The Lessons
Having already put the main components of the management system in place we found it very straightforward to add the extra requirements of ISO9001 and broaden the objectives, metrics, roles and processes to be more business, rather than security, related. We would summarize the top 5 lessons we learned as follows:
Lesson 1 – It’s useful to set objectives – although we were measuring many aspects of our business, we hadn’t defined where we were trying to get to in enough detail. Doing this has helped understand what we (and our suppliers) need to do to meet the new objectives and carry the business forward.
Lesson 2- Don’t bother with ISO9000 (Fundamentals and Vocabulary) – although the ISO9001 standard states that ISO9000 is “essential background” we bought it and then wished we hadn’t. In our humble opinion it didn’t add that much to our implementation efforts and includes some quite frankly weird spider-like diagrams at the back that didn’t help our understanding at all. Save your money (sorry ISO).
Lesson 3 – Better understanding of risks and opportunities – for the first time, ISO9001 now asks for a risk assessment. Nothing new to those familiar with other standards such as ISO/IEC 27001, ISO/IEC 20000 or ISO22301 perhaps. But we did find that risk-assessing the business processes was a useful addition to our existing, asset-based risk assessment for ISO27001. And we had a long discussion with the auditor about what an opportunity is and how to assess them (basically a risk with a positive potential outcome).
Lesson 4 – Supply chain is where it’s at – Ok, our customers have been telling us this for ages, but we came out of the audit with increased determination to look hard at our suppliers, both during procurement and once established. It’s very easy nowadays to Google a requirement, find a cloud supplier and sign up within minutes, without having done enough due diligence from a security, business and legal angle. Don’t assume it’s safe, check.
Lesson 5 – Procedures are boring, but necessary – having been through the process of documenting the way we do things we actually found it helped a lot, both in asking why we do it that way and in helping to ensure it’s done that way each time. Although ISO9001 doesn’t insist on things being written down, it really is a no-brainer.
