ISO/IEC 27001 Certification in Moroccan Companies: Trends and Future Recommendations

Abstract

In a context marked by an increasingly open information technology environment, with a significant flow of data, the exponential growth of cyber threats and attacks, the embedded security risk in every IT asset, and the challenges related to ensuring the confidentiality, integrity, and availability of information. Adopting an Information Security Management System has become an essential requirement for organizations to meet their goals, and safeguard the interests of their key stakeholders, reputation, brand, and value-creating activities. This paper provides an overview of the challenges related to adopting the ISO/IEC 27001 standards by Moroccan firms. The paper analyzes the outcome of the questionnaire with security engineers: Chief Information Security Officer “CISO”, Security Operations Center “SOC” responsible, incident handling and response team, as well as IT engineers to evaluate the readiness of 62 enterprises to implement an ISMS based on The ISO/IEC 27001 standards. With an emphasis on ISO/IEC 27001 requirements and their significance, related trends, and key issues. In addition, we examine the correlation between ISO/IEC 27001 certification process and the Moroccan regulation. Our findings underscore the limitations related to establishing robust information security strategies within Moroccan enterprises and provide insights into the challenges encountered during the implementation of ISO/IEC 27001. Furthermore, the study emphasizes the importance of awareness, policies and procedures to manage risks effectively including threads related to Artificial Intelligence and Cloud environment. As a result, this paper provides new insight and recommendations that should be considered in the Moroccan context, to assist companies in implementing ISMS and achieving the ISO/IEC 27001 certification.