What is IS027001
ISO 27001 (formally known as ISO/IEC 27001:2005 currently ISO/IEC 27001:2013) is a specification for an information security management system (ISMS). An ISMS is a framework of policies and procedures that includes all legal, physical and technical controls involved in an organisation's information risk management processes. Being IS0 27001 accredited means that we have proven to an external body that we comply with all regulations and requirements, therefore ensuring that security (both information and physical)/risk management and other best practices are ingrained in everything we do through the processes we follow.
Who is Responsible for Compliance
Ultimately, the CEO (As all processes must be approved and Supported from the board of directors), however all members of the cloud team are committed to maintaining our certification and take active roles in designing\implementing processes and controls. Other aspects of the business also play a vital role from HR to Development ensuring all processes are followed and information security\risk assessment is incorporated into every action performed.
How Often are we Audited
We are audited every 12 months and inorder to stay certified we must not only show the documented processes but also how these are implemented in the business and show that all those effected by the process understand its requirements and adhere to its contents. We must also show that, where necessary checks and controls are in place to ensure that the process can not be circumvented. Our last audit certificate along with other accreditations are available via https://www.hornbill.com/security-policy/
What Processes are covered under ISO
The list is below, however processes are expanded to include additions not necessarily covered by ISO27001 but that are either deemed important or best practice.
- ISO27001:Risk Management
- ISO27001:Information Security
- ISO27001:Management Systems
- ISO27001:Mobile Security
- ISO27001:HR Security
- ISO27001:Asset Management
- ISO27001:Information Classification & Handling
- ISO27001:Access Control
- ISO27001:Network Policy
- ISO27001:Cryptography Controls and Usage
- ISO27001:Physical and Environment Security
- ISO27001:Supplier Relationships and Procurement
- ISO27001:Incident Reporting\Handling and Management
- ISO27001:Change Reporting\Handling\Planning and Management
- ISO27001:Business Continuity and Disaster Recovery
We have a document for each of the above (summary available via link) , containing summary of requirements, outlining the responsibilities for each department\individual, detailing any actions that must be performed inorder to ensure the desired outcome is achieved and listing any checks or controls that must be performed. All Documents are reviewed at least once every 12 months and made available to appropriate employees via Hornbill Document manager. Every employee effected by one or more processes is provided training and tested to ensure they understand the process and its effects (Records of training then available to ISO certification team) .
The below links to sections\documents that are not covered by ISO27001, however are important to the way Hornbill operates\plans and provides services. This includes polices, guiding theologies or supporting documents that help show our commitment to security and your data.
Capacity Management and Scalability
We have hardware available for our expected growth of Hornbill and this is reviewed\increased every 3 months with the purchasing of additional hypervisors\rack space as required. If required we can also create a instance or complete replica of the Hornbill infrastructure in AWS (Same as in our DR Plan) in record time meaning that capacity and scalability is never an issue. This scalabity along with the underlying server code also removes all limitations for user increase as new servers can be added as demand increases.