Companies can become more efficient and effective in combating data breaches, data
mismanagement, and improving information security while building the trust of their
customers and employees, by employing globally accepted information security standards.
This implementation creates a challenge for institutions who wanted to be looked at,
internally and externally, as a company that puts these features of industry standards into
extensive use in their information systems management schemes. As such, company
executives in various industries pose these questions: what information security management
framework should we implement? Is the Payment Card Industry Data Security Standard (PCI
DSS) enough? Which International Organization for Standardization (ISO) should we opt
for?
Institutions are relying increasingly on industry standards as part of ongoing due diligence in
their compliance frameworks. However, some of the implementations of these standards
often remain highly manual, which makes them expensive.
To implement industry standards in cyber and information management systems, institutions
must pay attention to gap analysis, risk identification, re-evaluating existing policies,
managerial involvement, risk mitigation, and training.
Institutions, therefore, require a strategic mindset and the needed technical expertise and
organisational capabilities in the implementation of most industry frameworks. Proper
implementation of these known standards boost audit effectiveness, increases alignment with
regulatory obligations and improves customer service.
Most stakeholders recognise the importance of these recognisable global standards. For
example, after implementing ISO 27001 frameworks in an institution, business procedures
are more effective and improved to meet various local and international standards.
Industry Standards are not regulations. They only serve as a guide. COBIT (Control
Objectives for Information and Related Technologies), for example, is a framework created
by Information Systems Audit and Control Association (ISACA). The COBIT framework
ensures the quality, control, and reliability of information systems in an organisation.
Implementing information security management frameworks usually requires specific distinct
steps, depending on what a company is trying to achieve. First, the company must define
criteria for implementation, determine requirements for gap analysis, establish rules for
reviews, and define review completion and documentation protocols.
I also would like to see more standards pushed forward by industry leaders within Africa
regarding information security management standards. There’s a dearth of such measures
within Africa or created by African institutions. There’s ample opportunity to develop
standards that pay attention to the African business climes. I digress.
Assuming companies perform these industry standardisations and implementation correctly,
the quality of any company’s information process flows, and management can be improved
significantly by thirty-eight per cent, experience indicates.
Companies reduce breaches, and the identification and documentation of risks are improved,
create new processes, and improve existing business processes. More importantly, these
institutions can meet regulatory targets more quickly and implement known frameworks to
better their overall capabilities.
Implementing any industry-standard security framework is a challenging task requiring
considerable commitment and resources. However, institutions capable of astute decision-
making and effective implementation have generated significant benefits from the
performance of these frameworks. After implementing the ISO 27001 framework, a
stakeholder said that they have “have become more efficient and effective in securing and
managing our information assets, improved our regulatory compliance, and enhanced our
customer trust.”
CONTACT US FOR MORE ENQUIRIES HERE.