IEC/ISO:27001 is essentially a series of policy documents related to cyber resilience. The policies are tailored to your business, and are intended to be audited and amended on a regular basis. We use the NIST CSF 2.0 framework for these policies.

ISO/IEC 27001 is a widely used information-security management standard. For DFSA-authorised firms in the DIFC, the DFSA requires an appropriate cyber risk management framework and lists ISO/IEC 27000 among the standards that may inform it, alongside NIST and others. Even where no regulator expects it, aligning with the standard is prudent, including for supply-chain security, which it covers.

IEC/ISO:27001 can be approached from two angles:

• Compliance
• Certification

Compliance means just that - you follow the standard, including external assessments, where you must demonstrate that your business is following the published policies, however no certification will be issued. This is appropriate for most businesses (including those in the DIFC).

Certification follows the same principles as Compliance, however your business will be recognized as being certified by ISO/IEC. Many companies don’t go down this path due to the additional cost if they can demonstrate compliance to the relevant authority or a customer as part of a supply chain assessment.

We are not currently licensed to certify companies, however we can bring you to a compliant level, and audit your supply chain for compliance.