News & Topics
Ascendant Becomes ISO27001 Certified for BPO of Payroll and Social Insurance Admin
February 24, 2010
Ascendant was examined by external auditors and certified by JIPDEC effective from February 4, 2010 until February 3, 2013.
ISO/IEC27001:2005, JIS Q 27001:2006 requires that management:
• Systematically examine the organization's information security risks, taking account of the threats, vulnerabilities and impacts;
• Design and implement a coherent and comprehensive suite of information security controls and/or other forms of risk treatment (such as risk avoidance or risk transfer) to address those risks that are deemed unacceptable; and
• Adopt an overarching management process to ensure that the information security controls continue to meet the organization's information security needs on an ongoing basis.
To ensure conformity to standards, Ascendant will now be subject to annual audits that require a three-stage process:
• Stage 1 is a preliminary, informal review of the ISMS standard requirement, for example checking the existence and completeness of key documentation such as the organization's information security policy, Statement of Applicability (SoA) and Risk Treatment Plan (RTP). This stage serves to familiarize the auditors with the organization and vice versa.
• Stage 2 is a more detailed and formal compliance audit, independently testing the ISMS against the requirements specified in ISO/IEC 27001. The auditors will seek evidence to confirm that the management system has been properly designed and implemented, and is in fact in operation (for example by confirming that a security committee or similar management body meets regularly to oversee the ISMS). Certification audits are usually conducted by ISO/IEC 27001 Lead Auditors. Passing this stage results in the ISMS being certified compliant with ISO/IEC 27001.
• Stage 3 involves follow-up reviews or audits to confirm that the organization remains in compliance with the standard. Certification maintenance requires periodic re-assessment audits to confirm that the ISMS continues to operate as specified and intended. These should happen at least annually but (by agreement with management) are often conducted more frequently, particularly while the ISMS is still maturing.
Ascendant's license number is 1444084 certified by Bureau Veritas Japan on February 4,2010.
