The webinar covers: • How to present ISO 27001 in non-technical terms • Four Main benefits of ISO 27001 and how to present them • The role of senior executives in ISO 27001 implementation Presenter: This webinar was presented by Dejan Kosutic, who works as an ISO 27001 expert advisor with extensive experience in tutoring and consulting. He has an MBA from Henley Management College and holds many other certificates in ISO 27001. Link of the recorded session published on YouTube: https://youtu.be/9SP_FA4P4uI

1. How to convince top management
to implement ISO 27001
Presenter: Dejan Kosutic

2. How to convince top management
to implement ISO 27001
Presenter: Dejan Kosutic

3. ©2015 27001Academy www.advisera.com/27001academy 3
How to increase chances for successful
ISO 27001 implementation by bringing in
the management.
You are in charge of ISO 27001
implementation…
…Without management support your
project will probably fail!

4. ©2015 27001Academy www.advisera.com/27001academy 4
Present your ISO 27001 project like a
business case, and you’ll make your
management much more interested!

5. ©2015 27001Academy www.advisera.com/27001academy
Agenda
5
• Management mindset
• What is really ISO 27001
• Four main benefits of ISO 27001
• Return on investment
• Elevator speech
• Using right words

6. ©2015 27001Academy www.advisera.com/27001academy
Management mindset
6
• Return on investment (ROI)
• Market
• Compliance
• Strategic direction
• Short time to present the case
• Management is under great pressure!
• Persuading the management takes time

7. ©2015 27001Academy www.advisera.com/27001academy
What is really ISO 27001
7
• A management standard, not technical –
Information Security Management System
• The purpose is to manage and control –
example: BYOD policy
• Only 50% of controls from Annex A are IT
related

8. ©2015 27001Academy www.advisera.com/27001academy
Four main benefits
8
Compliance
Marketing
edge
Lowering the
expenses
Optimizing
business
processes

9. ©2015 27001Academy www.advisera.com/27001academy
Return on investment (ROI)
9
• Asset: server
• Threat: fire
• Single Loss Expectancy (SLE) = $5000
• Annualized Rate of Occurrence (ARO) =
10%
• Annualized Loss Expectancy (ALE) = $500
• Conclusion: any investment in security
< $500 annually is profitable

10. ©2015 27001Academy www.advisera.com/27001academy
Elevator speech
10
Not
more
than 45
seconds
Use a
vivid
example!
Short speech
you should
use to
influence your
executives to
support ISO
27001

11. ©2015 27001Academy www.advisera.com/27001academy
Using the right words
11
INSTEAD OF: USE:
Backup/firewall Prevention
Cost Investment
Probability Risk
Incident Damage
Disaster Loss/downtime

12. ©2015 27001Academy www.advisera.com/27001academy
Conclusions
12
ISO 27001 will pay off if it prevents only
one medium incident, not to mention large
ones
Use this key message and convince your
management!

13. Q & A
Dejan Kosutic

14. Thank you!