Posted: August 11th, 2022

Support for ISO on ISMS Framework

Computer Sciences and Information Technology
Topic:
Compliance
Support for ISO on ISMS Framework
You are just hired at a financial institution as a compliance officer. You have found from audit reports that there are some noncompliance issues at this bank. The bank management has decided to implement ISO to “provide requirements for establishing, implementing, maintaining and continuously improving an Information Security Management System”. Produce an executive write-up that outlines your support for or against adopting ISO as your strategic security framework. Make your case compelling either way so that management can make a decision.

The following report outlines why it is important to implement ISO as a strategic security framework from a compliance officer’s perspective. The ISO on Information Security Management System is a framework that aims to provide and formulate policies and processes relevant to data management, control, and use. Petters (2020) identifies the ISO’s goal is not to obligate the company to certain specific products, tools, solutions, or methods. Rather, it provides an essential checklist to mitigate against risk and unforeseen loss.
Industrial analysts identify that risk, especially to computer networks, is increasingly inevitable for most organizations (Marcus, 2018). It is not a question as to whether external unauthorized access is impossible; it is a matter of when it will happen—making an ISO compliance even more essential for any financial organization with personally identifiable data on their employees and customers. Security and data breach and mismanagement is a phenomenon on the rise in the US. Researchers in 2017 at the Ponemon Institute assessed a total of 130 effective breaches per major organization, which accounted for a 27% rise from 2016; and a total of $11.7 million per company risking the integrity of 16.7 million US citizens while making away with nearly $16.8 billion (Marcus, 2018). Formulating a working ISO on Information Security Management System would effectively contain and mitigate financial institutions such as the bank from such risk or prevent them from being outspoken.
Risk management is a key factor that motivates institutions to take on ISO compliance. Under the pretext of globalization, there has been an immense growth of financial institutions that have resulted in a complex working environment with numerous financial chains, intermediaries, and broad inter and intra-organizational networks. This has only served the need for a standard working procedure to be adopted for greater compliance. Tapiero (2015) identifies that financial regulation is a socio-political and economic need with a risk and a price. Growth in financial technology (hardware and software components) has increased profits and brought more challenges to the industry. This has, in turn, brought about immense regulators and regulations. It is making an ISO compliance, not just as a need but a requirement.
Noncompliance in large financial institution bears a heavier litigation burden and financial risk in cases where risks become barely mitigated in time. Some of the more serious risks of noncompliance include the fact that regulatory agencies can give huge financial institutions large penalties and fines for breaching protocols and guidelines that make up the regulatory framework. It also can perpetuate a loss in productivity and revenue among the employees. Employees and customers could also take the bank to court or pursue other litigation processes, which bears heavy implications on the bank.
Without greater compliance in data management, the risk of injuries due to loss of information or access by unauthorized parties presents an unsafe working environment. This could also serve to invite greater government sanctions and license suspensions that may hurt the financial institution’s business model by preventing its ability to work within a specified jurisdiction—essentially losing credibility to perform its duty. Ensuring data integrity is important for a company of all sizes. Setting up data security is a more complicated process than just setting up an IT security group in charge of cybersecurity. The ISO compliance covers all end-to-end processes and provides security organizations, especially if they have a presence in multiple locations.

References
MARCUS, D. J. (2018) “The Data Breach Dilemma: Proactive Solutions for Protecting Consumers’ Personal Information.” Duke Law Journal, vol. 68, no. 3, Dec. 2018, pp. 556–593. EBSCOhost, search.ebscohost.com/login.aspx?direct=true&db=a9h&AN=133418287&site=ehost-live&scope=site (references)
Petters. (2020). What is ISO 27001 Compliance? Essential Tips and Insights | Varonis. Retrieved 16 October 2020, from https://www.varonis.com/blog/iso-27001-compliance/
Tapiero, C. (2014). Financial regulation, non-compliance risks and control: A statistical approach. Risk And Decision Analysis, 5(2-3), 113-127. doi: 10.3233/rda-140104

Order | Check Discount

Tags: Support for ISO on ISMS Framework