-step through the internal ISO 27001 audit process. Conducting an effective internal ISO 27001 audit is a multi-step process, and each step requires a thorough and detailed understanding of not only the relevant standards, but also the potential implications of failing to meet these standards. At a high level, the major steps in the internal ISO 27001 audit process are:
- Assembling the audit team
- Collecting all ISO 27001 compliance documentation
- Examining the company’s organizational, people, physical, and technological controls
- Examining all other aspects of the company’s ISMS
- Conducting stress testing and other appropriate means of analysis
- Documenting the audit’s findings
- Remediating any adverse findings from the internal ISO 27001 audit
By regularly working with clients to conduct their internal ISO 27001 audits, we are able to streamline the process and help facilitate consistent and well-documented compliance. If you are interested in our internal ISO 27001 audit services, we invite you to contact us to learn more.
Preparing for an ISO 27001 Certification Audit: Making Sure Your ISMS Will Withstand External Scrutiny
Along with helping companies conduct internal ISO 27001 audits, we also help companies prepare for external ISO 27001 certification audits. If your company needs ISO 27001 certification for any reason, our lawyers and consultants can help ensure that you are thoroughly prepared; and, if necessary, we can assist with addressing any issues that arise during your company’s certification audit.
Preparing for an external ISO 27001 certification audit involves anticipating auditors’ concerns and addressing them proactively. Fortunately, since external auditors focus specifically on the standards in ISO 27001, anticipating auditors’ concerns is a fairly straightforward part of the process. However, addressing these concerns can be far more complicated—with each company’s specific obligations depending on the types of data it stores and the scope of its operations.
Since conducting internal ISO 27001 audits is a necessary part of ISO 27001 compliance, we effectively use these audits to serve double duty when our clients are preparing to undergo certification. Conducting an internal audit provides us with clear insight into any threats to certification, and it allows us to help our clients address these risks proactively before the certification process begins.
FAQs: What U.S. Companies Need to Know About ISO 27001 Audits
Are ISO 27001 Audits (and ISO 27001 Compliance) Legally Required in the United States?
No federal laws or regulations currently require companies operating in the U.S. to conduct ISO 27001 audits or maintain ISO 27001 compliance. However, many federal agencies enforce cybersecurity obligations, and many of these agencies will accept proof of ISO 27001 compliance (i.e., an ISO 27001 certification) as evidence of a company’s cybersecurity compliance efforts. Additionally, while not legally required, many companies in the U.S. require vendors and other counterparties to have ISO 27001 certification, and U.S. companies conducting business overseas may need to maintain ISO 27001 compliance as well.
What Does it Take to Pass an ISO 27001 Audit?
Under ISO 27001, companies must implement numerous and varied protocols to protect the sensitive data they have in their custody. This includes not only logical protocols, but physical protocols and documented policies and procedures as well. Passing an ISO 27001 audit involves affirmatively demonstrating that a company has taken all necessary steps to satisfy all of the standards in ISO 27001.
What is the FDA’s Position on ISO 27001 Compliance?
The FDA does not currently require that regulated companies maintain ISO 27001 compliance. However, the FDA has shown interest in migrating from U.S.-specific standards to international standards in recent years, and the FDA has recognized ISO 27001 as a valid standard for implementing effective cybersecurity protocols. Additionally, while the FDA does not require ISO 27001 compliance specifically, it still expects regulated companies to comprehensively address cybersecurity. As a result, while ISO 27001 compliance is not an aspect of FDA compliance, regulated companies may still want to consider ISO 27001 when developing their cybersecurity protocols—particularly if they also sell their regulated products overseas.
Can I Use an ISO 27001 Audit Checklist?
While there are several ISO 27001 audit checklists available online, we do not recommend that companies use these to assess ISO 27001 compliance. These checklists are generic by design, and they do not address all of the company-specific aspects of conducting an effective ISO 27001 audit. While companies can (and should) use checklists or other methods to add structure to the ISO 27001 audit process, the checklists (or other methods) they use must be custom-tailored to their specific needs.
Do I Need a Law Firm to Conduct an Internal ISO Audit?
Working with a law firm when conducting an internal ISO audit serves multiple purposes. Not only will a law firm that has experience conducting audits be able to provide thorough and custom-tailored assistance, but it will also be able to provide legal advice. Cybersecurity failures inherently present several legal risks, and it is critical that companies get the advice they need to manage these risks effectively.
Inquire About Oberheiden P.C.’s ISO 27001 Audit Services
If you would like to know more about our ISO 27001 audit services, we invite you to get in touch. We help companies conduct internal ISO 27001 audits and prepare for external audits as part of the certification process. To speak with a lawyer or consultant at Oberheiden P.C. in confidence, please call 888-680-1745 or tell us how we can help online today.
