Isms

[Mark Hoffmann]

ISO 27001 is the standard for information security.

AKA Information Security Management System and it would make a good poem entitled: Dystopia 
 

[Mark]

ISO 27001 is the standard for information security.

Wonder if Facebook's heard of it.
 

[Amie]

Apparently they are certified to it: https://www.facebook.com/workplacebyfac ... 8298065185

This is the problem with voluntary standards (as opposed to regulatory ones). Anyone can call themselves a certification body, and all the certification bodies are vying for business, so you can get a certificate for any (voluntary) standard just by breathing.

That's not to say that there aren't many many companies who take this stuff seriously and put the work in, just that it's easy to get a certificate regardless, if you shop around.

[Mark Hoffmann]

Apparently they are certified to it: https://www.facebook.com/workplacebyfac ... 8298065185

This is the problem with voluntary standards (as opposed to regulatory ones). Anyone can call themselves a certification body, and all the certification bodies are vying for business, so you can get a certificate for any (voluntary) standard just by breathing.

That's not to say that there aren't many many companies who take this stuff seriously and put the work in, just that it's easy to get a certificate regardless, if you shop around.

Thread drift. I was on a call with a major financial institute and their Security Manager said they have started disregarding certification unless it is from one of the major bodies. Thankfully we went with BSI so it was not an issue.

[Mark]

Agreed, Amie.
Sounds like an opportunity
for a private enterprise
with a government endorsement
to become a compliance ratings inspectorate
setting a recognized industry gold standard
that can't be ignored
by serious competitors in those markets.

Excuse me. Think I just invented business poetry... 

   

[Amie]

Well, accreditation bodies already exist (e.g. UKAS in the U.K.). But it's not a legal requirement for a certification body to be accredited in order to provide certification for a voluntary standard, and lots of companies don't know what accreditation means or why it matters.

Sorry, you've awoken my inner regulatory nerd - these things come into my awareness because of the interface between regulations and voluntary standards. E.g. It's fine (legally) to have an unaccredited certificate for a supplier of a polymer if you're an umbrella manufacturer, not so much if you're a breast implant manufacturer.

I challenge you to write a poem about that!

[Mark]

Breast implants? No problem...