01
Vulnerability management
A.8.8Automated quarterly scans detect technical vulnerabilities in network and infrastructure. The reports are directly usable as evidence that you take vulnerability management seriously.
ISO 27001: why demonstrable information security is increasingly required
ISO 27001 is the international standard for information security. It describes how to set up an information security management system (ISMS): a systematic approach in which you identify risks, take measures and continually assess how effective they are.
Many large organisations and governments require ISO 27001 of their suppliers. NIS2 and NEN 7510 also follow the structure of ISO 27001. If you want to show that you take information security seriously, ISO 27001 is the most widely recognised framework for doing so.
ISO 27001
What is ISO 27001 and who is it relevant to?
ISO 27001 is voluntary but is fast becoming a contractual obligation. It is relevant to:
- Smaller companies supplying large organisations, government or multinationals
- Software companies and IT service providers that process customer data
- Companies that also want to demonstrate NIS2, NEN 7510 or PCI DSS (all three follow ISO 27001)
- Businesses that want to grow in markets where information security is a procurement condition
Certification is costly and not always necessary. But showing a demonstrable ISO 27001 foundation through technical measures is something any company can do.
The obligations
What does ISO 27001 require?
ISO 27001 is built around the PDCA cycle (plan, do, check, act) and 93 controls (Annex A). The most relevant technical measures for smaller companies are:
- A.8.8: Management of technical vulnerabilities (vulnerability scans, patch management)
- A.8.7: Protection against malware
- A.8.23: Web filtering and access control
- A.5.31: Legal, statutory and contractual requirements (GDPR, NIS2, PCI DSS)
- A.6.3: Awareness, education and training of staff
- A.5.23: Information security when using cloud services
- A.8.20 to A.8.22: Network security, network management and segregation
Our contribution
How does Orange Warriors contribute to ISO 27001?
The Sentinel package offers the technical building blocks that fill in the most relevant Annex A controls for smaller companies.
02
Network security
A.8.20 to A.8.22Website and domain protection through a WAF, DDoS protection and SSL/TLS monitoring provide the technical network security layer Annex A requires.
03
Access control and authentication
A.8.2, A.8.5The password manager and monitoring for leaked passwords ensure system access is limited to authorised people with strong, unique credentials.
04
Awareness and training
A.6.3Security awareness training and phishing simulations give shape to the ISO 27001 obligation on staff awareness and education. With reporting as evidence for an auditor.
05
Incident detection
A.5.25, A.5.26Real-time monitoring of uptime, SSL, domains and leaked data lets you detect incidents early, a core requirement of the ISMS.
Please note
Orange Warriors delivers technical security measures that contribute to compliance. We do not issue certification and we are not a legal adviser. Whether you fully meet a guideline also depends on organisational measures, policy and documentation that fall outside our services.
ISO/IEC 27001 (iso.org)
FAQ
Frequently asked questions about ISO 27001
Does Orange Warriors make my company ISO 27001 certified?
No. ISO 27001 certification requires a formal audit by an accredited certification body. We deliver the technical measures that fill in a substantial part of Annex A, but certification also requires policy, risk assessment, internal audits and management involvement.
How long does it take to become ISO 27001 certified?
Six to eighteen months on average, depending on how mature your security processes are. Having the technical building blocks already in place shortens that period considerably.
What is the difference between ISO 27001 and NIS2?
ISO 27001 is a voluntary international standard you can be certified against. NIS2 is mandatory European legislation. The two overlap strongly in substance: meeting ISO 27001 means meeting a large part of the technical requirements of NIS2 as well. In Sentinel we work on both at once.
Why do more and more clients require ISO 27001 of their suppliers?
Large organisations are themselves responsible for the security of their supply chain, both under NIS2 and under their own risk management policy. ISO 27001 is the most internationally recognised way for a supplier to demonstrate that information security is taken seriously.
Free scan
The technical groundwork for ISO 27001 in place
Sentinel lays down the technical building blocks of Annex A, with reporting your auditor can use. We look at where you stand, free of charge.