Considering the fast-paced and innovative culture within Freeday, we jointly identified an appropriate approach to work as quickly and efficiently as possible towards ISO 27001 and NEN 7510 certification.

Experience from other projects has taught us that the biggest challenge lies in getting the organization to work following the standard. The underlying organizational policies are supportive but drafting these is perhaps the easiest part of these projects.

We wrote policies, of course; there’s no escaping that for continuous information security. Especially in a young company, laying down rules and procedures to ensure consistency is crucial as a foundation for further growth. Roles and responsibilities may be changing rapidly. Successive individuals must be able to understand what activities were previously performed in securing a certain level of information security for this level to be maintained.  

As Freeday was already using a document management tool (Slite), it made sense to include policies in it as well. This way, every employee could read how Freeday interprets ISO 27001 and NEN 7510. After all, they were all used to using Slite during their daily work. The benefit of using a document management tool rather than separate documents is that one can clearly outline the relationship between documents within the information security management system (ISMS), assign roles directly to the documents and keep track of changes. What about records and reports?

Not all of these were included in Slite as well. Reports, such as management reviews, were best suited to be included in Slite and directly linked to their corresponding policy. For registrations, such as the risk record and the (performance of the) operational agenda, there was a desire to apply automation feasibly within the work management tool Monday that Freeday was using. Since Monday was already used to assign tasks within project teams, it seemed fitting to use Monday for performing information security tasks as well to be consistent with the standard way of working.

Risk management is a crucial part of effective information security. Unfortunately, it also remains particularly vague for many organizations. For Freeday, we’ve set up a practical system for managing information security risks. ISO 27001 and NEN 7510 provide safeguards (controls) to manage information security risks. NAALA has translated these controls into understandable and actionable recurring tasks. Each task is assigned an owner; the role appropriate to perform the activity. When the date of the task approaches, only its owner receives a reminder to perform its activity.

An example of such a task is checking whether authorizations are assigned according to the internal authorization matrix. This task was assigned to each system admin. The system admin is now reminded periodically to review authorizations for the systems under their responsibility.

By using various types of automation, the entire system interoperates while minimizing the workload for Freeday’s employees. Moreover, the burden of managing risks and information security is distributed among several individuals, each with their expertise and responsibilities. The result is a clear set of activities, the execution of which is recorded: a manageable and demonstrably effective management system.