Digital Jewels Aid Three ISO/IEC 27001, Local Firms Move Slowly

Only a handful of Nigerian firms have secured the prestigious ISO/IEC 27001:2005 indicating that most companies and organizations in the country are yet to bring their processes at par with global standards, Nigeria CommunicationsWeek can report.

ISO/IEC 27001, part of the growing ISO/IEC 27000 family of standards, is an information security management system (ISMS) standard published in October 2005 by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC).

It is generally regarded as the world’s highest accreditation for information protection and security from the International Organisation for Standardization (ISO).

First Bank of Nigeria Plc, Galaxy Backbone Plc, Fidelity Bank Plc and Unity Bank Plc have all etched their names in history book as firms at par with leading international and multi-lateral corporate organizations including the International Monetary Fund (IMF) and the World Bank in the area of security and protection of customers’ information.

Nigeria CommunicationsWeek investigations revealed that First Bank of Nigeria Plc was the first to adopt and comply with the highest known management standards in information security in the world.

After First Bank, Digital Jewels, an Information Value Chain Consulting Firm has secured the prestigious certification for Galaxy Backbone, Fidelity Bank Plc and recently Unity Bank Plc.

Galaxy Backbone is the first public sector organisation in Nigeria and the first ICT Company in the entire West African region to have attained accreditation.

Fidelity Bank Plc is currently the second organization in the Nigerian banking industry to be so certified and followed by Unity Bank Plc.

Mrs. Adedoyin Odunfa, managing director/CEO, Digital Jewels had at the presentation of the certification to Galaxy Backbone last late year that her company is committed to emerging as the leading player in the implementation of global best practice standards in Nigeria and beyond.

“Without doubt, to reach the goal of certification, it’s been a great deal of hard work, sometimes tedious, sometimes tough, often painstaking, but always exciting. I commend the management of the two organizations (Galaxy Backbone, Fidelity Bank Plc) for their doggedness in implementing and complying with this world-class standard in their operations; and pleased Digital Jewels was a key facilitator of this success story.” She said

Mrs. Omobola Johnson, minister of Information and Communication Technology, who received the certification presented by Mr, TheunsKotze, managing director, British Standards institute, BSI Europe, Middle East & Africa, on behalf of Galaxy Backbone noted that the achievement represents a significant milestone in the journey to attain global best practices in Information Technology by the Federal Government.

Mr. Gerald Ilukwe, managing director, Galaxy Backbone  said the government agency embarked on the journey to ISO 27001:2005 Certification as part of an overarching imperative of implementing processes that will guide the company’s service provision.

“The ISO/IEC 20071 certification specifies requirements for ISMS (Information Security Management Systems) management. And certification is a recognition of compliance with the stringent requirement of the ISMS standards and regulations for handling all organizational information, be it for the organisation or for its clients, in such a manner as to ensure that it is secure, available when needed and reliable.” Ilukwe explained.

Elsewhere at a similar presentation of certification to Fidelity Bank, Mr. Reginald Ihejiahi, managing director/CEO of the bank, stressed the importance of the certification to the Bank’s business.

Both Galaxy Backbone and Fidelity Bank Plc commended the effort of Digital Jewels in ensuring that they attained the feat despite all odds.

Nigeria CommunicationsWeek gathered that on ISO/IEC 27001 formally specifies a management system that is intended to bring information security under explicit management control. Being a formal specification means that it mandates specific requirements.

Organizations that claim to have adopted ISO/IEC 27001 can therefore be formally audited and certified compliant with the standard.

Most organizations have a number of information security controls.

However, without an information security management system (ISMS), controls tend to be somewhat disorganized and disjointed, having been implemented often as point solutions to specific situations or simply as a matter of convention.

Security controls in operation typically address certain aspects of IT or data security specifically; leaving non-IT information assets (such as paperwork and proprietary knowledge) less protected on the whole.

Moreover business continuity planning and physical security may be managed quite independently of IT or information security while Human Resources practices may make little reference to the need to define and assign information security roles and responsibilities throughout the organization.