The rise of the digital world Organisations are becoming ever more reliant on the digital world to send information and transact business. Email has now become the default method of communication and connected applications, via the cloud, are now mainstream. Consequently, the volume of easily available data is increasing exponentially. This is affecting all organisations, both large and small, by driving the need to change the way that they manage their affairs. The security of the data held by an organisation, and by extrapolation its information or the intelligence that can be gleaned from that data, has now become one of the primary areas of focus for all businesses. Why is securing data increasingly important for SMEs? As an SME ensuring the security of your data has become increasingly important due to the following reasons: Larger organisations are using more sophisticated tools and techniques to secure their data, resulting in criminal elements switching to targeting smaller, less well, protected businesses Data is being increasingly held in single locations, such as cloud storage applications, rather than on paper in dispersed offices and sites raising the spectre of a single point of catastrophic failure New legislative regulations are being introduced, such as GDPR, which carry increased fines and penalties if data security is breached The loss of data belonging to Customers and Partners is now seen as being a major business risk due to the associated loss of trust and reputation For all these reasons it is becoming important to not just be secure, but to be able to demonstrate that you are securely managing all the information in your possession. The best way of doing this is to introduce an Information Security Management System, tailored to your needs, which will allow you to demonstrate to customers, suppliers, staff and any other stakeholders that you take data security seriously and that you are doing everything practically possible about it. Isn’t Introducing an information Security Management System Time Consuming and Difficult? This is a typical question that gets posed by SMEs. A ‘Management System’ sounds complicated and raises visions of the need for armies of administrators who just add overhead costs, enforce rigid ways of working, and reduce the ability to respond nimbly to any situation. For a small business with limited resources this is a frightening prospect. However, when organised well an Information Security Management System (ISMS) does not need to act as a brake to business activity. Most small businesses are already managing their data well, using tools and techniques that work for them and keep the data secure. All an ISMS will do is document how the current practices work and ensure that they can be viewed as one entity. This will: Allow you to demonstrate to anyone who is interested that you are taking data security seriously Raise the visibility of the current practices, allowing them to be easily communicated to everyone who needs to know about them, especially new joiners Pull everything together, allowing the whole suite of tools, techniques, and ways of working to be assessed as one, and any gaps or weaknesses to be identified Assign responsibility for actions to an individual, or set of individuals, thereby making sure nothing can slip between the cracks Build confidence in customers, partners and staff that you are securely managing their data, thereby enhancing your organisation’s reputation. So what needs to be considered? As mentioned above most small businesses will already have actions in place to reduce any risk of losing data. The ISMS therefore only needs to document how these areas are being handled. The key areas being: Physical Security: Ensuring that unauthorised individuals cannot gain access to any locations or equipment Personal Security: Making sure that you employ trustworthy individuals to work for you, and have trained them in how to keep themselves secure from attacks such as Phishing exercises Cyber or Systems Security: Securing accounts and systems through the use of passwords, firewalls and other network security tools; the deployment of backups for critical data; and actions to secure mobile equipment Operational Security: Deploying standard ways of working that are known to be safe and secure rather than expecting everyone to find their own way of undertaking a task Contingency Planning and Disaster Recovery: To ensure that if disaster does strike that everyone knows what to do and how to react to get the business back up and running as soon as possible, with the minimum of disruption. Personal Privacy: This has become more important with the advent of GDPR but really just means making sure that you only collect personal data that you need, that you know where it is stored, and that it is stored securely. The vast majority of small businesses are already ensuring that all these areas are covered and managed. The only thing that am Information Security Management System will add is the confirmation that this is happening, and that the security tools and techniques are being consistently assessed to make sure that they are still current and effective. How Can I Make this Happen? The first thing to do is to take each of these areas in turn and write down how security is applied to each of them. This can be helped by a trip to the internet where you will find many frameworks and formats for documents that are free of charge. The government recommends the use of the Cyber Essentials framework as the absolute minimum that any business should use to ensure information security, but this only focuses on the Cyber element of the points above. Whatever your thoughts the best thing to do, as a minimum, is to begin by listing what you do in each of these areas, and to begin today. If you would like to discuss any of the points raised in this blog please contact Graham at info@evolve-ec.com and he will be delighted to discuss your concerns.