Achieving ISO 27001: Strengthening Information Security at Homeless Link

In this blog, Homeless Link Deputy CEO Matt Harrison shares our journey towards achieving ISO 27001 certification, explaining why we made the investment, what the process involved, and how it will help us strengthen information security, build confidence among our stakeholders and support the delivery of our services.

We are pleased to be able to announce that Homeless Link has now been awarded the ISO27001 certification for Information Security. ISO27001 is the world’s leading international standard for information security management systems. It builds on the work we have done at Homeless Link in recent years to improve our information security including obtaining Cyber Essentials certification in 2018 and Cyber Essentials plus certification in 2025.

It has been a lot of work over the past 12 months to get us to this point. We have spent about £40k on IT systems, consultancy support and audit fees and also about 200 days of staff time on the process. So why have we made this significant investment?

There are three main reasons:

1. To improve our Information Security

We are entirely dependent on IT to do all our work. Our staff work remotely from all over the country, we use email, mobile phones, laptops, documents, databases, Salesforce, Slack, Office 365 etc to do all our work. And we provide online systems like In-Form and CHAIN to our customers. And this is against the backdrop of an ever-increasing risk of cyber-attack threat potentially affecting our systems, data, finances and the personal data we manage for our members.

2. To provide reassurance for our stakeholders

Having good information security policies and processes provides reassurance to our leadership, board, funders, members and customers that we take these threats seriously and invest in good systems and processes to maintain the confidentiality, integrity and availability of our systems.

3. To make it easier to sell our systems and services

We provide services like In-Form, CHAIN, consultancy and training services to organisations of all sizes. Larger organisations like government departments, NHS bodies, local authorities, housing associations and large charities will normally run procurement and due diligence processes before we can work with the. Having ISO27001 certification will help massively with these processes.

What work was involved?

We took the decision to attempt to achieve ISO27001 certification last summer. We discussed it at SMT and Board level to get approval for the investment required. We recognised that we needed support to help us manage the process, so we carried out a tender exercise to appoint consultants to work with us. The firm we appointed (Cognisys) recommended using a software platform (Vanta) to help manage the process.

We had done a lot of work on these issues already. We had an IT strategy, IT usage policies, an Information Security policy, a risk assessment process and Cyber Essentials certification of our technical controls. We employ an IT services company (Smartdesc) to manage our network infrastructure, computers and software. We were using anti-malware software, email filtering and endpoint security software. We had moved away from owning our own servers to a 100% cloud setup with Microsoft, Salesforce and AWS. We had already developed good processes for software development, data protection, risk management, staff recruitment, onboarding and offboarding and providing support desks for our systems.

What the ISMS does is put all this work into a structured framework, making sure we have all the policies and procedures we need, that those procedures are documented and evidenced and that all staff have been trained in their use.

We had to adopt about 20 new policies and procedures. Our consultants provided us with templates, but these needed adapting to our circumstances, were reviewed by SMT and approved by our board before we trained all staff in the new policies and processes. We then had to provide documentary evidence (over 100 items) to prove that we are following these new processes. We setup a small team of staff from across the organisation (including IT, Finance, HR, In-Form, CHAIN) to help with this work.

We had to connect Vanta to all our systems to make sure that we had the right technical controls on all our systems and devices, including MFA, anti-virus, patching, screenlock, HD encryption, access controls.

In total there were about 225 tests we needed to pass and show the evidence for each test. This was all managed using Vanta. And once we’d done that we needed to go through a multi-stage audit process. This included a tabletop exercise, management review and internal audit with our consultants and then a 2-stage external audit with an independent audit firm (Insight Assurance). This last stage alone took about 3 weeks with daily meetings!

But the work doesn’t stop here. We need to keep all our policies, systems and processes under review, look for opportunities for continuous improvement, and carry out further tabletop exercises (scenario planning), management reviews and internal audit, plus another external audit next summer to retain our certification. To manage this process, we have set up an ISMS team of 6 people who will meet quarterly to review progress and plan and carry out actions to improve our information security.

We know that many of our members will be very concerned about information security and will be looking at ISO27001 certification – indeed we know that some of you already have it or are working towards it. We’re very keen to share our experience with you. We are planning a webinar about this, but I would also be happy to discuss it individually with any of you.