Getting Security Right .... Santa Style

We’ve spent much of 2014 watching the information security mishaps in the global empires of Home Depot, Wal-Mart and Sony, to name but a few. But have we overlooked the risks associated with the largest data controller in the world? It all starts with sacks full of envelopes addressed, in best crayon, to “Father chrismus, Norf pole” (assuming that the local postal service actually delivers them).

The volumes of data handled at this time of year by Mr F. Christmas (also known as Mr S. Claus) and his colourfully costumed, vertically-challenged assistants cross pretty much every national boundary, which at face value would seem to present us with a whole host of data protection challenges.

According to Wikipedia, we’re most likely to find this Data Controller located in the mountains of Korvatunturi in the Lapland Province of Finland. That would subject this global gift procurement and distribution operation to the Finnish Personal Data Act of 1999 (or Henkilötietolaki 1999/523 if you’re a local). From Barbie to Nintendo, we’re not simply talking about a large list of the latest toys, games and gadgets here. Closer examination reveals names, addresses (how else will the big chap know where to deliver), the gender, and possibly ages or dates of birth of quite a lot of children.

Quite a lot? Another quick dip into the internet shows that we now have over 2.2 billion children on this spinning orb we call Earth. Discounting the faiths and cultures in which Santa does not feature, that still leaves us approximately 400 million kids wishing for a reindeer-powered sleigh to land on their roof on Christmas Eve. For now, we’ll overlook the practicalities of landing a heavy sleigh (best estimate = c.320,000 tonnes) laden with presents on a 45° pitched roof of an average semi-detached house, or the eye-watering estimated 650 miles a second or 1,000 visits a second needed to visit them all (depending on which crazy facts website you read). We’ll also gloss over the 200,000+ cousins of Rudolph that a sleigh of this weight would require just to get moving.

Putting our information security hat back on for a moment, you do have to admire how Santa does all this and has yet to be the subject of a global security breach or data protection fine of any sort. Whilst data protection is well structured within the EEA (European Economic Area) within which Santa Enterprises has its headquarters, each year he plans on visiting a good number of nations whose data protection performance is decidedly less robust. Just how is this mountain of delivery data being securely transported on the big night? Does it involve reams of printed documents or the latest in cloud-based Santa-nav apps borrowing unsecured wireless networks he finds along the way? And how is this all being kept secure on the open sleigh as the jolly chap travels up and down far-too-small-for-his-waist chimneys in fractions of a second? Can we assume that Comet and Blitzen may have been trained on sleigh close-protection duties? And when it’s all over, in line with data protection legislation on keeping personal data for no longer than absolutely necessary, how are all these sensitive records properly disposed of on Boxing Day?

I guess we’ll never know. But credit where credit’s due, Father Christmas has done a fantastic job ensuring that order and delivery data has been kept secure for centuries. Once the busy season is over, the red coat has gone in to the dry cleaners, the reindeer are frolicking in the meadow and the sleigh has passed its annual MOT (mountains of toys) test, we should all be looking out for a hand-written CV for that CISO role, complete with Finnish postmark. It may be the best hire we ever made.

Respecting customer confidentiality, we can neither confirm nor deny rumours that Santa is using InfoSaaS to help manage his information security this year. In the meantime, we would like to wish all InfoSaaS customers and partners a Merry Christmas and a happy, prosperous and secure 2015. 

Choosing the Right Risk Assessment Solution

ISO27001 is the international standard for Information Security Management Systems (ISMS), and with an ever increasing number of cyber security threats it's not surprising that so many organisations around the world seek to demonstrate their competencies by achieving ISO27001 certification. At its core is the requirement to implement and manage an effective risk assessment activity, and doing this well is essential to fully protect your organisation and its valuable data.

Traditionally this requirement has been undertaken manually, either being paper-based or in a series of spreadsheets, and in most cases has also required investment in expensive consultants to help establish the initial selection of vulnerabilities and threats, as well as suggesting appropriate security controls to properly manage them. However, keeping an ISMS operating effectively and efficiently requires the development of a range of competencies by the organisation, including tracking and assessing against emerging or changing threat actors and newly discovered vulnerabilities.

This has been most onerous on SMEs, who are unlikely to have a dedicated team of information security professionals devoted to this task. Some have chosen to seek assistance in the form of dedicated risk assessment software, which varies widely in terms of cost (some being more expensive than hiring a dedicated IA professional!), functionality and ease of use. Whilst all such solutions will claim to help organisations streamline and improve the operation of their ISMS - and the risk assessment activities in particular - own own experience with some has been wholly disappointing.

That's the reason behind our decision and commitment to develop and launch InfoSaaS. We've taken our own successful manual methodology and automated it into a cost-effective and highly-functional solution suitable for all sizes of business. Use the library of included risk templates, or use InfoSaaS to design your own if you operate in an unusual sector. We've encompassed the convenience, flexibity and most importantly security of the cloud, which is of great benefit to geographically-diverse organisations. We have not designed InfoSaaS as a community cloud: instead each customer has their own dedicated instance to provide the highest possible levels of confidentiality to their ISMS data. There's no requirement for expensive additional software either.

The project took over three years to complete, and with significant investment by the Company's founders we are committed to becoming a leading provider to those seeking or maintaining ISO27001 certifications. We're now developing a series of language packs in response to requests from a number of countries worldwide.

During our pre-launch trials, not only did we successfully convert all of our existing customers from their manual approach, but we also sought the opinions and feedback of several of the most credible and respected IA consultancies within the UK. Their testing regime was extremely thorough, but we are pleased to note that they have now fully adopted InfoSaaS as their software tool of choice!

At this point, we could become poetic about how we use InfoSaaS for our own ISO27001 certification, or how many UKAS-audit bodies have already issued certificates to our customers. That's all well and good, but we would rather potential customers try it for themselves. We make a fully-featured and secure instance of InfoSaaS available to organisations free for thirty days. No risk, no nonsense. Try it with some of your real data or create a fictitious set - the choice is yours. Simply visit www.infosaas.uk and request a trial today. You'll be glad you did.

InfoSaaS Launches its Cloud-Based IT Risk Management Software

24 November 2014 – InfoSaaS Limited: The "Information Security as a Service" company has announced the launch of its new ISO27001 cloud-based risk assessment software.

It has been designed to enable customers to quickly, simply and cost effectively identify and manage their IT security risks, whilst also making a substantial contribution to their achievement and retention of ISO27001 certification, the international standard for information security.

A combination of high-profile security breaches, increasing data protection legislation and demand from customers to prove that their data is appropriately protected is driving many organisations to realise the need to properly secure their valuable data.

Based upon a proven methodology that has delivered many successful ISO27001 certifications, InfoSaaS enables its customers to identify assets and risk assess their vulnerabilities and threats, which enhances their capability to implement and manage appropriate security controls.

Removing the need for customers to procure, deploy and manage their own hardware and software solution, InfoSaaS is cloud-based which provides security, flexibility and cost effectiveness. This intuitive product is readily accessible from any device type, anywhere, anytime, offering a single pane of glass to view an organisation's information security status.

John Godwin, CEO InfoSaaS, said: “As organisations and individuals entrust more of their valuable information to IT systems, it is vital that data security is understood and properly managed. With new vulnerabilities and threats being reported on a daily basis, the development and operation of an Information Security Management System is one of the most important commitments an organisation can deliver to protect its business activities and its customers.”

Godwin continues: “Traditionally, achieving ISO27001 certification has been a challenge for many organisations, often due to the lengthy nature of the preparation and the common need to engage specialist resources. At InfoSaaS, we have commoditised many years of practical ISO27001 implementation experience into a user-friendly service, which has already helped a number of organisations to successfully realise their information security objectives.”

InfoSaaS is headquartered in the UK, whilst delivering options for an international service offering which allows customers to retain data within their operating territory.

About InfoSaaS

InfoSaaS is an innovative information security software provider, deploying cloud based services globally. Combining over 20 years of IT risk management experience with the latest in web technologies, InfoSaaS, aims to simplify the ISO27001 certification process for its customers.

For further information, please contact:

InfoSaaS Ltd, 145-157 St John Street, London, EC1V 4PW, UK
T: +44 (0) 203 474 1290
E: info@infosaas.uk or visit: www.infosaas.uk

Developing an Appetite for Risk?

Risk assessment methodologies such as InfoSaaS are based around calculating levels of risk, and comparing the result against pre-defined levels determined by the organisation as being their “risk appetite”. But what does this term actually mean, how it is calculated and how does it become a pragmatic yet effective foundation to your Information Security Management System?

From the outset, having an appetite for risk is a strange concept to many, who quite reasonably believe that nobody would willingly accept a risk if it was in any way avoidable, or similarly how can there be a value applied to risk which is, by its very nature, very difficult to assign a number to? To put these opinions into context, information security risk management unfortunately has to deal with a wide selection of potentially “bad things”, from power outages to credit card fraud and component failure to employee theft (amongst many, many more). It is easy to see, therefore, that the effort involved in managing risks is always going to incur cost and effort, as the best result that you can hope to achieve is the predicted events not happening, or business as usual.

Risk appetite is built around the reasonable assumption that not every identified risk should be dealt with at all costs: some will be disproportionately expensive to resolve, and some will have such a low impact on your organisation that implementing complex controls as directed by a policy may be assessed as simply not being an appropriate use of time and money. So how can you determine risk appetite in a pragmatic fashion?

Firstly, how would your organisation like to assess the impact if something bad were to happen? For many this has a direct currency alignment – “we have contingency to fix things if the cost is below £10k, but above that we’d have to divert funds from live operations”. The latter would affect ongoing business if live operations are impacted, so in its crudest form we’ve determined the sort of events that would be acceptable to the organisation, vs. those where we need to simply take a little more care to make sure that they can’t happen. Another method could be to assess the negative impact on the organisation’s credibility or brand reputation for certain events, and identify which need to be avoided at all costs, as a matter of business survival, vs. those that events that customers won’t even notice.

Next, to add some justification to these decisions, by looking at probability and impact. Probability can be assessed by looking for similar events in comparable industries, or assessing media reports of incidents and breaches to see if your organisation could be similarly affected in the future. As noted in the previous paragraph, impact can be measured in hard cash (cost to put right) but is also likely to factor in unwanted negative publicity and resultant competitor advantage.

Most risk assessment methodologies employ a probability vs. impact comparison to determine whether a risk is acceptable – i.e. does the calculated risk fall above or below the organisation’s risk appetite? Within InfoSaaS we use a 5x5 matrix, with corresponding values between 1 and 25. An event that is extremely likely to happen, and even if it did nobody would notice or be affected would be graded as “1”. However, a negative event that is definitely going to happen, and when it does the continued operation of the business is called into question would be graded as “25”.

In our experience, the Senior Management of most organisations will set an acceptable risk limit (or have a risk appetite) of somewhere between “7” (very cautious) through to “12” (more bullish), although we have seen values either side of these. Our own ISMS operates as a “10”. In its simplest form, numbers below 10 (lower probability, lesser impacts) will be accepted as part of the risks of delivering normal business, whilst anything above 10 (more likely to happen, with a greater impact) needs to be carefully looked at to see if better security controls can be implemented, or whether existing security controls need to be delivered in a more effective way.

If your organisation is struggling with delivery effective risk assessments, you should consider taking a free trial of InfoSaaS to see how our solution helps achieve meaningful results. If you would like to find out more about us, please visit our website at www.infosaas.uk or call 0203 474 1290. 

Risk Terminology for Beginners

Amongst the key requirements of the ISO27001 Information Security Management System standard are activities related to the establishment, implementation, operation and management of an effective risk assessment framework. The standard expects that all relevant “threats” and “vulnerabilities” are assessed, but do we fully understand the difference between these two terms and “risk”?

A vulnerability is a weakness in an asset that by its ongoing existence could be used to cause it some damage or disruption, for example the existence of weak passwords, or not applying the latest security patches. A threat, on the other hand, is an activity (human based or an Act of God) which has the potential to exploit an asset's vulnerabilities to cause harm: examples including computer viruses, activities of hackers or extremes of weather. Generally speaking organisations will be spending more time and effort on identifying and addressing vulnerabilities (the majority of which will be within their power to manage) instead of external threats (the nature of which is not often fully know by the organisation).

Risk is the combination of the probability (or likelihood) of something bad happening, and the impact on the asset (and therefore the organisation) if it were to do so. These two variables of probability and impact allow risk assessments to prioritise where action is needed most: a risk that is definitely going to take place and has the potential to threaten the organisation’s very existence will receive more urgent attention than very occasional risks that have such a negligible effect that nobody is likely to even notice them.

That is the reason why a formal, structured and effective risk assessment regime is so important to the protection of an organisation’s data, or the data of customers which has been entrusted during the provision of a service. There is no value in cutting corners to file incomplete or poorly completed assessments, as there is rarely the opportunity of a second chance to have another look once a serious information security breach of system failure has already taken place. By then the damage has been done.

Risk assessment is commonly perceived as a “dark art”, but there is no reason for this view. All that is needed is a framework which acknowledges a wide variety of vulnerabilities and threats, as applicable to the operations of the organisation, and diligent, trained employees who understand what they are being asked to do, and the importance of doing it well. Effective risk assessments allow the organisations to identify, implement or change the controls (or "good" activities) that are in place to manage, control, reduce or remove vulnerabilities and the likelihood of their exploitation by threats.

This is the sole reason why we have been developing InfoSaaS, which will very soon be helping organisations around the world take controls of the security of their information assets. Far from being a dark art, we want to be sharing the best practice which has allowed our methodology to underpin the successful ISO27001 accreditations of organisations for many years.

Visit our website www.infosaas.uk or call us on 0203 474 1290 to find out more.

Social Media, Identity Theft and Corporate Risks

Introduction

The growth of web-based social media applications such as Facebook, Twitter and LinkedIn presents a set of unique challenges to organisations, both with respect to the individual users and also the possibility of breaching corporate information security principles. Addressing these risks is an important objective of an Information Security Management System, and should be given proper consideration during formal risk assessment activities. 

It is known that law enforcement and public authorities are already using social media applications to seek out information on individuals, as are insurance companies and other investigative organisations. There’s also current and future employers who will be taking an interest in social media activities, and perhaps most sinister of all are those who have illegal intentions such as identify theft, stalking, harassment and corporate fraud.

Social Media Applications and the Individual

Recently described as “one of the fastest growing industries in the world”, identity theft has been defined by the Identity Theft Resource Centre as encompassing five distinct activities:

• Business or commercial identity theft (e.g. for obtaining a line of credit)
• Criminal identity theft (e.g. providing a false identity when apprehended for crimes)
• Financial identity theft (e.g. using another’s identity to obtain credit, goods or services)
• Identity cloning (e.g. using another’s information to replicate and live their daily lives)
• Medical identity theft (e.g. using another’s identity to obtain treatment or medication)

Social media applications promote the sharing of information, and can provide most or all of the information which allow for all of the above activities to take place, if they are not configured and used correctly. Some examples include:

• Disclosure of date and place of birth: frequently displayed on Facebook profiles, without proper consideration for how these could be misused by others
• Mother's maiden name: used universally as a piece of authentication information - can this be worked out from social media content?
• Holiday plans: not only advertises when property will be empty, but allows identity thieves an attack window when they know the users are unlikely to be checking their accounts
• Use of location services: many social media applications allow users to communicate their precise geographic location, again allowing attack windows
• Unrestricted photographic content: from security arrangements of an office to vehicle registration numbers. Very useful in the wrong hands. 

Educating Social Media Users

Most social media applications already offer reasonable levels of protection for user's personal information, but users need to understand what these are and how to set and maintain these controls effectively. Using Facebook, as an example, users are routinely offered four levels of privacy:

• Friends only - a sensible option, sharing content and photos only with known friends (although it doesn't restrict how friends might then onwardly share that information)
• Friends of Friends - whilst users will have a reasonable degree of comfort within their friends network, how well do they know the friends of their friends?
• Everyone - the global setting which offers no privacy or security. Using this privacy option provides no protection - anyone with a Facebook account will see this content
• Customise - allows for the individual configuration of content, although is most time consuming to implement. Allows users to limit content down to one person, if need be

Other social media platforms provide a similar range of privacy options, and a program of user awareness and privacy training is a wise investment to ensure that they are used properly. 

Social Media Applications and the Employer

Whilst many of the above observations expose vulnerabilities to the individual users of social media applications, some of these users will also be trusted employees of an organisation. An emerging and worrying trend is for individual identities to be compromised, with the associated increased threat of corporate identity fraud using this illegally gained information. This is most serious if the compromised individual is a key member of an organisation perhaps with responsibility for legal or financial matters, where in the worst cases the legal status of the company could be changed, financial records amended or disclosed, or financial funds diverted to unauthorised accounts.

As part of an effective Information Security Management System, organisations should establish, implement and communicate their position on and the agreed acceptable use of social media applications. This document should clearly explain, as a minimum:

• the objectives of the Policy: protecting the company, its information and its employees
• position on using social media applications: from a complete ban to authorised purposes
• communicating an acceptable code of conduct - what should and should not be posted
• communication of known risks - including specific risks about using mobile devices
• managing passwords - keeping social media passwords separate (and different)
• details of monitoring activities that are to be undertaken to measure policy compliance

A balanced, considered view is necessary. A total ban of social media is difficult to enforce, and can lead to the organisation missing out on the positive aspects of using social media:

• raise awareness of the organisation's existence and its activities
• promote and advertise new products and services
• allow great flexibility for communicating with customers and employees
• advertise vacancies, share press releases
• participation and collaboration in sector based forums and discussion groups

A few moments on Google (other search engines are available) will return numerous stories of social media application postings bring disciplinary action and dismissals for (ex) employees, including examples of a waitress complaining about poor tips from a diner, a journalist challenging the management practices of his senior executives, and an IT manager relieved of his position for openly discussing the salary packages of his colleagues.

If unauthorised or negative postings are located, it is imperative that organisations take prompt and effective action to ensure that they are removed, and any resulting damage minimised. Whilst there is valid debate around “freedom of speech”, this blog is primarily concerned with protecting organisational information assets in these circumstances.

Software Vulnerabilities

Social media applications, most notably Facebook and Twitter, offer users a bewildering array of third party software programs and utilities, from games and news feeds to shopping channels and music services. If an organisation is allowing any level of access to social media applications, its supporting security policies should clearly state the position on whether such downloads are permissible.

The threat remains that users will not know the authenticity of the code that they are downloading to the organisation's ICT infrastructure, and therefore cannot be certain that it does not contain any malicious code that could compromise the user’s account, or worse the wider corporate network. High profile social media breaches are sadly all too common, and technical measures may need to be considered to manage such risks.

Summary

Social media applications are here to stay, and organisations need to understand and assess the risks that they pose alongside the benefits that they may provide. Effective controls should be implemented to minimise the possibility of individual or corporate identity theft, data loss, as well as the risks arising from downloaded malicious code. 

An effective Information Security Policy, Social Media Policy and Acceptable Use Policy should be in place to provide clear direction to employees.Corporate information security training needs to communicate the risks to the organisation, and equally the risks to the individual which relate to their personal use of social media.

Whilst social media channels provide efficient and cost effective means of distributing organisational communications, but their content and authority to do so should be clearly defined. Maintain awareness of the possibility of posts containing negative, unauthorised or misleading content, and understand the steps to be taken to minimise the impact.

With our help, InfoSaaS will protect your business from social media related risks through an effective risk management framework. Please take a moment to view our website at http://www.infosaas.uk and register for updates for our new cloud-based information security software which will be launched on 1st October 2014. 

Acknowledgements

All trademarks of products and services referred to within this blog are hereby acknowledged as being registered to their respective organisations. 

ISO27001 in Plain English

Often perceived as shrouded in an eerie mist of complexity and strange terminology, ISO27001 is an established information security standard. In this blog we'll explain what this means - in layman's terms - and explain why it is a sensible investment for organisations of all shapes and sizes. In its simplest form, it's a structured framework which helps organisations to understand what their valuable information is, develop an appreciation for the sort of "bad things" which can happen to that information, and implement a sensible safety net of controls to stop them happening.

Introducing "CIA"

However, not all information has the same value or sensitivity (compare a confidential password database with publicly available brochures, for example), so we need to take a look at three characteristics to determine how much protection it needs:

• Confidentiality - can it only be seen by persons that have authority and a need to see it

• Integrity - can the information be trusted, has it been modified without authority?

• Availability - ensuring that information can be accessed as and when required

We can start to see that sensible business systems and processes will help us provide appropriate protection for each of these considerations. For example, confidentiality can be maintained by user names, strong passwords and proper logging of user activity. Integrity is assisted by implementing access control to minimise access, or perhaps by having regular back-up media which could be recovered. Availability considers many things, from the resilience of power, networks and systems - through to our business continuity arrangements.

Sprinkle on some Risks ...

Think about all the things that could in some way affect your organisation's valuable data, or perhaps the buildings or infrastructure upon which it depends for its security. There are many of these, for the sake of a short blog, here's a small selection of risks which should be assessed by an organisation:

• risks of information theft by an employee, or a contractor

• damage to information from a computer virus outbreak, or theft by some form of malware

• disclosure of information to the wrong customer from unchecked software changes

• server failure due to hard drive capacity issues

• risks to your data centre environment due to historical flood risks or proximity to an airport

Some risks will happen on a more frequent basis than others, whilst some will have a major impact and others relatively minor. So alongside the identification of risks, we should seek to understand the probability of them actually happening, and the impact if they did.

... And stir in carefully selected Controls

There are lots of "bad things" which we need to identify, and do all we can to remove or at the very least minimise to an acceptable level. You're hopefully already doing sensible things, so for our five examples above you could be implementing:

• employment contract clauses, supplier agreements, and appropriate activity monitoring

• robust anti-virus and anti-malware protection, ensuring it is updated regularly

• formal change management for all software changes, involving multiple personnel

• infrastructure capacity checks, taking action when pre-agreed thresholds are reached

• environmental checks, ensuring your valuable infrastructure is protected from risks

The ISO27001 (2013) standard offers 114 controls which could be implemented, but there's nothing to stop you adding in additional controls if you think they are appropriate.

Statement of Applicability

The ISO27001 standard requires a "Statement of Applicability" to illustrate how controls have been implemented to protect your organisation's assets.Your risk assessment activities above may indicate to you that some controls are weak or inappropriate, so opportunities should be taken to implement more robust controls, or perhaps transfer the risks to a more suitable third party, or maybe even stop undertaking the risky activities altogether.

Is That All?

Not quite. Whilst asset identification, risk assessment and control implementation may require a clear head and a good supply of strong black coffee, there's a number of related activities which ISO27001 expects to see. Once again we'll spare you a long list, but think along the following lines:

• Involving your senior management, demonstrating their agreement and commitment to information security objectives which protect your business

• An appropriate framework of information security policies and procedures, and records to demonstrate how they've been followed

• A comprehensive employee and contractor security education programme - they need to understand their roles and responsibilities

• Internal audit activities, a programme of formal checks taking an objective view of how well your information security plans are working

• Improvement initiatives - doing things better when there is an opportunity to do so.

Next Steps

We hope that this end of the blog finds you more informed than ten minutes ago. With our help, protecting your business and gaining ISO27001 certification is a realistic and achievable goal. Please take a moment to view our http://www.infosaas.uk website, and register for updates for our new cloud-based software which is being launched in November 2014. It will help guide you through the requirements of ISO27001, including easing the complexities of risk assessment activities and an automatically prepared Statement of Applicability. Most importantly, however, is the reassurance that your business will be better protected in an increasingly competitive marketplace.

Introducing InfoSaaS

Every organisation needs to properly manage and protect information, both its own and the data entrusted to it by its customers. An international standard (ISO27001) exists to help organisations implement the controls necessary to achieve this important objective, but this is commonly perceived as being complicated, expensive, disruptive to implement properly, and a potential cash machine for "day rate consultants".

InfoSaaS, powered by Ctrl O, has been developed to make information security an achievable goal for all organisations, from SMEs to large corporates. It will help to provide valuable protection for your company, promoting your commitment to data security and helping to differentiate your offerings from your competitors. It's cloud based, requires no additional software, is easy to use and is provided for a low monthly cost. With over 20 years' experience in delivering certified systems to companies around the world, the creators of InfoSaaS know how you should be protecting your business.

InfoSaaS helps you to identify the important information and other assets (for example, premises, hardware, software etc.) and guides you through a risk assessment process to measure the threats and vulnerabilities that they could be subject to. It also contains workflows for managing unacceptable risks, security incidents, document management and a host of other useful features - all designed to help you deliver an effective, operational security management system quickly and with a minimum of fuss. Customers can choose the specific elements that they need, or use the whole solution to deliver their accreditation objectives.

If you have some previous experience with information security, or have perhaps attempted to achieve ISO27001 certification before, the following "top ten" of features will demonstrate what InfoSaaS has to offer:

1. Management dashboard, see at a glance the current status of all your information security activities and workstreams
2. Define thresholds for risk acceptance, and related parameters specifically aligned to the needs of your organisation
3. Undertake detailed risk assessments, perhaps using one of a library of standard asset risk templates, or create templates of your own
4. Progress risk treatment activities for any unacceptable risk levels identified during your various risk assessments
5. Automatically populate your Statement of Applicability (as required by the ISO27001 standard) as each risk assessment is completed
6. Integrated security incident module, allowing for prompt logging, investigation and closure of reported incidents
7. Integrated document management suite, assisting with document identification, ownership, approvals and planned review cycles
8. Calendar management, providing visibility of forthcoming (and overdue) management reviews, risk assessments, audits, document reviews etc.
9. Aligns with ISO27001:2013, and provides helpful cross-references to PCI DSS, CSA CCM and the UK Government Cyber Essentials Scheme for SMEs
10. A practical, effective and  integrated solution, affordable to all sizes of organisations whatever their sector

If you would like more information on InfoSaaS, or be kept updated, please take a look at http://www.infosaas.uk.