In this episode of InfoSec Insider, George Ryan and Jack Woods, both Consultants at URM, discuss some of the most common nonconformities they encounter when auditing organisations against the management system requirements of ISO 27001, focusing on Clauses 4, 5 and 6. Drawing upon their auditing and consultancy experience, they provide practical guidance on common mistakes and how organisations can strengthen their approach. George Ryan and Jack Woods discuss:

• Common issues relating to Clause 4, including keeping internal and external issues up to date, considering climate change, correctly identifying the needs and expectations of interested parties, and understanding how ISMS processes interact.
• Why leadership involvement and commitment are critical to meeting Clause 5 requirements, from aligning information security objectives with wider business objectives to ensuring information security policies are appropriately approved and endorsed by top management.
• Common pitfalls under Clause 6, including risk assessments without a clearly defined methodology, objectives that are not measurable or time-bound, and the importance of producing valid, comparable and repeatable risk assessment results.
• How organisations can avoid problems with their Statement of Applicability, including weak justifications for excluding Annex A controls and assumptions that physical or development-related controls do not apply to their organisation.
• Why changes to the ISMS need to be properly planned and recorded, and how overlooking business and organisational changes, rather than simply technical changes, can lead to nonconformities.
• And more.

If there's a GRC or cyber security related issue you'd like us to explore, share it with us here here: https://urmconsulting.com/podcasts/common-nonconformities-in-clauses-4-5-and-6-of-iso-27001 We use listener questions to guide future discussions and ensure our episodes tackle the challenges that matter most to organisations like yours.

You can find more episodes of InfoSec Insider here: https://urmconsulting.com/podcasts          

Brought to you by URM, the UK’s leading information and cyber security specialists.       

In this episode of InfoSec Insider Wayne Armstrong, Senior Information Security Consultant at URM, and Lisa Dargan, CEO at URM, discuss how organisations can gain greater value from their ISO 27001 risk management processes. Moving beyond compliance and certification, Wayne and Lisa explore how effective risk management can become a genuine business enabler, supporting informed decision-making, business growth, and continual improvement. They discuss:

• The mandatory ISO 27001 risk management requirements, including risk assessment, risk treatment, risk acceptance criteria, and documented information requirements.
• How to align information security risk management with business objectives, helping organisations support growth opportunities while managing risk effectively.
• Practical approaches to identifying and prioritising critical information assets based on confidentiality, integrity, and availability requirements.
• Why transparency, inclusivity, and organisation-wide participation are essential for accurate risk assessments and successful risk ownership.
• The growing importance of threat intelligence, third-party risk management, and maintaining a dynamic risk management process that adapts to a changing threat landscape.
• Common risk management pitfalls, including risk aggregation, control-driven risk creation, and static assumptions about organisational context, together with practical advice on how to avoid them.

Whether you are implementing ISO 27001 for the first time or looking to mature an existing ISMS, this episode provides practical guidance on transforming risk management from a compliance exercise into a valuable tool for improving business resilience and information security performance. This episode was based on our webinar, Getting More from ISO 27001 Risk Management. If you'd like to watch more of our webinars or find out about upcoming events, please visit  https://urmconsulting.com/events

You can find more episodes of InfoSec Insider here: https://urmconsulting.com/podcasts       

Brought to you by URM, the UK’s leading information and cyber security specialists.       

In this episode of InfoSec Insider – Talk DP, Rachael Salter and Aimee Brown, both Consultants at URM, share their insights on how to effectively manage the immediate aftermath of a personal data breach. Aimee and Racheal draw on over 20 years’ combined data protection experience to discuss: 

• What actually counts as a data breach and when it needs to be reported to the Information Commissioner’s Office (ICO)
• How organisations can assess risk and decide whether affected individuals need to be told
• The biggest mistakes organisations make in the first few days following a data breach
• How ransomware attacks, supplier incidents, and modern technology are changing breach management
• The practical steps organisations can take now to prepare for a breach and demonstrate accountability afterwards.

Ask Rachael and Aimee a question:  https://urmconsulting.com/podcasts/the-first-72-hours-managing-data-breaches     

You can find more episodes of InfoSec Insider here: https://urmconsulting.com/podcasts  

Connect with us on LinkedIn  

Brought to you by URM, the UK’s leading information and cyber security specialists.