CGI

ISO 9001:2015 and Cybersecurity/IT

Origin and Development

ISO 9001:2015 is a quality management system standard developed by the International Organization for Standardization (ISO), a global federation of national standards bodies. However, it's important to clarify that ISO 9001:2015 is not specifically a cybersecurity or IT certification—it's a general quality management standard applicable to any organization regardless of industry. The standard was released in 2015 as the fifth revision of ISO 9001, which was first published in 1987. For cybersecurity specifically, ISO created ISO/IEC 27001, which is the actual information security management system standard.

Industry Value and Importance

ISO 9001:2015 is valued across industries because it demonstrates an organization's commitment to consistent quality management, customer satisfaction, and continuous improvement. When applied to IT and cybersecurity contexts, it helps organizations establish systematic processes for service delivery and quality assurance. However, for cybersecurity-specific certification, organizations typically pursue ISO/IEC 27001, which directly addresses information security controls, risk management, and data protection. Both certifications are internationally recognized and often required for government contracts, enterprise partnerships, and demonstrating due diligence to customers and stakeholders.

ISO 27001:2013: Information Security Management Standard

Origin

ISO 27001:2013 was developed and published by the International Organization for Standardization (ISO) in partnership with the International Electrotechnical Commission (IEC). Released in October 2013 as a revision to the original 2005 version, this standard emerged from the earlier British Standard BS 7799, which was created in the 1990s. The standard was developed to provide organizations with a systematic framework for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS), addressing the growing need for consistent information security practices across industries and borders.

Industry Importance

ISO 27001:2013 is highly valued in the industry because it provides internationally recognized criteria for managing sensitive information and mitigating security risks. Organizations that achieve certification demonstrate to clients, partners, and regulators that they follow best practices for protecting data confidentiality, integrity, and availability. The certification is particularly important for companies handling sensitive customer data, those working with government contracts, or businesses operating in regulated industries. It also provides competitive advantages in procurement processes, helps organizations meet legal and regulatory requirements, and reduces the likelihood of costly data breaches through its risk-based approach to security management.

CREST Cybersecurity Certification

Origin

CREST (Council of Registered Ethical Security Testers) was established in 2006 in the United Kingdom by a group of cybersecurity professionals and industry representatives. It was created to address the growing need for standardized, recognized qualifications in penetration testing and cybersecurity services. The organization emerged from concerns about the quality and professionalism of security testing services, aiming to provide a framework that would certify both individual practitioners and the companies that employ them.

Industry Value

CREST certifications are highly valued in the cybersecurity industry because they demonstrate a practitioner's technical competence and adherence to professional ethical standards. Many government agencies, financial institutions, and large corporations specifically require CREST-certified professionals when procuring penetration testing or security assessment services. The certification provides assurance to employers and clients that certified individuals have been independently verified to possess the necessary skills and knowledge, and that they follow established codes of conduct. This makes CREST credentials particularly important for cybersecurity professionals working in regulated industries or seeking to work with organizations that have stringent security requirements.

Origin of CompTIA Security+

CompTIA Security+ was created by the Computing Technology Industry Association (CompTIA), a non-profit trade association established in 1982. The Security+ certification was first launched in 2002 as a response to the growing need for standardized cybersecurity knowledge in the IT industry. CompTIA developed this vendor-neutral certification to establish a baseline of competency for IT security professionals, covering essential principles and best practices that apply across different technologies and platforms rather than focusing on specific products or vendors.

Industry Value and Importance

Security+ is widely recognized as one of the most valuable entry-to-intermediate level cybersecurity certifications in the industry. It meets the ISO 17024 standard and is approved by the U.S. Department of Defense (DoD) as one of the required certifications for information assurance positions, making it particularly valuable for government contractors and military personnel. Employers value Security+ because it validates that holders possess practical, hands-on skills in areas such as threat detection, risk management, cryptography, and network security. The certification's vendor-neutral approach means certified professionals can work with any technology platform, making them versatile assets to organizations of all sizes and across all sectors.