2The ISO 27001 Standard

One morning a message reached the village from a big client in a faraway city. He wanted to send them his designs, but he had written just one question: “How do I know my secrets are safe with you?”

Fawzooz read the message to the people around him: the young man, Uncle Saleh, and the mother, who sends out the workspace’s invoices to clients. “Let’s write back and tell him we’re trustworthy,” said the young man. Fawzooz smiled. “Everyone writes that, my friend. A client isn’t reassured by words, but by a system he can see.”

“Trust is built when people know their data is in safe hands.”

So Fawzooz decided to answer the client with a system rather than with words. He chose the international standard ISO 27001, and began applying its principles in the village, one step at a time.

He decided what to protect. Fawzooz sat down with his team and listed the important information they had to protect: client data, new designs and creative scripts. That became the scope of their information security management system.

He led it himself. Fawzooz didn’t hand the job to someone else. He took the lead himself, and gave the team the time and means they needed to write their security policies and put them into practice.

He planned. Fawzooz and his team looked for the dangers threatening their work and the gaps someone might slip through, then calmly weighed each risk and put a matching protection in place.

He trained and ran it. Fawzooz provided what was needed and trained his team, so that everyone worked in a way that kept information safe.

He reviewed how it was doing. Fawzooz gave the system regular reviews and constant monitoring, to be sure it worked and that it adapted to every new danger.

He improved it. And whenever a review turned something up, Fawzooz adjusted the system and made it stronger against the threats that were emerging.

What the village gained

Ideas kept safe. The standard became a fence that protected the village’s ideas and work from theft and sabotage.

Keeping to the law. ISO 27001 also helped Fawzooz meet what data-protection laws require, which reduced the risk of penalties.

Then Fawzooz wrote to the client, explaining step by step how they would protect his secrets. A few days later the designs arrived, together with two more projects. Fawzooz turned to the mother with a smile. “New invoices, Auntie.” Then he pinned a sheet of paper above his desk that read: “We don’t ask for trust with words; we build it with a system.”