IT Security Standard Certification

BlueSpud

Does anyone know of any well recognised industry standard for certification of IT security standards, for a small company of say 5 employees, without money to spend. ISO I believe is out of the question cos to takes oceans of time. I am looking for something more appropriate to scale. We have a few servers on our network and desktops.

constellation

Do you want to certify the company or the employees? If the former, will it actually help the business - i.e. increase profits?

BlueSpud

I want to certify the company, i.e. that we follow some recognised policies etc. It is one of those tick boxes in tendering.

CptSternn

Microsoft offers MCSE: Security certs, but thats for employees. There are security certs you can get to verify your website is secure from Thawte and a few other companies, but as far as certifying that your whole company meets a certain standard, I have yet to hear of such a standard.

The main problem being - how can you certify your company of 5 or so is meeting a security standard if the employees themselves don't have any security certs.

quinta

The only really recognised one for security frameworks/standards etc is ISO27001 - It will require a spend though as will any certification process you go through.

han68

We achieved ISO27001:2005 accreditation after about 6-8 months of work, but it will indeed cost you (apart from the effort).

Certification Europe has info (and courses) regarding ISO27001 certification

http://www.certificationeurope.com

And no, I do not work there

BlueSpud

thanks for all the input guys. The MCSE for employees might be a flag worth flying.

mick.fr

Your company can become a Microsoft partner certified in Security.
You need one guy certified MCSE: Security, another with any security certification (MCP security) or other vendors as well.
Plus you will need 3 customer references regarding security.