Information is the most precious active for every organization in the modern world. Information security is of great importance for the existence and prosperity of an organization and it is essential to be ensured that the information won’t be lost or used in an improper way.

ISO 27001 is an international standard that gives a definition for the requirements of information safety management. The standard requires presence of control mechanisms that provide safety management through balance of confidentiality, availability and integrity of information. The standard refers to information security not as a technical question but as a management problem. Thus it unifies all structural levels of the organization in a self-improving system based on risk assessment, improvement cycle (Plan – Do – Check – Act), internal connection and traceability.

The integration of the standard gives an opportunity for increasing organization’s information safety and its preservation from counterfeiting. Thus traceability of potential loss of information is made easier. Other benefit is that practices and action plans are established in the organization in cases of emergency such as virus penetration into the computer system, entry in areas of limited access, etc. It also ensures safety of personal and confidential information as it is stated in relative documentation.

Integration of such a system is economically profitable and is controlled through mechanisms for continual assessment and management.

Nowadays confidentiality has become a part of business relationships. Most businessmen want to be sure that their information will be treated in strict confidentiality. In some cases the ability of an organization to ensure information safety determinates future business relationships.

ISO 27001:2005 assists organizations in:

• Understanding the necessity of establishing information security policy and objectives

• Spreading information security policy and objectives through out the organization

• Integrating a system for control and management of risks related to information security in its own business sphere

• Monitoring and reviewing the effectiveness and efficiency of the information security management system