LONAP and ISO 27001
What is ISO/IEC 27001?
ISO/IEC 27001 is an international standard for managing information security.
It sets out how organisations should identify security risks, put suitable controls in place, and keep those controls under review as risks and technology change.
You can read the official ISO description here: https://www.iso.org/standard/27001.html.
What does ISO 27001 require?
To meet the standard, an organisation must establish and maintain an Information Security Management System, or ISMS.
This includes:
- defining which parts of the organisation are covered
- identifying and assessing security risks
- selecting and applying suitable controls
- documenting how those controls work
- assigning clear responsibility for them
- training staff
- reviewing, auditing and improving controls over time
The aim is to make security part of day-to-day operations rather than something considered only when a problem occurs.
Why does this matter?
Networks, systems and data are exposed to a changing range of threats. Organisations need to show that they understand those risks and have controls in place to manage them.
ISO 27001 helps by:
- showing that security is managed across the organisation
- giving customers and partners evidence that controls are in place
- making responsibilities clearer when incidents occur
- supporting consistent security decisions rather than reactive ones
When you rely on a shared network, how much assurance do you expect about the way that network is managed?
LONAP’s Journey
LONAP established a plan to develop a security framework that could stand up to external scrutiny while supporting continued growth. This included defining technical, operational and governance requirements, alongside the day-to-day procedures needed to support them.
The project was led by a dedicated security team, which identified risks relating to equipment, access, data flows and supplier connections.
Procedures were reviewed and controls were tested in practical scenarios. This gave the team a clearer understanding of where controls were working well and where improvements were needed.
Once the foundations were in place, the team strengthened those controls. Access protocols were updated, monitoring was improved, and detailed procedures were developed for handling security incidents. This created a more consistent approach to managing day-to-day security issues.
To help ensure a consistent approach across LONAP, all employees received training relevant to their roles and responsibilities.
Throughout the project, the Executive, supported by the Board of Directors and other stakeholders across the organisation, worked together to identify the resources needed to support the move towards ISO 27001.
Working closely as a team to build the control matrix, document how key controls are managed, and review them regularly gave LONAP a clearer view of where controls were effective and where gaps remained.
It also improved communication around decisions and made ownership of individual controls clearer.
ISO 27001 requires organisations to continually evaluate and improve their controls. LONAP will continue to review its performance, respond to changing risks and introduce new controls where needed.
For members, this provides greater confidence that LONAP has a structured approach to security, with clear processes, defined responsibilities and a system that continues to improve over time.
Share on Facebook
Share on Twitter
Share on LinkedIn