There are many ways your organisation can be impacted by a failure to protect your information and the consequences can be catastrophic.
For example, in Europe, a failure to protect the personally identifiable information (PII) of your employees or customers could result in your organisation being prosecuted under the General Data Protection Regulation (GDPR).
This carries with it fines of up to 4% of global turnover, or 20 million Euros, whichever is the higher.
If a failure to protect information becomes public knowledge, it can also lead to negative publicity in traditional or social media, resulting in significant brand and reputational damage and impacting your organisation’s ability to generate revenue.
Implementing an ISMS based upon ISO 27001 will help you to identify where your greatest risks are and for you to deal with them appropriately, and reduce the likelihood of significant impacts occurring. This will reassure your stakeholders that information security risk is being managed effectively.
It’s one thing having the required technical knowledge, it’s another thing for a consultant to apply that knowledge to the context of our organisation. To use a sporting analogy, we view cyber and information security as a marathon not a sprint. I am not a believer in doing everything all at once. Our approach has been risk based and incremental, remediating our biggest risks first before moving on. I believe this approach is far more sustainable and effective. And URM’s consultants fully understand this and are very pragmatic and tailored in their guidance and advice. They know we are not implementing ISO 27001 purely for the certificate, but more as a framework for continual improvement, and at a pace where new systems and processes can be fully understood and absorbed by our team and be business as usual.
Brand distributor
Thinking about ISO 27001 but unsure how your project should take shape?
We offer a free, no‑commitment call to help you clarify your certification pathway, understand the standard in the context of your business.
Find out more
related BLog
ISO 27001 Clause 7.5: Documented Information Explained
Published on
27 Apr
2026
URM’s blog breaks down ISO 27001 Clause 7.5 requirements, with practical guidance on how to achieve conformance to this Clause & what external assessors expect.
Read more
Information Security
Published on
15/4/2026
ISO 27001 – Clause 6.3: The Importance of Planned ISMS Change ManagementURM’s blog explains the purpose & requirements of ISO 27001 Clause 6.3, types of ISMS change it covers, and key considerations when putting it into practice.
Read more
Information Security
Published on
2/4/2026
Transitioning to ISO 27001:2022If your organisation is looking to transition to ISO 27001:2022, URM’s blog provides practical and invaluable guidance on meeting the new requirements.
Read more
Information Security
Published on
2/4/2026
What is the CIA Security Triad? Confidentiality, Integrity and Availability ExplainedURM’s blog explains how the principles of confidentiality, integrity and availability (CIA) can help align your information security controls with best practice
Read more
"
Whenever we have asked our QSA and account manager whether additional work is required outside of the annual cycle, there has never been a hard sell of any of URM’s services, and instead offer advice based on our compliance requirements and business needs.
CISO at University of Surrey
contact US
Let us help you
Let us help you in your compliance journey by completing the form and letting us know how we can best support you.