FEBRUARY 2019CIOAPPLICATIONSEUROPE.COM 19The accreditation has encouraged a culture of continuous improvement across the organisation.This has involved not only a serious level of investment in technologies but also considerable upskilling of key staff and general upskilling of all staff using a common standard of office tools. A full software licencing review was undertaken in the lead up to consolidation of key licencing requirements. Further upskilling of staff is now being achieved through our virtual learning environment, delivering information security, regulatory and induction training, awareness and assessment.A project management methodology was developed around the APM body of knowledge, ensuring successful and consistent project delivery. Everyone involved in the programme benefited from this approach as it ensured project deliverables were achieved through the motivation and determination of the programme team.A series of project plans were developed to ensure the programme objectives were achieved and prerequisites met. Utilisation of the plans enabled monitoring of progress through to achievement of ISO27001. Focusing on a phased and modular approach within the project plans also ensured deliverables were not overly complex at any point in time.Many highlight reports and update meetings ensured the status of the programme was regularly communicated to stakeholders and investors. The reports monitored progress towards milestones and highlighted risks and issues. As we worked through the project life cycle, regular reviews were conducted ensuring continual improvement in information security and monitoring progress towards the ISO27001 standard.Information security tasks were developed for various teams in the business to complete, with progress monitored by management. Developing our Disaster Recovery plans for IT core systems, emphasised the importance of application continuity across the business. This approach ensured employees were motivated to take responsibility for their respective applications knowing this was key to achieving accreditation.The business has become a lot more technology lead as we break new ground in fleet management. Alongside this, the requirement for protective best practice and new legislation have helped to drive Information Security to be considered at the start of, and throughout, new projects. This has also raised the appreciation within the business of the importance of securing information and the work the Information Security team do in support of the business.Alongside the extensive changes realised from ISO27001 best practice, we have introduced considerable change to IT infrastructure and IT operational practices, which has led to a massive change in culture throughout the business, as well as increased respect for information.Having now achieved the level of success of the accreditation, indicative by the very limited observations the independent assessors were able to identify, and with the concept of continuous improvement being a key facet of ISO7001, the appetite within the business is now to achieve accreditation for the entire global organisation by the point of re-certification in early 2021.All of this has helped to open new doors for the business and growing the opportunities to support a corporate objective for considerable growth over the coming few years. New technologies also required new skills in-house to manage the technology and we recruited several key staff to help us define and build policies, processes and proceduresDave Roberts
< Page 9 | Page 11 >