[ARCHIVE] Information security

Note: This article is out of date and has been archived. Please refer to the Accreditation guidelines and the Supplementary accreditation guidelines: Insurance for the most up to date information.

Archived Text

Questions

1. What type of assurance report is suitable to meet the information security requirements for accreditation?
2. Is ISO 27001 certification sufficient to fulfil the information security requirement for accreditation?

Answers

1. Accreditation requirements surrounding information security and assurance reports, including the evidence to be provided, are set out in our Supplementary Accreditation Guidelines: Information Security
2. Where an applicant has an ISO 27001 certification, the applicant may seek to rely on this certification as partial evidence to demonstrate that it satisfies the information security obligation. The Data Recipient Accreditor will accept, as part of an accreditation application, a current ISO 27001 certification together with an additional scope assurance report. More information on our approach to recognising ISO 27001 certification in the context of information security requirements can be found in our Supplementary Accreditation Guidelines: Information Security.