Information Security Management System (ISMS) Certification
The CSM27001 scheme provides an audit and certification services based on the ISO/IEC 27001 standard. The ISO/IEC 27001 standard specifies the requirements for establishing, operating, monitoring, reviewing, maintaining and improving an organisation’s Information Security Management System.
With the Scheme, various information security goals, such as protecting the con?dentiality, availability, authenticity, non-repudiation, and integrity of information handled by the organisation could be achieved through a certification programme based on the internationally recognised standard ISO/IEC 27001.
Certification Benefits
- Enhance competitiveness and bench mark your organisation within peer community globally
- Increase trust from your clients, business partners and/or other interested parties
- Maximize opportunities and manage information security risks effectively
- Recognise your established information security as integral part of your business
- Promote compliance to legal, regulatory and/or customers’ requirements
Impartiality Policy
CyberSecurity Malaysia undertakes to manage impartiality and to ensure that certification activities undertaken are conducted in an impartial manner.
We do not permit commercial, financial or other pressures to compromise our commitment to impartiality. The credibility, integrity and objectivity of a certification is fundamental to our client’s needs and for those that subsequently rely on it.
We commit to ensure that any threats to the impartiality and confidentiality in the certification activities are managed robustly and pro-actively.
We practice impartiality and monitors this closely through an impartiality committee made up of members representing key interested parties.
We also commit to identify and assess risks in related certification activities which may result in a conflict of interest or pose a threat to impartiality. The risk assessment covers possible sources of conflict of interests, regardless of their origin.
- INTRODUCTION
These Terms of Service have been structured in accordance with the applicable requirements of the accreditation bodies. - SCOPE
CyberSecurity Malaysia provides services to persons, firms or companies (each a “Client”). CyberSecurity Malaysia may provide its services directly or, in its absolute discretion, through (a) its own employees, (b) any affiliated company or (c) any other person or organisation, as may be entrusted by CyberSecurity Malaysia. Where part of the work is subcontracted to others, CyberSecurity Malaysia retains full responsibility for granting, maintaining, extending, reducing, suspending or withdrawing certification and for ensuring that properly documented agreements are in place. CyberSecurity Malaysia will notify its clients of any changes to the requirements for certification within a reasonable timeframe. - CONFIDENTIALITY
CyberSecurity Malaysia maintains confidentiality at all levels of its organisation concerning information obtained in the course of its business. No information will be disclosed to any third party unless in response to legal process or required by an accreditation body as part of the accreditation process. The client's name, location, scope of certification and contact numbers may be entered into relevant directories. CyberSecurity Malaysia protects your personal data, the data collected by CyberSecurity Malaysia in this form will not be used for any other purpose than the purpose it was collected unless consented by you ,will not sell, transfer, share with a third party, will not retain for longer period than necessary, will take necessary measures to protect your personal data. - ORGANISATIONAL STRUCTURE
A copy of the organisation chart of CyberSecurity Malaysia, showing the responsibility and reporting structure of the organisation, and documentation identifying the legal status of CyberSecurity Malaysia are available on request. - APPLICATION FOR CERTIFICATION
On receipt of a completed Application Form (provided by CyberSecurity Malaysia upon request), a quotation is sent to the Client outlining the costs of the services together with an acceptance slip. Once the acceptance slip is returned, together with any due payments and controlled copies of relevant documentation and samples, the project will be allocated to auditor(s) who will be responsible for ensuring that the services are carried out in accordance with the procedures of CyberSecurity Malaysia. - INITIAL CERTIFICATION
The initial certification audit is conducted in two stages, namely Stage 1 and Stage 2 audit. The purpose of Stage 1 audit is to verify that the client’s management system is implemented and the client’s preparedness of Stage 2 audit. Meanwhile, the Stage 2 audit will evaluate the implementation of the client’s management system. - CLIENT'S OBLIGATIONS
In order to obtain and retain certification, the Client shall comply with the following procedures and rules: the Client shall make available to CyberSecurity Malaysia all documents, samples of products, drawings, specifications and other information required by CyberSecurity Malaysia to complete the CSM27001 audit and certification service and shall appoint a designated person who is authorised to maintain contact with CyberSecurity Malaysia; CyberSecurity Malaysia, if not satisfied that all certification requirements are met, shall inform the Client of those aspects in which the application has failed; when the Client can show that remedial action has been taken by it, within the time limit specified by CyberSecurity Malaysia, to meet all the requirements, CyberSecurity Malaysia will arrange, at additional cost to the Client, to repeat only the necessary parts of the assessment; if the Client fails to take acceptable remedial action within the specified time limit it may be necessary for CyberSecurity Malaysia, at additional cost, to repeat the assessment in full; identification of conformity shall refer only to the sites or products assessed as specified in the Certificate and Assessment Schedule (if any) or other attachments which may accompany the Certificate; fees may be paid by a nominee or appointed vendor of the Client, on behalf of the Client. Notwithstanding the foregoing, the Client shall remain responsible for the performance of its obligations under this Terms & Conditions. - ISSUANCE OF CERTIFICATE
When CyberSecurity Malaysia is satisfied that the Client meets all the certification requirements, it will inform the Client and issue a Certificate. The Certificate shall remain the property of CyberSecurity Malaysia and may only be copied or reproduced for the benefit of a third party if the word “copy” is marked thereon. The Certificate will be published at ISCB website (https://iscb.cybersecurity.my) and will remain valid unless surveillance reveals that the management system of the Client no longer meet the standards, norms, regulations or this Terms & Conditions. - CERTIFICATION MARKS
Upon issuance of a Certificate, CyberSecurity Malaysia may authorise the Client to use a designated certification mark. A Client’s right to use any such mark is contingent on maintaining a valid Certificate in respect of the certified management system or products and compliance with the regulations governing the use of the mark issued by CyberSecurity Malaysia. A Client who has been authorised to use the mark of an accrediting body must also comply with the rules governing the mark of such body. Improper use of such a mark is non-conformity with certification requirements and could result in suspension of certification. - SURVEILLANCE
Periodic surveillances shall be carried out and shall cover aspects of the management system, documentation, manufacturing and distributing processes and products, depending on the type of certification services provided, at the discretion of CyberSecurity Malaysia or the nominated auditor. The Client shall give access to all sites or products for surveillance purposes whenever deemed necessary and CyberSecurity Malaysia shall reserve the right to make unannounced visits as required. The Client shall maintain a register recording all customer complaints and safety-related incidents reported by an enforcing authority or users relating to those covered by the Certificate and make this available to CyberSecurity Malaysia on request. The Client shall be informed of the results of each surveillance visit. - RENEWAL OF CERTIFICATION
Clients wishing to revalidate Certificates approaching the end of their cycles shall apply under the procedure set forth in Clause 5. Clients are generally informed of the requirement for renewal of the certification during the pre-renewal visit which is the last surveillance visit of each cycle. - EXTENSION OF CERTIFICATION
In order to extend the scope of a Certificate to cover additional sites or processes, Client shall complete a new Application Form. The application procedure outlined in Clause 5 will be followed and an assessment will be carried out on those areas/processes not previously covered. The cost of extending the scope of certification will be based on the nature and programme of work. Following a successful assessment an amended Certificate or Assessment Schedule, as the case may be, will be issued covering those aspects covered by the extended Certificate. Although the original Certificate will normally remain in force, it may be necessary in some instances to issue a new Certificate. In such cases the Client must return the superseded Certificate to CyberSecurity Malaysia. - SYSTEM/PROCESS MODIFICATION
The Client shall inform CyberSecurity Malaysia, in writing, of any intended modification to the management system or process which may affect compliance with the standards, norms or regulations. CyberSecurity Malaysia will determine whether the notified changes require additional assessment. Failure to notify CyberSecurity Malaysia of any intended modification may result in suspension of the Certificate. - PUBLICITY BY CLIENT
In compliance with the applicable Regulations governing the relevant mark(s), a Client may render public that its relevant management system or products have been certified and may print the relevant certification mark on stationery and publicity materials relating to the scope of certification. In any case, the Client shall ensure that its announcements and advertising material do not create confusion or could otherwise mislead third parties about certified and non-certified systems, products or sites. - MISUSE OF CERTIFICATE AND CERTIFICATION MARK
CyberSecurity Malaysia shall take suitable action, at the expense of the Client, to deal with incorrect or misleading references to certification or use of Certificates and certification marks. These include suspension or withdrawal of Certificate, legal action and/or publication of the transgression. - SUSPENSION OF CERTIFICATE
A Certificate may be suspended by CyberSecurity Malaysia for a limited period in cases such as the following: if a Corrective Action Request has not been satisfactorily complied with within the designated time limit; if a case of misuse as described in Clause 14 is not corrected by suitable retractions or other appropriate remedial measures by the Client; if a Client ceases to supply the product, process or service or some part of it (which is the subject matter of the certification) for an extended period of time, exceeding two (2) months; if a Client does not allow CyberSecurity Malaysia to conduct surveillance or re-certification audits in the required time frame; if a Client fails or refuses to pay to CyberSecurity Malaysia any part of the fees which may have become due and payable; Improper use of certification mark in accordance with the certification requirements. CyberSecurity Malaysia will confirm in writing to the Client the suspension of a Certificate. At the same time, CyberSecurity Malaysia shall indicate under which conditions the suspension will be removed. At the end of the suspension period, an investigation will be carried out to determine whether the indicated conditions for reinstating the Certificate have been fulfilled. On fulfilment of these conditions the suspension shall be lifted and the Client notified of the Certificate reinstatement. If the conditions are not fulfilled the Certificate shall be withdrawn. All costs incurred by CyberSecurity Malaysia in suspending and reinstating a Certificate will be charged to the Client. - WITHDRAWAL OF CERTIFICATE
A Certificate may be withdrawn if the Client voluntary withdraw the certificate and advises CyberSecurity Malaysia in writing; the Client takes inadequate measures in case of suspension; the certified process, service, product etc do not conform to the standards, norms or regulations or are no longer offered; CyberSecurity Malaysia terminates its contract with the Client. In any of these cases, CyberSecurity Malaysia has the right to withdraw the Certificate by informing the Client in writing. The Client may give notice of appeal (see Clause 19). In cases of withdrawal, no reimbursement of assessment fees shall be given and withdrawal of the Certificate shall be published by CyberSecurity Malaysia and notified to the appropriate accreditation body, if any. - CANCELLATION OF CERTIFICATE
A Certificate will be cancelled if the Client advises CyberSecurity Malaysia in writing that it does not wish to renew the Certificate or goes out of business; the Client no longer offers the certified process, service, product etc; the Client does not timely commence application for renewal; the Client fails or refuses to pay to CyberSecurity Malaysia any part of the fees which may have become due and payable. In cases of cancellation no reimbursement of assessment fees shall be given and cancellation of the Certificate shall be published by CyberSecurity Malaysia and notified to the appropriate accreditation body, if any. - RECOGNITION OF ACCREDITED ORGANISATIONS
CyberSecurity Malaysia, in its absolute discretion, generally recognises the certificates issued by other accredited organisations where this does not compromise the integrity of information security management system certification scheme. - APPEALS
The Client may, through the Complaints and Appeals Procedure request reconsideration of a decision made by CyberSecurity Malaysia. Appeals can be filed by any client organisation to CyberSecurity Malaysia and may be filed for reasons associated with:- Rejection of application;
- Rejection of conducting audit; and
- Reconsideration of the suspension or withdrawal of certification.
Notification of the intention to appeal must be made in writing and received by CyberSecurity Malaysia within seven (7) business days from receipt of notification by CyberSecurity Malaysia, supported by relevant facts and data for consideration during the Complaints and Appeals Procedure. The minimum information required are:- The name of the appellant;
- Contact details for the appellant;
- The application/audit/certification decision that is the subject of the appeal; and
- Description of the appeal.
If the required information cannot be supplied, the appeal is automatically rejected and a formal rejection letter is sent to the appellant. All appeals are forwarded to CyberSecurity Malaysia and are put before the appeal’s committee of CyberSecurity Malaysia. CyberSecurity Malaysia shall be required to submit evidence to support its decision to withhold, suspend or withdraw the Certificate. Any appeals received are fully investigated, documented and appropriate follow-up action taken within 3 months. The decision of the appeal's committee shall be final and binding on both the Client and CyberSecurity Malaysia. Once the decision regarding an appeal has been made, no counter-claim by either party in dispute can be made to amend or change this decision. In instances where the appeal has been successful and the Certificate issued or reinstated, no claim can be made against CyberSecurity Malaysia for reimbursement of costs or any other losses incurred as a result of the withholding, suspension or withdrawal notification. - COMPLAINTS
Any complaint regarding the certification activities of CyberSecurity Malaysia or relating to a certified client shall be made in writing, without delay, and addressed to the Client Relationship Manager (CRM). The minimum information required are:- The name of the complainant;
- Contact details for the complainant;
- The certification activity that is the subject of the complaint; and
- Description of the complaint.
If the required information cannot be supplied, the complaint is automatically rejected and a formal rejection letter is sent to the complainant. Any complaints received are fully investigated, documented and appropriate follow-up action taken within 3 months.
How To Apply
Certification Process
The steps towards achieving ISO/IEC 27001 certification are shown below:
Application
Organisations should complete an application form and provide relevant supporting information to request for quotation. Kindly note that the quotation for audit days will vary depending on the scope of certification, the size of the organisation, complexity of the scope etc.
Application Review
The application will be reviewed by Certification Body (CB) to ensure information about the organisation and its management system is sufficient and the CB has the competence and ability to perform the certification activity. Based on this review, the CB will either accept or decline the application.
Stage 1 Audit
The purpose of Stage 1 Audit is to verify that the organisation’s management system is implemented and the organisation’s preparedness of Stage 2 audit. CB will review the organisation’s management system documented information and obtain the necessary information regarding the scope of management system.
Stage 2 Audit
Stage 2 audit evaluates the implementation, including effectiveness of the organisation’s ISMS. Where Non-conformities and Opportunities for Improvements are observed, the CB will formally document them. The organisation should provide an appropriate set of corrective actions to resolve the identified non-conformities.
Certification Decision
All information and audit evidence gathered during Stage 1 and Stage 2 audits will be analysed in order to review the audit findings and agree on the audit conclusions. The CB will make the final decision after all non-conformities have been resolved. The decision include granting or refusing certification, expanding or reducing the scope of certification.
Surveillance/Recertification
Surveillance audits are conducted periodically for the CB to maintain confidence that the organisation’s certified management system continues to fulfil the standard requirements. Recertification audit will be conducted if the organisation wishes to renew its certification. The purpose of the recertification audit is to confirm the continued conformity and effectiveness of the management system, and its continued relevance and applicability for the scope of certification.
Apply here
Click here to download the CSM27001 Application Form.
Certification Fee
The total fee will vary depending on the organisation's scope and size. Shown here is the general guideline:
| Evaluation Assurance Level | Certification Assurance Fees |
| EAL1 | RM 16,000 |
| Application Fee | RM 500.00 |
| Initial Certification Fee |
Adequacy Audit |
| Compliance Audit | |
| Annual Fee | RM 1000.00 |
| Surveillance Fees |
Surveillance 1 |
| Surveillance 2 |
The total audit fee includes the professional fee, the number of auditor and the required number of audit days. This will be determined based on client organization desired certification scope.
Fees shown are not inclusive of incidental cost which covers accommodation and travel (where applicable). These fees will be charged directly to the organisation.
Contact
For any enquiry please contact:
enquiry@cybersecurity.my