Home Code Quality What is ISO/IEC 27001:2013 and why is it relevant?

What is ISO/IEC 27001:2013 and why is it relevant?

Author

Date

Category

Code analysis is essential in every organization focused on software development. However, when sensitive information is at play, organizations might want to take an extra step to ensure that those data are well protected. That’s where ISO/IEC 27001:2013 certification has a significant role. More than guaranteeing that developers write better code, it’s a way to show customers that the organization takes its data security seriously.

What is ISO certification?

Maintaining consistent quality standards across different industries and nations might be challenging in today’s global marketplace. In this context, international standards help to keep a level playing field and ensure consistency.

The International Organization for Standardization (ISO) is an independent, non-governmental international organization developing and producing worldwide standards. ISO standards cover various activities, from making products and managing processes to service delivery and supplying materials.

Although ISO develops the standards themselves, a third party is responsible for annual audits and corresponding certification. These certifications β€” existing in many industries, from information technology to food safety β€” are a way for organizations to show they comply with all the standardization and quality assurance requirements.

One of the most prevalent ISO standards in information technology is the ISO/IEC 27001:2013. Let’s see what it entails.

What is ISO/IEC 27001:2013?

The ISO/IEC 27001:2013 standard specifies the requirements for establishing, implementing, maintaining, and continually improving an organization’s information security policies and procedures.

Although specific to information security management systems, the requirements set out in ISO/IEC 27001 are generic. As a result, all organizations can apply the standard, regardless of their industry, type, or size.

What does ISO/IEC 27001:2013 exactly stand for?

The ISO/IEC 27001:2013 standard includes three main components: ISO/IEC, 27001, and 2013. We’re going to analyze each one of them in more detail.

ISO/IEC

We already covered ISO: it is the International Standards Organization. But what about IEC? It stands for International Electrotechnical Commission. It is another international standards organization, specifically focused on electrical, electronic, and related technologies. Therefore, IEC works closely with ISO in creating standards for the commonly called “electrotechnology” field.

27001

The number appearing after ISO/IEC classifies the standard. All standards within the ISO 27000 family (they are more than a dozen!) refer to information security management. When following these standards, the goal is to keep information assets secure. The 27001 standard is widely known by professionals in the realm of information technology, and it provides requirements for the information security management system for any kind of digital organization.

2013

The final number refers to the standard version, corresponding to the calendar year ISO launched it. In this case, 2013 is the latest version of ISO 27001, launched in October of that same year.

Why is ISO/IEC 27001:2013 certification relevant?

Let’s be clear: in several cases, ISO/IEC 27001:2013 certification is voluntary, not mandatory. Some organizations choose to implement the standards to benefit from the best practices it contains, but without going through the certification process.

The three-year certification process is lengthy and can seem daunting, with two-stage audits and subsequent yearly checkups. However, it is worth the effort, and being ISO certified offers numerous benefits and advantages for organizations of all industries.

ISO certification has become the norm, and it works as a seal of approval. The benefits include, among others, improved quality management, more efficient processes, increased protection of the company and its assets, increased international reputation, potentially increased revenue or competitive advantage, and enhanced client satisfaction.

The ISO/IEC 27001:2013 shows how data that has been previously collected can remain confidential and secure. This is vital when dealing with sensitive data like health-related information. ISO certification can also help organizations comply with other regulations.

For example, for U.S.-based healthcare organizations, having the ISO/IEC 27001:2013 certification can also help to comply with other frameworks, such as the HIPAA (Health Insurance Portability and Accountability Act). In practice, ISO 27001 consists of 114 security controls, and we can leverage at least 47 to comply with HIPAA requirements.

How Codacy can help you comply with ISO/IEC 27001:2013?

Now that we covered the basics, let’s see precisely how Codacy can help you comply with ISO/IEC 27001:2013. We analyzed the particular case of LOGEX, a leading healthcare analytics company.

We spoke with Tim van Loosbroek, Head of Infrastructure and Security at LOGEX, about how Codacy helps them comply with ISO/IEC 27001:2013 and, in Tim’s words, “get a really nice certificate.” Check out the case study!

Logex Codacy ISO IEC 27001 2013

Does your organization also have to deal with sensitive data? Try Codacy, and see how we can help you achieve your high-security standards.

2 COMMENTS

LEAVE A REPLY

Please enter your comment!
Please enter your name here

Subscribe to our newsletter

To be updated with all the latest news, offers and special announcements.

Recent posts

Static Code Analysis: client-side tools integration with Codacy

Testing and analyzing your code is one of the most important parts of your software development process. With Codacy, you can...

Open salary calculator: our commitment to transparency and fairness

Here at Codacy, we are committed to being a fully transparent company. So back in 2019, we launched our open salary...

How Vevo uses Codacy to replace legacy systems while guaranteeing code coverage

As the tech world keeps evolving, having legacy systems is a certainty, especially for organizations that have been around for decades....

December Product Update πŸš€

Hi there πŸ‘‹, With 2021 in the rearview mirror, we can now focus on making 2022 an incredible...

How Loft uses Pulse to measure Engineering health

Customer story about how Loft uses Pulse to measure Engineering health. Estimated reading time: 5 minutes. About Loft