ISO 27001 and ISO 27002 2022 updates
ISO/IEC 27001:2022 – the newest version of ISO 27001 – was published in October 2022.
Organisations that are certified to ISO/IEC 27001:2013 have a three-year transition period to make the necessary changes to their ISMS (information security management system).
For more information about ISO 27001:2022 and its companion standard, ISO 27002:2022, and what they mean for your organisation, please visit ISO 27001 and ISO 27002: 2022 updates
Download your copy of ISO 27001:2022 here
Download your copy of ISO 27002:2022 here
Why is penetration testing important for ISO 27001 compliance?
Effective penetration testing involves the simulation of a malicious attack against the security measures under test, often using a combination of methods and tools.
A certificated, ethical professional tester conducts tests. The resultant findings provide a basis upon which security measures can be improved.
Penetration testing is an essential component of any ISO 27001 Information Security Management System (ISMS), from initial development to ongoing maintenance and continual improvement.
ISO 27001 control objective A12.6 (Technical Vulnerability Management) states that ’information about technical vulnerabilities of information systems being used shall be obtained in a timely fashion, the organisation's exposure to such vulnerabilities evaluated and appropriate measures taken to address the associated risk’.
Why should you conduct a penetration test?
The nature of information technology assets means they may have many technical vulnerabilities that external attacks could exploit.
Automated and indiscriminate attacks target identifiable vulnerabilities in hardware and software irrespective of the organisation that has them.
These vulnerabilities include un-patched software, inadequate passwords, poorly coded websites and insecure applications.
The logical point at which you should carry out a penetration test is once you have identified the assets to be included in the scope of your ISMS.
The penetration test results will identify vulnerabilities in detail, together with the threat that can exploit them, and will usually also identify appropriate remedial action.
The identified threats and vulnerabilities will then form a key input to your risk assessment, while the identified corrective action will inform your selection of controls.
How does penetration testing fit into my ISO 27001 project?
There are specific points in your ISMS project at which penetration testing has a significant contribution to make:
- As part of the risk assessment process, uncovering vulnerabilities in any Internet-facing IP addresses, web applications, or internal devices and applications, and linking them to identifiable threats.
- As part of the risk treatment plan, ensuring that controls which are implemented work as designed.
- As part of the ongoing continual improvement processes, ensuring that controls continue to work as required and that new and emerging threats and vulnerabilities are identified and dealt with.
How does IT Governance penetration testing work?
Once we have agreed on a scope of work with you, we will agree on detailed testing plans, considering your security objectives and your business, regulatory and contractual requirements.
Our professional testing team will then execute the agreed tests:
- External tests, focusing on internet-facing IP addresses, web applications and other such services.
- On-site tests, focusing on the devices – including wireless devices – that make up your network, and the various applications and operating systems that run on them.
Once we have completed our tests, we will produce a detailed report that sets out our findings. This report will include an assessment of any vulnerabilities, and our recommendations for appropriate remediation.
Discover our full range of penetration testing services today