iPedia Free Information Center

Information about Iso 17799

ISO/IEC 27002 is an information security standard published by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) as ISO/IEC 17799:2005 and subsequently renumbered ISO/IEC 27002:2005 in July 2007, bringing it into line with the other ISO/IEC 27000-series standards. It is entitled Information technology - Security techniques - Code of practice for information security management. The current standard is a revision of the version first published by ISO/IEC in 2000, which was a word-for-word copy of the British Standard (BS) 7799-1:1999.

ISO/IEC 27002 provides best practice recommendations on information security management for use by those who are responsible for initiating, implementing or maintaining Information Security Management Systems (ISMS). Information security is defined within the standard in the context of the C-I-A triad:
the preservation of confidentiality (ensuring that information is accessible only to those authorised to have access), integrity (safeguarding the accuracy and completeness of information and processing methods) and availability (ensuring that authorised users have access to information and associated assets when required).

Outline of the Standard

After the introductory sections, the standard contains the following twelve main sections:
  • 1: Risk Assessment
  • 2: Security policy - management direction
  • 3: Organization of information security - governance of information security
  • 4: Asset management - inventory and classification of information assets
  • 5: Human resources security - security aspects for employees joining, moving and leaving an organization
  • 6: Physical and environmental security - protection of the computer facilities
  • 7: Communications and operations management - management of technical security controls in systems and networks
  • 8: Access control - restriction of access rights to networks, systems, applications, functions and data
  • 9: Information systems acquisition, development and maintenance - building security into applications
  • 10: Information security incident management - anticipating and responding appropriately to information security breaches
  • 11: Business continuity management - protecting, maintaining and recovering business-critical processes and systems
  • 12: Compliance - ensuring conformance with information security policies, standards, laws and regulations
Within each section, information security controls and their objectives are specified and outlined. The information security controls are generally regarded as best practice means of achieving those objectives. For each of the controls, implementation guidance is provided. Specific controls are not mandated since:
  1. Each organization is expected to undertake a structured information security risk assessment process to determine its specific requirements before selecting controls that are appropriate to its particular circumstances. The introduction section outlines a risk assessment process although there are more specific standards covering this area such as ISO Technical Report TR 13335 GMITS Part 3 - Guidelines for the management of IT security - Security Techniques, and BS 7799 Part 3.
  2. It is practically impossible to list all conceivable controls in a general purpose standard. Industry-specific implementation guidance for ISO/IEC 27001 and 27002 are anticipated to give advice tailored to organizations in the telecomms, financial services, healthcare, lotteries and other industries.

National Equivalent Standards

ISO/IEC 27002 has directly equivalent national standards in countries such as Australia and New Zealand (AS/NZS ISO/IEC 17799:2006), the Netherlands (NEN-ISO/IEC 17799:2002 nl, 2005 version in translation), Denmark (DS484:2005), Sweden (SS 627799), Japan (JIS Q 27002), UNE 71501 (Spain), the United Kingdom (BS ISO/IEC 27002:2005), Uruguay (UNIT/ISO 17799:2005) and Estonia (EVS-ISO/IEC 17799:2003, 2005 version in translation). Translation and local publication often results in several months' delay after the main ISO/IEC standard is revised and released but the national standard bodies go to great lengths to ensure that the translated content accurately and completely reflects ISO/IEC 27002.

The ISO/IEC 27000 series

ISO/IEC 27002 is part of a growing family of ISO/IEC ISMS standards, the 'ISO/IEC 27000 series'. The others (most of which are in preparation) include:
  • ISO/IEC 27000 - a standard vocabulary for the ISMS standards (in preparation)
  • ISO/IEC 27001 - the certification standard against which organizations' ISMS may be certified (published in 2005)
  • ISO/IEC 27003 - a new ISMS implementation guide (in preparation)
  • ISO/IEC 27004 - a standard for information security measurement and metrics (in preparation)
  • ISO/IEC 27005 - a standard for risk management, potentially related to the current British Standard BS 7799 part 3
  • ISO/IEC 27006 - a guide to the certification/registration process (published in March 2007)
  • ISO/IEC 27007 - a guideline for auditing information security management systems (in preparation)
  • ISO/IEC 27799 - guidance on implementing ISO/IEC 27002 in the healthcare industry

Certification

ISO/IEC 27001 (Information technology - Security techniques - Information security management systems - Requirements) specifies a number of requirements for establishing, implementing, maintaining and improving an information security management system consistent with the best practices outlined in ISO/IEC 27002.

References

External links

See also

Information security means protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction.[1] The terms information security
..... Click the link for more information.
International Organization for Standardization (Organisation internationale de normalisation), widely known as ISO, is an international standard-setting body composed of representatives from various national standards organizations.
..... Click the link for more information.
The International Electrotechnical Commission[1] (IEC) is a not-for-profit, non-governmental international standards organization that prepares and publishes International Standards for all electrical, electronic and related technologies – collectively known
..... Click the link for more information.
The ISO/IEC 27000-series are information security standards published by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC).
..... Click the link for more information.
20th century - 21st century
1970s  1980s  1990s  - 2000s -  2010s  2020s  2030s
1997 1998 1999 - 2000 - 2001 2002 2003

2000 by topic:
News by month
Jan - Feb - Mar - Apr - May - Jun
..... Click the link for more information.
This article or section appears to contain a large number of buzzwords and may require cleanup.
Please help [ rewrite this article] to make it more concrete and meaningful, removing tautologies, obvious statements and excessive abstraction.
..... Click the link for more information.
Bold text

Information technology management (or IT management) is a combination of two branches of study, information technology and management.

Strictly speaking, there are two incarnations to this definition.
..... Click the link for more information.
ism was first used to form a noun of action from a verb. For example, baptize (or literally derived from "to dip") becomes "baptism". It is taken from the Greek suffix -ismos, Latin -ismus, and Old French -isme, that likewise forms abstract nouns from verbal stems.
..... Click the link for more information.
CIA triad are three principal classes of information assurance (IA) objectives confidentiality, integrity and availability. The three classes are also referred to as IA services, goals, aims, tenets or capabilities.
..... Click the link for more information.
Confidentiality has been defined by the International Organization for Standardization (ISO) as "ensuring that information is accessible only to those authorized to have access" and is one of the cornerstones of Information security.
..... Click the link for more information.
For other uses, see .


Integrity is the basing of one's actions on an internally consistent framework of principles. Depth of principles and adherence of each level to the next are key determining factors.
..... Click the link for more information.
availability has the following meanings:

1. The degree to which a system, subsystem, or equipment is operable and in a committable state at the start of a mission, when the mission is called for at an unknown, i.e., a random, time.
..... Click the link for more information.
A security policy is a definition of what it means to be secure for a system, organization or other entity. For an organization, it addresses the constraints on behavior of its members as well as constraints imposed on adversaries by mechanisms such as doors, locks, keys
..... Click the link for more information.
IT asset management (ITAM) is the set of business practices that join financial, contractual and inventory functions to support life cycle management and strategic decision making for the IT environment.
..... Click the link for more information.
Physical security describes measures that prevent or deter attackers from accessing a facility, resource, or information stored on physical media. It can be as simple as a locked door or as elaborate as multiple layers of armed guardposts.
..... Click the link for more information.
access control refers to the practice of restricting entrance to a property, a building, or a room to authorized persons. Physical access control can be achieved by a human (a guard, bouncer, or receptionist), through mechanical means such as locks and keys, or through
..... Click the link for more information.
This article or section is in need of attention from an expert on the subject.
Please help recruit one or [ improve this article] yourself. See the talk page for details.
..... Click the link for more information.
Business Continuity Planning (BCP) is an interdisciplinary peer mentoring methodology used to create and validate a practiced logistical plan for how an organization will recover and restore partially or completely interrupted critical function(s) within a predetermined
..... Click the link for more information.
Security controls are safeguards or countermeasures to avoid, counteract or minimize security risks.

To help review or design security controls, they can be classified by several criteria, for example according to the time that they act, relative to a security incident:

    ..... Click the link for more information.
    BS 7799 Part 1 was a standard originally published as BS 7799 by the British Standards Institute (BSI) in 1995. It was written by the United Kingdom Government's Department of Trade and Industry (DTI), and after several revisions, was eventually adopted by ISO as ISO/IEC 17799,
    ..... Click the link for more information.
    ISO/IEC 27000 is the number reserved for a new international standard, which currently has the provisional title: "Information technology - Security techniques - Information security management systems - Overview and vocabulary".
    ..... Click the link for more information.
    Stage 1 is a "table top" review of the existence and completeness of key documentation such as the organization's Security Policy, Statement of Applicability (SoA) and Risk Treatment Plan (RTP).
    ..... Click the link for more information.
    ISO/IEC 27003 is an information security standard being currently developped by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC). Its current title is Information Technology - Security techniques.
    ..... Click the link for more information.
    ISO/IEC 27004 is an information security standard being currently developped by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC).
    ..... Click the link for more information.
    ISO/IEC 27005 is an information security standard being currently developped by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC).
    ..... Click the link for more information.
    BS 7799 Part 1 was a standard originally published as BS 7799 by the British Standards Institute (BSI) in 1995. It was written by the United Kingdom Government's Department of Trade and Industry (DTI), and after several revisions, was eventually adopted by ISO as ISO/IEC 17799,
    ..... Click the link for more information.
    ISO/IEC 27006 is an information security standard published by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC).
    ..... Click the link for more information.
    ISO/IEC 27007 is an information security standard being currently developped by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC).
    ..... Click the link for more information.
    ISO/IEC 27799 is an information security standard being currently developped by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC).
    ..... Click the link for more information.
    Stage 1 is a "table top" review of the existence and completeness of key documentation such as the organization's Security Policy, Statement of Applicability (SoA) and Risk Treatment Plan (RTP).
    ..... Click the link for more information.


    This article is copied from an article on Wikipedia.org - the free encyclopedia created and edited by online user community. The text was not checked or edited by anyone on our staff. Although the vast majority of the wikipedia encyclopedia articles provide accurate and timely information please do not assume the accuracy of any particular article. This article is distributed under the terms of GNU Free Documentation License.
    Herod_Archelaus


    page counter