The Standards Association of Zimbabwe (SAZ) recently attained accreditation for ISO/IEC 27001 certification, marking an important milestone in strengthening confidence in information security management systems certification. In this interview, SAZ Communications Officer (CO) speaks with the Director of Certification Services, Mr. R. Mutonono (RM), on what the accreditation means for SAZ, certified organizations and the wider market.

1. What does this accreditation mean for your organization?
   
2. CO: What does attaining accreditation for ISO/IEC 27001 mean for our organization?
   RM: This acts as an independent proof of competence, impartiality, integrity, openness and application of risk-based approach in the certification process. This also elevates our credibility globally as certificates issued by SAZ are recognized through our accreditation body SADCAS which is a full signatory under the Multi Recognition Arrangements (MRAs) and Multilateral Recognition Arrangements (MLAs).
   
3. Significance for organizations that will be certified
   
4. CO: What does it mean for an organization to be certified by an accredited certification body under ISO/IEC 27001?
   RM: The certificates issued are recognized globally. This creates a competitive advantage over organizations certified by an unaccredited body. The certified organizations will be listed on the IAF SEARCH global data system which can be accessed by various interested parties across the globe thus creating more business opportunities. The certified organization will have confidence in the audit process offered by the certification body knowing that these are also subject to assessment by the Accreditation body.

---

3. Value of ISO/IEC 27001 in today’s environment
5. CO: Why is ISO/IEC 27001 especially relevant in today’s digital and increasingly interconnected business environment?
   RM: This is an Information Security Management System standard that focuses on helping organizations proactively protect sensitive data, minimize cyber security risks, achieve compliance and build global trust with clients and relevant stakeholders. The standard is structured on 3 important pillars which are Confidentiality (only authorized users access the data), Integrity (data remains accurate and unaltered) and Availability of data (data is accessible when needed). Through effective implementation of ISO/IEC 27001, businesses can avoid massive financial and reputational losses associated with cyberattacks. This standard provides an organization with a set of controls (93 in total) that an organization can apply as a minimum to mitigate all potential security risks and cybersecurity threats. The controls are categorized into 4 main groups which are organizational (37), people (8), physical (4) and technological (34).

---

5. Market impact and opportunities
   
6. CO: What new opportunities does this accreditation create for our organization and for the market we serve?
   RM: This creates the opportunity to increase the volume of SAZ certified organizations and make accredited certification locally available and more affordable. Organizations certified by SAZ can pay for certification services using our local currency thereby saving our country of the much-needed foreign currency. Opportunities to certify organizations outside our borders have been created by attaining ISO/IEC 27001 accreditation. With the coming in of the African Continental Free Trade Area (AfCFTA) this accreditation provides a solid base on which SAZ can extend its certification services to the entire African region.

---

1. CO: What opportunities does this accreditation create for organizations in Zimbabwe and the region?
   RM: Several opportunities exist because of this accreditation. These include

• Access to be certified by a body that understands the regional context and dynamics of our economies from an African perspective.
• Benefit from the continual improvement initiatives which come as part of the requirements across all ISO management system standards.
• Better understanding and meeting of the legal obligations and compliance within the information security and cyber security space
• Enhanced confidence from relevant stakeholders which creates better image and reputation
• Getting listed on the IAF SEARCH global data system which can be accessed by various interested parties across the globe thus creating more business opportunities
• Avoid financial costs associated with data breaches
• Building a sustainable security culture within the organization which provides a proactive approach.

1. CO: What message would you like to share with organizations considering certification to ISO/IEC 27001?
   RM: My message is clear that change is inevitable and organizations need to realize that information is a key asset of the organization. Like any other asset, it needs to be well managed. Every organization in one way or another handles sensitive information which must be protected to provide confidence for the relevant stakeholders. There is no better way of providing this confidence other than implementing and attaining accredited certification to ISO/IEC 27001 standard. SAZ is ready to offer this valuable and credible certification. Please feel free to reach out to SAZ Certification Services for more details on the certification process.

---