Ensuring Integrity & Confidentiality using the ISO27000 Security Standard

TrueAbility adheres to the ISO27000, information security management system (ISMS), which is an internationally recognized family of standards designed to help organizations keep information assets secure. Following the ISO27000 standard helps achieve compliance with relevant regulatory agencies, data protection, privacy and IT governance. We manage the security of assets such as intellectual property, user details or other information entrusted to us by our customer.

ISO27000 management system standards (MSS) help organizations improve their performance by specifying repeatable steps that organizations consciously implement to achieve their goals and objectives, and to create an organizational culture that engages in a continuous cycle of self-evaluation, correction and improvement of operations and processes through continual employee awareness, management and commitment.

This systematic approach to managing sensitive information includes people, processes and IT systems, so it remains secure.

If you have found a potential vulnerability, please let us know.
TrueAbility Security Team – security@trueability.com

More details about what an ISO27000 Standard involves

Physical and Environmental Security

Physical access to premises and support infrastructure (communications, power, air conditioning etc.) must be monitored and restricted to prevent, detect and minimize the effects of unauthorized and inappropriate access, tampering, vandalism, criminal damage, theft etc.
The list of people authorized to access secure areas must be reviewed and approved periodically (at least once a year) by Administration or Physical Security Department, and cross-checked by their departmental managers.
Photography or video recording is forbidden inside Restricted Areas without prior permission from the designated authority.
Suitable video surveillance cameras must be located at all entrances and exits to the premises and other strategic points such as Restricted Areas, recorded and stored for at least one month, and monitored around the clock by trained personnel.
Access cards permitting time-limited access to general and/or specific areas may be provided to trainees, vendors, consultants, third parties and other personnel who have been identified, authenticated, and authorized to access those areas.
Other than in public areas such as the reception foyer, and private areas such as rest rooms, visitors should be escorted always by an employee while on the premises.
The date and time of entry and departure of visitors along with the purpose of visits must be recorded in a register maintained and controlled by Site Security or Reception.
Everyone on site (employees and visitors) must wear and display their valid, issued pass always, and must present their pass for inspection on request by a manager, security guard or concerned employee.
Access control systems must themselves be adequately secured against unauthorized/inappropriate access and other compromises.
Fire/evacuation drills must be conducted periodically (at least once a year).
Smoking is forbidden inside the premises other than in designated Smoking Zones.

Human Resource security

All employees must be screened prior to employment, including identity verification using a passport or similar photo ID and at least two satisfactory professional references. Additional checks are required for employees taking up trusted positions.
All employees must formally accept a binding confidentiality or non-disclosure agreement concerning personal and proprietary information provided to or generated by them while employment.
Human Resources department must inform Administration, Finance and Operations when an employee is taken on, transferred, resigns, is suspended or released on long-term leave, or their employment is terminated.
Upon receiving notification from HR that an employee’s status has changed, Administration must update their physical access rights and IT Security Administration must update their logical access rights accordingly.
An employee’s manager must ensure that all access cards, keys, IT equipment, storage media and other valuable corporate assets are returned by the employee on or before their last day of employment, as a condition of authorizing their final pay….

Access control

User access to corporate IT systems, networks, applications and information must be controlled in accordance with access requirements specified by the relevant Information Asset Owners, normally according to the user’s role.
Generic or test IDs must not be created or enabled on production systems unless specifically authorized by the relevant Information Asset Owners.
After a predefined number of unsuccessful logon attempts, security log entries and (where appropriate) security alerts must be generated and user accounts must be locked out as required by the relevant Information Asset Owners.
Passwords or pass phrases must be lengthy and complex, consisting of a mix of letters, numerals and special characters that would be difficult to guess.
Passwords or pass phrases must not be written down or stored in readable format.
Authentication information such as passwords, security logs, security configurations and so forth must be adequately secured against unauthorized or inappropriate access, modification, corruption or loss.
Privileged access rights typically required to administer, configure, manage, secure and monitor IT systems must be reviewed periodically (at least twice a year) by Information Security and cross-checked by the appropriate departmental managers.
Users must either log off or password-lock their sessions before leaving them unattended.
Password-protected screensavers with an inactivity timeout of no more than 10 minutes must be enabled on all workstations/PCs.
Write access to removable media (USB drives, CD/DVD writers etc.) must be disabled on all desktops unless specifically authorized for legitimate business reasons.