I-ISO 27001 yachaza: ukuphatha, ukulawula, nokhiye bokusebenzisa

Informatec Digital » Ukuphathwa » I-ISO 27001 yachaza: ukuphatha, ukulawula, nokhiye bokusebenzisa

Ukuphathwa kokuphepha kolwazi ngokungangabazeki kuyinto eza kuqala ezinkampanini nasezinhlanganweni ezifuna ukuvikela izimpahla zazo ezibaluleke kakhulu: idatha yazo kanye nezinqubo zangaphakathi. Uma wake wazibuza ukuthi i-ISO 27001 imayelana nani nokuthi kungani ivela kakhulu ekuhlolweni nasekudingweni kwamakhasimende, ngizokuchazela ngokuningiliziwe namuhla. Le nqubo yamazwe ngamazwe ayiyona nje into ethandwayo; inikeza isisekelo esiqinile sokusebenzisa uhlelo lokuphathwa kokuphepha kolwazi olusebenza kahle ngempela (i-SMS).

I-ISO 27001 ayiseyona indinganiso egcinelwe izinkampani ezinkulu zobuchwepheshe; namuhla, noma iyiphi inkampani, enkulu noma encane, kunoma yimuphi umkhakha, ingazuza ohlakeni lwayo. Kusukela ezinhlanganweni emkhakheni wezempilo, ezokuthutha, ezemfundo, kanye nezinsizakalo kuya kuma-SME afuna ukwenza izilawuli zawo zokuphepha zibe sezingeni eliphezulu futhi akhe ukwethembana namakhasimende kanye nabalingani, ukufinyelela kwayo kubanzi. Sizohlola zonke izici zayo ezibalulekile, ukuthi indinganiso ihlelwe kanjani, ukuthi isitifiketi sihilelani, kanye nezinyathelo okudingeka uzithathe ukuze usetshenziswe ngempumelelo. Lungela umhlahlandlela ophelele, ocacile, nosebenzayo owenzelwe ukuphendula yonke imibuzo yakho, kungakhathaliseki ukuthi umusha ekuphathweni kwezokuphepha noma usuvele unolwazi oluthile.

Iyini i-ISO 27001 futhi ingeyani?

I-ISO 27001 iyindinganiso yamazwe ngamazwe ebeka izidingo zokuklama, ukusebenzisa, ukusebenzisa, ukuqapha, kanye nokuthuthukisa njalo Uhlelo Lokuphathwa Kokuphepha Kolwazi (i-SMS). Inhloso yayo ukuvikela ubumfihlo, ubuqotho, kanye nokutholakala kolwazi kunoma iyiphi inhlangano ngokuphatha izingozi ezihambisanayo.

Yasungulwa yi-ISO (International Organisation for Standardization) kanye ne-IEC (International Electrotechnical Commission), le ndinganiso inikeza uhlaka oluhlelekile nolwamukelekile emhlabeni wonke ongaluvumelanisa nezidingo zebhizinisi lakho. Inhloso eyinhloko? Ukuqinisekisa ukuthi ulwazi luhlala luphephile, lutholakala kuphela kulabo abaludingayo, luphelele, futhi luyatholakala uma ludingeka.

Ububanzi: Ikabani i-ISO 27001?

Enye yezinganekwane ezinkulu ukuthi i-ISO 27001 ifanele izinkampani zobuchwepheshe kuphela. Akukho okungaba kude neqiniso: ulwazi luyimpahla eyisisekelo yazo zonke izinhlobo zamabhizinisi kanye nemikhakha. Namuhla, izinhlangano zomphakathi nezizimele, ezinkulu nezincane, zifuna ukuvikela idatha yazo ezinsongweni zangaphakathi nezangaphandle.

Eqinisweni, indinganiso ngokwayo igcizelela ukuguquguquka kwayo kanye nokuzivumelanisa nezimo ; ivumela ukulungiswa kobunzima kanye nosayizi wenkampani ngayinye, inikeze inhlangano ngayinye indawo yokuchaza ukuthi ihlangabezana kanjani nezidingo. Lokhu kuyisihluthulelo: ayiphoqi izinkampani ukuthi zilandele izinyathelo eziqinile , kodwa kunalokho inikeza inkululeko yokuthola indlela engcono kakhulu yokusebenzisa izinyathelo ezifanele ngokuya ngomongo wenhlangano ngayinye.

Le ndlela isho ukuthi imikhakha eminingi, kusukela kwezezimali kuya kwezokuthutha, ezemfundo noma ezempilo, iyamukela i-ISO 27001 ukuze ithuthukise ukuncintisana kwayo kanye nokwethenjwa ngamakhasimende kanye nabahloli bamabhuku.

Izinzuzo zokusebenzisa i-ISMS ngokuya nge-ISO 27001

• Ukuhlukaniswa kokuncintisana: Uzobonisa ukuzibophezela kwakho ekuvikelekeni futhi uthole ukwethenjwa amakhasimende, ozakwethu, nabalawuli.
• Ukulawulwa kwezingcuphe okungcono: Khomba, hlaziya, futhi uxazulule ngokunengqondo ubungozi bolwazi, hhayi nje “ngokuqonda.”
• Ukuthobela okuvamile: Uzohlinzeka ngobufakazi ekucwaningweni kwamabhuku nasekuboniseni ukuthobela (imithetho yokuvikela idatha, izinkontileka, njll.).
• ukuthuthukiswa okuqhubekayo: Umjikelezo we-PDCA (plan-do-check-act) uzothuthukisa ukuthuthukiswa kwangempela minyaka yonke ezinqubweni zakho zokuphepha nezinqubomgomo.

Isakhiwo kanye nezidingo ze-ISO 27001

Inguqulo yakamuva ye-ISO 27001 ilandela lokho okubizwa ngokuthi "isakhiwo sezinga eliphezulu" (i-Annex SL), esifana nezinye izindinganiso ezifana ne-ISO 9001. Ihlelwe yaba yizigaba eziyi-10 ezibalulekile kanye ne- Annex A enezilawuli ezithile. Ake sibheke ngayinye:

1. Into kanye nenkundla yesicelo

Chaza inhloso yendinganiso, ukuthi kufanele isetshenziswe nini, nokuthi ungayichaza kanjani ububanzi be-ISMS . Lapha, inhlangano ngayinye kumele inqume ukuthi yiziphi izindawo, izinqubo, kanye nempahla ezimbozwa uhlelo lwayo lokuphatha, ngokusekelwe ezidingweni nasezingozini zayo.

2. Izinkomba zokulawula

Ibonisa izindinganiso zokubhekisela eziphoqelekile noma ezinconywayo, ikakhulukazi i-ISO/IEC 27000 , equkethe amagama kanye nohlaka lwalo lonke uchungechunge lwe-27000. Inguqulo yamanje ayisadingi ukusetshenziswa kwe-Annex 27002, okuvumela izilawuli ukuthi zivumelane nomkhakha ngamunye noma iqiniso lebhizinisi.

3. Imigomo nezincazelo

Zonke izincazelo ezibalulekile kanye nemibono zifakiwe ukuqinisekisa ukuthi amagama asetshenziswa ngendlela efanayo futhi kugwenywe ukudideka esikhathini esizayo. Ukuqonda la magama kubalulekile ngaphambi kokuklama i-ISMS.

4. Umongo wenhlangano

Ngaphambi kokusebenzisa noma yiziphi izinyathelo, udinga ukuqonda isimo senkampani sangaphakathi nesangaphandle . Lokhu kuhilela ukuhlonza izici zangaphandle (imithethonqubo, izinsongo, izinguquko kwezobuchwepheshe) kanye nezici zangaphakathi (abantu, izinqubo, isiko, njll.), kanye nababambiqhaza kanye nokulindela kwabo mayelana nokuphepha.

I-5 Ubuholi

Abaphathi abaphezulu kumele babonise ubuholi kanye nokuzibophezela okusebenzayo ekuphepheni kolwazi. Ukunikeza abanye akwanele; kumele bahileleke, bachaze inqubomgomo yokuphepha, futhi banikeze imisebenzi nemithwalo yemfanelo, baqinisekise izinsiza kanye nokusekelwa kwe-ISMS yonke.

Kubalulekile ukusungula isiko lokuphepha , lapho lonke ithimba liqonda futhi libambisana ngenkuthalo ekuvikeleni ulwazi.

I-6. Ukuhlela

Kulesi sigaba, uhlonza futhi uhlole izingozi namathuba ahlobene nokuphepha kolwazi. Kumelwe uchaze izinhloso zokuphepha ezicacile futhi uhlele izinyathelo zokubhekana nalezi zingozi, ezihambisana njalo nesu kanye nezinhloso zenkampani.

7. USoporte

Indinganiso idinga ukuhlonza nokuhlinzeka ngazo zonke izinsiza ezidingekayo ukuze i-ISMS isebenze kahle: isabelomali, amakhono, ukuqeqeshwa, ukuqwashisa abasebenzi, ukuxhumana kwangaphakathi kanye nokulawulwa kolwazi olubhalwe phansi.

8. Ukusebenza

Lesi sigaba sichaza indlela yokusebenzisa izinqubo nezilawuli ezichaziwe, kanye nokuqapha kwazo kanye nokubuyekezwa kwazo njalo. Lapha, izinhlelo zokwelapha ubungozi ziyasetshenziswa futhi zihlanganiswe nemisebenzi yansuku zonke.

9. Ukuhlolwa kokusebenza

Kumelwe ulinganise, uqaphe, futhi uhlole ukusebenza kahle kwe-ISMS: ukuhlolwa kwangaphakathi, ukubuyekezwa kwabaphathi, kanye nokuhlaziywa kwezinkomba ezibalulekile kanye nezilinganiso.

10. Ukwenza ngcono

Ukuthuthuka okuqhubekayo kubalulekile. Amathuba okuthuthukisa kumele athathwe futhi kuqaliswe izinyathelo zokulungisa ngenxa yokungalandeli imithetho, kusetshenziswa okutholakele ekuhlolweni kwamabhuku, izehlakalo, noma yimuphi omunye umthombo wokuphambuka.

Isijobelelo A: Izilawuli ze-ISO 27001

Ngaphezu kwezimfuneko eziphoqelekile, indinganiso ifaka i- Annex A ephelele echaza izilawuli eziningi ongazisebenzisa ukuze unciphise izingozi ezitholakele, ezihlanganisa izihloko eziningi ezahlukene:

• Ukulawula ukufinyelela: izinqubomgomo zokufinyelela okunengqondo, ukuqinisekiswa, ukuhlukaniswa kwemisebenzi, ukuphathwa kwemvume, njll.
• Ukuhlukaniswa kolwazi: chaza izigaba ngokuya ngokuzwela kanye nenani, uqinisekisa izinga elilinganayo lokuvikela.
• Ukuphepha ngokomzimba: ukuvikelwa kwesikhungo, ukufinyelela ngokomzimba okulawulwayo, izintambo nokuvikeleka kwemishini.
• Ukuphathwa kwedivayisi: ukufakwa nokulawula kwedivayisi, izinqubomgomo zokusebenzisa, nokuvikeleka kwe-inthanethi okuhlobene.
• Ukwenza ikhophi yasenqolobaneni nokuthola: lawula ukwenziwa, ukugcinwa kanye nokuhlolwa kwezipele ngezikhathi ezithile.
• Ukuqapha nokuhlola: izinhlelo zokugawula imicimbi, ukuqapha ezokuphepha kanye nokuhlolwa kwamabhuku kwangaphakathi/kwangaphandle.

Lezi zilawuli zingenziwa ngendlela oyifisayo, futhi ukukhetha kwazo kuncike ngokuqondile ekuhlaziyeni ubungozi okwenziwa inhlangano ngayinye.

Inqubo yokusebenzisa izinga le-ISO 27001

Isigaba sokuklama nokuhlela

Konke kuqala ngokusekelwa okuqinile okuvela kubaphathi . Lesi yisisekelo okwakhelwe kuso uhlelo. Okulandelayo, kuchazwa ububanzi be-ISMS, okukhomba ukuthi yiziphi izinqubo kanye nezimpahla ezizohlanganiswa. Kuhlanganiswa uhlu lolwazi olubalulekile, kuchazwa izilawuli okufanele zisetshenziswe, kubekwa imigomo, futhi kuhlelwa ukusetshenziswa (umugqa wesikhathi, amaqembu anomthwalo wemfanelo, izinsiza, njll.).

Isigaba sokuqalisa

Kulesi sigaba, zonke izilawuli, izinqubo, kanye nezinqubomgomo ezichazwe esigabeni esedlule ziyasetshenziswa. Lokhu kungafaka konke kusukela ezinhlelweni zokuqeqesha nokuqwashisa abasebenzi kuya ezilawulini zobuchwepheshe ezifana nezicishamlilo, ukuhlukaniswa kwenethiwekhi, ukubethela, njalo njalo. Izinqubo zokuphatha izigameko nazo ziyasungulwa, futhi iziteshi zokuxhumana zivunyelwe ukubika noma yikuphi ukungahambi kahle.

Isigaba sokuhlola

Uma sekuqaliswe ukusebenza, kubalulekile ukuqinisekisa ukuthi konke kusebenza kahle . Ukuhlolwa kwangaphakathi kanye nokubuyekezwa kwabaphathi kuhleliwe, futhi izinkomba kanye nezilinganiso ziyahlolwa ukuqinisekisa ukuthi imigomo iyafezwa yini nokuthi izilawuli zinciphisa yini izingozi ngempumelelo.

Isigaba sokuthuthukisa okuqhubekayo

Ulwazi lushintshashintsha. Yingakho i-ISMS kumele iguquke, ifunde emaphutheni nasezigamekweni . Umjikelezo wokuthuthukisa okuqhubekayo (i-PDCA) uqinisekisa ukuthi izinqubomgomo, izinqubo, kanye nokulawula kuyabuyekezwa futhi kubuyekezwa njalo, kwethulwa izinyathelo zokulungisa lapho kuvela ukungalandeli noma izindawo zokuthuthukisa.

Isigaba sesitifiketi

Okokugcina, uma sifuna ukuqinisekisa i-ISMS yethu , kumele sihlolwe ngaphandle yinhlangano egunyaziwe. Uma uhlelo luhambisana nezindinganiso, isitifiketi siyanikezwa, esivame ukuvuselelwa njalo eminyakeni emithathu ngokuhlolwa kokulandelela kwaminyaka yonke.

Imininingwane ye-ISO 27001 eSpain

ESpain, indinganiso ilawulwa ngokusemthethweni ngaphansi kwe -UNE-EN ISO/IEC 27001:2023, okulingana ne-ISO/IEC 27001:2022 . Ukuqaliswa kuvame ukwakhelwa phezu kolwazi lwangaphambilini lwezinkampani ngemithethonqubo yokuvikela idatha efana ne- Spanish Organic Law on Data Protection noma i-European GDPR, uma kubhekwa ubudlelwano obucacile phakathi kokuphepha kolwazi kanye nokuthobela imithetho.

Amanye amathuluzi ajwayelekile asekelayo nezindlela eSpain ahlanganisa i-MAGERIT (yokuhlaziya nokuphatha ubungozi), i-PILAR, kanye ne-SECITOR, ngaphezu kwereferensi eqhubekayo phakathi kwe-ISO 27001 nochungechunge lwe-27000, kanye namazinga e-ISO 9001 kanye ne-14001 ukuze kuhlanganiswe izinhlelo zokuphatha eziphelele.

Intuthuko yakamuva ku-ISO 27001

Inguqulo yakamuva yethule izinguquko ezibalulekile esakhiweni sayo kanye nokulawula . Ihlose ukuguquguquka okukhulu, indlela engaguquki kakhulu yezinqubo, izilawuli ezandisiwe, kanye nokuzivumelanisa kangcono nokwehlukahlukana kwezinhlangano zanamuhla. Isibonelo, izizinda ezintsha ezifana nokuphathwa kwabaphakeli zengeziwe, futhi izilawuli zilungisiwe ukuze zibhekane nezinsongo ezivelayo, njengokuhlasela kwe-cyber okuthuthukisiwe. Ngaphezu kwalokho, ivumela ukulungiswa kwezilawuli ezinconywayo zibe yizinhlaka ezihlanganisiwe noma ezijwayelekile eziningi, okwenza kube lula ukuhlanganiswa nezinye izindinganiso ze-ISO.

Ithini inqubo yesitifiketi? Ingabe kuyimpoqo?

Ukusebenzisa le nqubo akuholeli ngokuzenzakalelayo ekuqinisekisweni , yize kunikeza ukuzethemba okwengeziwe kanye nokucaca kumakhasimende kanye nabahloli bamabhuku. Isitifiketi singenziwa kuphela yinhlangano ezimele futhi egunyaziwe, ezobuyekeza i-ISMS yakho kanye nezinga layo lokuthobela imithetho. Inqubo yokuhlola imvamisa ihlala phakathi kwamasonto ambalwa nezinyanga ezimbalwa, kuye ngobukhulu kanye nobunzima benhlangano, futhi ilandelwa ukuhlolwa kokulandelela kwaminyaka yonke. Isitifiketi sivame ukusebenza iminyaka emithathu.

I-ISO 27701: Isandiso esibalulekile sobumfihlo

Ezinhlanganweni lapho ukucutshungulwa kwedatha yomuntu siqu kubalulekile khona, isandiso se-ISO/IEC 27701 sesivele sikhona, esakhela ngqo ku-ISO 27001 ukuqinisa ubumfihlo. Siyithuluzi elifanele lokubonisa ukuthobela imithethonqubo efana ne-GDPR kanye noMthetho We-Organic WaseSpain Wokuvikelwa Kwedatha, ikakhulukazi ezinhlanganweni ezine-Data Protection Officer (DPO) noma lezo ezifuna ukuthuthukisa isithombe sazo sobumfihlo.

Qaphela: Ukuze ufanelekele ukuthola isitifiketi se-ISO 27701, kufanele uqale usebenzise futhi uqinisekise i-ISO 27001.

Ubudlelwano namanye amazinga nezinhlaka

I-ISO 27001 ayiyona yodwa emhlabeni jikelele ojwayelekile . Ihambisana futhi ixhunywe kwezinye izindinganiso eziningi ochungechungeni lwama-27000: i-ISO 27002 (imikhuba emihle kanye nezilawuli ezinconywayo), i-ISO 27003 (isiqondiso sokuqalisa), i-ISO 27004 (izilinganiso kanye nokulinganisa), i-ISO 27005 (ukuphathwa kwengozi), ngisho nezinhlaka zokuphepha nokuvuthwa ezifana ne-ISM3 noma i-COBIT, kanye nezinhlelo ezithile zokuphatha zokuqhubeka (ISO 22301) noma ikhwalithi (ISO 9001).

Kuthatha isikhathi esingakanani ukuthi inkampani iqalise futhi iqinisekise i-ISO 27001?

Akukho mpendulo eyodwa, njengoba kuncike ngobukhulu, ububanzi, kanye nokuvuthwa kokuphepha kwangaphambilini kwenhlangano ngayinye. Ngokuvamile, yonke inqubo, kusukela ekuhlaziyweni kokuqala kuya ekuhlolweni kwangaphandle, ithatha phakathi kwezinyanga eziyisithupha kuya kweziyishumi nambili. Uma inkampani isivele inezinhlelo zekhwalithi noma ulwazi ngemithetho yokuvikela idatha, inqubo ivame ukuba mfushane kakhulu.

Izinzuzo ezengeziwe zokuthembela kochwepheshe namathuluzi akhethekile

Ukusebenzisa i-ISO 27001 akulula ngaphandle kokuhlangenwe nakho kwangaphambilini . Yingakho izinhlangano eziningi ziphendukela kubacebisi abakhethekile noma isofthiwe ye-GRC (Governance, Risk, and Compliance) ukuze zihlanganise imisebenzi, zenze izilawuli ngokuzenzakalela, futhi zibhale ubufakazi. Lokhu kwenza inqubo ibe lula, kunciphisa amaphutha, futhi kusheshise isitifiketi, kuguqula lokho ngezinye izikhathi okubonakala kuyinselele engenakuqhathaniswa kube iphrojekthi engenzeka futhi elawulwa ngokuphelele.

I-ESG, ukubusa nokusimama: izitayela ezintsha

Ukuhlanganisa ukuphepha kolwazi nezinqubomgomo ze-ESG (Environmental, Social, and Governance) kuya ngokuya kuba yinto ebaluleke kakhulu , lapho umthwalo wemfanelo wenkampani kanye nokuphatha okuhle kuhambisana nokusimama kanye nokuziphatha. Ukuhambisana ne-ISO 27001 kuqinisa isithombe senkampani njengebhizinisi elinomthwalo wemfanelo, kokubili kubatshalizimali namakhasimende, kanye nomphakathi jikelele.

Namuhla, noma iyiphi inhlangano efisa ukuncintisana ezindaweni zedijithali noma ephatha ulwazi olubucayi kumele icabangele ukusebenzisa i-ISO 27001 njengokutshalwa kwezimali okunesu kunokuba kube yizindleko. Ukuzihlomisa nge-ISMS eqinile akuvikeli nje kuphela ezinsongweni ezikhulayo njenge-ransomware, ukwebiwa kwedatha, kanye nezingozi zobumfihlo; futhi kuthuthukisa ukusebenza kahle, kuthuthukisa idumela, futhi kuvumela ukukhula okuphephile emakethe edinga kakhulu. I-ISO 27001 ngokungangabazeki iyisango lezinkampani ezizibophezele ekuthatheni ukuphathwa kolwazi lwazo ngokungathi sína.