News

HCS have appointed Jaimal Chavda as a Systems Support Analyst as part of the government apprenticeship scheme.

Jaimal will undertake external training via Qudos Training which will enable him to achieve a Government Customer Service NVQ Level 2 certificate during his employment.

In addition HCS will train Jaimal in Linux System administration as well as fault finding and diagnostics for the company's clients.

CLOSE

Paul Haigh, Managing Director, is delighted to announce that HCS has achieved ISO27001 accreditation. The process, lasting 6 months, culminated in a succesful audit at the start of July. The...

Paul Haigh, Managing Director, is delighted to announce that HCS has achieved ISO27001 accreditation.

The process, lasting 6 months, culminated in a succesful audit at the start of July.

The accreditation will allow HCS to assure clients of it's commitment to data security, both physical and electronic and goes hand in hand with the ISO9001 accreditation already held.

Further information on ISO27001 (Source Wikipedia)

ISO/IEC 27001, part of the growing ISO/IEC 27000 family of standards, is an information security management system (ISMS) standard published in October 2005 by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC). Its full name is ISO/IEC 27001:2005 – Information technology – Security techniques – Information security management systems – Requirements.

ISO/IEC 27001 formally specifies a management system that is intended to bring information security under explicit management control. Being a formal specification means that it mandates specific requirements. Organizations that claim to have adopted ISO/IEC 27001 can therefore be formally audited and certified compliant with the standard (more below).

Most organizations have a number of information security controls. However, without an information security management system (ISMS), controls tend to be somewhat disorganized and disjointed, having been implemented often as point solutions to specific situations or simply as a matter of convention. Security controls in operation typically address certain aspects of IT or data security specifically; leaving non-IT information assets (such as paperwork and proprietary knowledge) less protected on the whole. Moreover business continuity planning and physical security may be managed quite independently of IT or information security while Human Resources practices may make little reference to the need to define and assign information security roles and responsibilities throughout the organization.

ISO/IEC 27001 requires that management:

Systematically examine the organization's information security risks, taking account of the threats, vulnerabilities, and impacts;
Design and implement a coherent and comprehensive suite of information security controls and/or other forms of risk treatment (such as risk avoidance or risk transfer) to address those risks that are deemed unacceptable; and
Adopt an overarching management process to ensure that the information security controls continue to meet the organization's information security needs on an ongoing basis.

The key benefits of 27001 are:

    It can act as the extension of the current quality system to include security
    It provides an opportunity to identify and manage risks to key information and systems assets
    Provides confidence and assurance to trading partners and clients; acts as a marketing tool
    Allows an independent review and assurance to you on information security practices

A company may want to adopt ISO 27001 for the following reasons:

It is suitable for protecting critical and sensitive information
It provides a holistic, risked-based approach to secure information and compliance
Demonstrates credibility, trust, satisfaction and confidence with stakeholders, partners, citizens and customers
Demonstrates security status according to internationally accepted criteria
Creates a market differentiation due to prestige, image and external goodwill
If a company is certified once, it is accepted globally.

While other sets of information security controls may potentially be used within an ISO/IEC 27001 ISMS as well as, or even instead of, ISO/IEC 27002 (the Code of Practice for Information Security Management), these two standards are normally used together in practice. Annex A to ISO/IEC 27001 succinctly lists the information security controls from ISO/IEC 27002, while ISO/IEC 27002 provides additional information and implementation advice on the controls. The domains covered by ISO 27002 include

Security policy
Organization of information security
Asset management
Human resources security
Physical and environmental security
Communications and operations management
Access control
Information systems acquisition, development and maintenance
Information security incident management
Business continuity management
Regulatory compliance

Organizations that implement a suite of information security controls in accordance with ISO/IEC 27002 are simultaneously likely to meet many of the requirements of ISO/IEC 27001, but may lack some of the overarching management system elements. The converse is also true, in other words, an ISO/IEC 27001 compliance certificate provides assurance that the management system for information security is in place, but says little about the absolute state of information security within the organization. Technical security controls such as antivirus and firewalls are not normally audited in ISO/IEC 27001 certification audits: the organization is essentially presumed to have adopted all necessary information security controls since the overall ISMS is in place and is deemed adequate by satisfying the requirements of ISO/IEC 27001. Furthermore, management determines the scope of the ISMS for certification purposes and may limit it to, say, a single business unit or location. The ISO/IEC 27001 certificate does not necessarily mean the remainder of the organization, outside the scoped area, has an adequate approach to information security management.

Other standards in the ISO/IEC 27000 family of standards provide additional guidance on certain aspects of designing, implementing and operating an ISMS, for example on information security risk management (ISO/IEC 27005).

01 September 2011 HCS Appoint Jaimal Chavda under the government apprentice scheme

01 July 2012 HCS Achieve ISO27001 accreditation

30 March 2012 Kevin Pagett appointed as Project Manager

01 February 2012 Unity wins CPF contract

2022

November

October

August

June

May

April

March

February

January

2021

December

2020

September

July

2018

2015

2014

2013

2012

2011

CONTACT

Thank you for your message.
A representative from Haigh Consultancy Services will be in contact with you as soon as possible.

NEWS