Objectives
To implement an ISMS aligned with ISO/IEC 27001 at head office and at a critical subsidiary, ensuring the integrity, confidentiality and availability of information at both.
Financial
Global financial group: an ISMS that has sustained an eight-year relationship
Implementation of an Information Security Management System based on ISO/IEC 27001 in a financial group with global reach, covering a key process at its head office and a subsidiary specialising in hosting, colocation and DRP.
- Sector
- Financial — global group
- Jurisdictions
- Bahamas and the Caribbean
- Standard
- ISO/IEC 27001
- Scope
- Head office and hosting, colocation and DRP subsidiary
- Relationship
- Continuous since 2017
Problem
In an increasingly interconnected and regulated global financial environment, the group faced the challenge of guaranteeing information security end to end and of demonstrating compliance to regulators, correspondents and institutional clients across several jurisdictions at once.
Solution
Since 2017 we have worked with the group to implement an ISMS conforming to ISO/IEC 27001 covering a key process at head office in the Bahamas and a subsidiary dedicated to hosting, colocation and disaster recovery plans.
Result
Certification of both entities and a relationship of trust that has widened into new areas: review of the SWIFT security framework, systems audits and improvement of IT service delivery processes.
Client context
The client is a financial group with global reach that needed a higher level of information security to sustain its position and comply with international regulation. The complexity of its operations —several entities, several jurisdictions, infrastructure services provided to third parties— and the need to protect its clients and its assets made security an absolute priority, not a departmental project.
The project
Approach
The approach covered assessing and strengthening the security policies and practices already in place, adapting them to the requirements of the standard rather than replacing them. Throughout the process we worked with the group’s different teams to ensure effective integration with their processes and their organisational culture: a management system that clashes with how the organisation works does not survive its first surveillance audit.
Results
Certification validated the security and effectiveness of the group’s processes and cemented a long-term working relationship. That bond later made it possible to take on projects such as the review of the SWIFT framework to ensure compliance, systems audits and improvements to IT service delivery processes, contributing to safer and more efficient management across the group.
Reflections and lessons
The project underlines the weight of a solid partnership and a meticulous approach in the financial sector. Trust and continued commitment are the only way to sustain compliance in an environment of constant change and regulation.
Frequently asked questions
Does ISO/IEC 27001 help with the SWIFT security framework?
It does not replace it, but it makes it much easier. The SWIFT Customer Security Programme requires specific controls over the messaging environment; an ISO/IEC 27001 ISMS already provides the governance, risk analysis, access management and evidence that framework requires, so the annual attestation stops being an isolated exercise and rests on a system that is already running.
Can only part of the group be certified?
Yes. ISO/IEC 27001 is certified against a declared scope, which can be a process, a business unit or a specific entity. It is common to start with the process or entity with the greatest exposure and extend the scope in later cycles, provided the interfaces with what is left out are identified and treated.
What does certifying a hosting, colocation and DRP service involve?
It means the scope covers not only the organisation’s own information but that of the clients it hosts, with additional demands on physical security, segregation, capacity management and continuity. The disaster recovery plan stops being a document and becomes a proven capability, with periodic tests whose evidence is audited.