UK Borough Council Case Study

Our client, a large UK borough council, provides residents with a full range of local government services, including social care, children’s services, housing, libraries and environmental services.

In its daily activities, the council processes a vast amount of data relating to residents, businesses and other parties. Much of this data is very sensitive, so its protection is paramount, especially in light of the GDPR (General Data Protection Regulation) and DPA (Data Protection Act) 2018, both of which prescribe severe penalties for data breaches.

The council therefore commissioned IT Governance to carry out a gap analysis against ISO 27001, the international standard for information security management.

We conducted a discovery phase on site over several days, comprising interviews with key stakeholders covering the relevant control areas.

We also reviewed the council’s relevant documents and records, where possible, to determine the extent of their conformity to each control in Annex A.

This analysis included an assessment of:

• Whether each of the Annex A controls was likely to be required by the council and, if they were, whether they were currently in place; and
• The extent to which and/or how consistently the selected controls were implemented, operated, monitored and evaluated.

Our consultant then produced a compliance status report detailing the findings for each Annex A control, complete with recommendations for improvement.

Comparing the council’s existing security practices against international best practice provided a clear understanding of where improvements can be made, organised according to importance.

The findings of our gap analysis report were colour-coded to help our client prioritise its approach to improving its information security practices: red to indicate nonconformity with the relevant control requirements, yellow to indicate partial conformity and areas where improvement could be made, and green to indicate conformity.

Implementing an ISMS is a significant undertaking that requires focused investment of time and resource across the entire organisation. Gaining the necessary high-level support for such a project therefore takes time, and not every organisation has the capacity to achieve full compliance with ISO 27001 immediately.

Although the council is not yet in a position to implement all the elements of an ISO 27001-compliant ISMS or pursue certification to the Standard, we recommended adopting an overarching information security policy. We therefore supplied a sample policy as part of our report.

IT Governance’s ISO 27001 Gap Analysis service provides a specialist, in-person review of your information security posture against the requirements of ISO 27001.

This gives you an accurate picture of your ISO 27001 compliance gaps, as well as expert advice on how to scope your project and establish your project resource requirements.

One advantage over questionnaire-based gap analyses is the level of expert analysis and insight you get from a specialist. With an in-person gap analysis, you will have a clear idea of the proposed scope of the ISMS, be able to set realistic project expectations, and obtain customised and detailed information necessary to develop a strong business case for implementing an ISO 27001-compliant ISMS.

Key features

An informed assessment of:

• Your compliance gaps against ISO 27001;
• The proposed scope of your ISMS;
• Your internal resource requirements; and
• The potential timeline to achieve certification readiness.

Find out more about this service