Skip to content

Information Technology And Information Security

Information technology is now crucial for the operation and possibly the survival of an organization. TÜV CYPRUS, recognizing the importance of IT and thus it provides inspection and certification services to all companies according to their needs.

ISO 27001

ISO/IEC 27001 is the only internationally recognized standard that can be audited and specifies the requirements for an Information Security Management System (ISMS). 

The standard is designed to ensure the selection of adequate and balanced security controls. This selection helps a business protect its information assets and gain trust from stakeholders, especially its customers.

The standard is based on a process approach for establishing, implementing, operating, monitoring, reviewing, maintaining, and improving an ISMS. ISO/IEC 27001 is suitable for all businesses, large or small, and for any workplace. It is particularly suitable for organizations where information protection is critical, such as financial institutions, telecommunications, healthcare organizations, the public sector, and IT.

Certification of an ISMS according to the requirements of ISO/IEC 27001 can offer the following benefits to an organization:

  • Demonstrates that the requirements for proper governance and business continuity are met,
  • Shows that relevant legislation and regulatory standards are applied,
  • Provides a competitive advantage in fulfilling contractual obligations and demonstrates to the organization's customers that the security of their information is of primary importance,
  • Proves through an independent body that organizational risks have been identified, assessed, and managed satisfactorily and correctly,
  • Highlights the existence of a formal operational information security management system,
  • Demonstrates the commitment of the organization's top management to information security,
  • Shows that all information stored, processed, or communicated through information systems is valuable to the organization.

ISO/IEC 27001 uses risk assessment to create a management system that provides:

  • Maximization of systems availability,
  • Assurance that the integrity of systems, processing systems, and information is maintained,
  • Confirmation that the confidentiality of information is preserved.

ISO/IEC 20000

ISO 20000 is the first international standard aimed at IT Service Management. It describes a comprehensive management process system for the effective delivery of services to organizations and their customers. If the primary purpose of an organization is to provide IT services, then ISO 20000 certification is almost essential.

ISO 20000 focuses solely on IT service delivery processes and the management system that supports them. It provides a recognized and tested management system that enables a service provider organization to plan, manage, deliver, monitor, review, and improve its services.

ISO 20000 is suitable for all organizations, large or small, and for any workplace that provides IT services. The standard is particularly suitable for internal IT service providers, such as IT departments, and external IT service providers, such as companies offering IT services to third parties (outsourcing).

Benefits of ISO 20000:

  • Justified and acceptable costs for IT infrastructure and provided services.
  • Increased awareness throughout the organization regarding IT services allows the organization to use them more effectively.
  • Increased awareness of corporate needs that facilitates innovative approaches to meet those needs.
  • Improved ability to recognize trend changes, allowing the organization to adapt more quickly to new requirements and market development (competitive advantage).
  • Enhanced capability for measurement and management reporting, facilitating decision-making and IT governance.

CYBER-HYGIENE FRAMEWORK FOR SMALL AND MEDIUM BUSINESSES

Small and medium-sized enterprises (SMEs) constitute the largest share of the economy and professional activity, contribute to the stable and upward growth of the Cypriot economy, and play an important role in boosting employment, competitiveness and innovation, while at the same time ensuring social stability. The impact of cybersecurity incidents can have adverse effects and disrupt their proper functioning and continuity of operations.

By following and using the key and advanced recommendations set out in the NCC-CY’s Cyber-Hygiene Framework for SMEs, SMEs ensure a basic level of cybersecurity, thereby securing their systems and business operations, while also enhancing their reliability.