ISO/IEC 27000-series | Wikipedia audio article


The ISO/IEC 27000-series (also known as the
‘ISMS Family of Standards’ or ‘ISO27K’ for short) comprises information security standards
published jointly by the International Organization for Standardization (ISO) and the International
Electrotechnical Commission (IEC).The series provides best practice recommendations on
information security management – the management of information risks through information security
controls – within the context of an overall Information security management system (ISMS),
similar in design to management systems for quality assurance (the ISO 9000 series), environmental
protection (the ISO 14000 series) and other management systems.The series is deliberately
broad in scope, covering more than just privacy, confidentiality and IT/technical/cybersecurity
issues. It is applicable to organizations of all shapes
and sizes. All organizations are encouraged to assess
their information risks, then treat them (typically using information security controls) according
to their needs, using the guidance and suggestions where relevant. Given the dynamic nature of information risk
and security, the ISMS concept incorporates continuous feedback and improvement activities
to respond to changes in the threats, vulnerabilities or impacts of incidents. The standards are the product of ISO/IEC JTC1
(Joint Technical Committee 1) SC27 (Subcommittee 27), an international body that meets in person
twice a year. The ISO/IEC standards are sold directly by
ISO, mostly in English, French and Chinese. Sales outlets associated with various national
standards bodies also sell directly translated versions in other languages.==Early history==
Many people and organisations are involved in the development and maintenance of the
ISO27K standards. The first standard in this series was ISO/IEC
17799:2000; this was a fast-tracking of the existing British standard BS 7799 part 1:1999
The initial release of BS 7799 was based, in part, on an information security policy
manual developed by the Royal Dutch/Shell Group in the late 1980s and early 1990s. In 1993, what was then the Department of Trade
and Industry (United Kingdom) convened a team to review existing practice in information
security, with the goal of producing a standards document. In 1995, the BSI Group published the first
version of BS 7799. One of the principal authors of BS 7799 recalls
that, at the beginning of 1993, “The DTI decided to quickly assemble a group of industry representatives
from seven different sectors: Shell ([David Lacey] and Les Riley), BOC Group (Neil Twist),
BT (Dennis Willets), Marks & Spencer (Steve Jones), Midland Bank (Richard Hackworth),
Nationwide (John Bowles) and Unilever (Rolf Moulton).” David Lacey credits Donn B. Parker as having
the “original idea of establishing a set of information security controls”, and with producing
a document containing a “collection of around a hundred baseline controls” by the late 1980s
for “the I-4 Information Security circle which he conceived and founded.”==Published standards==
The published ISO27K standards related to “information technology – security techniques”
are: ISO/IEC 27000 — Information security management
systems — Overview and vocabulary ISO/IEC 27001 — Information technology – Security
Techniques – Information security management systems — Requirements. The 2013 release of the standard specifies
an information security management system in the same formalized, structured and succinct
manner as other ISO standards specify other kinds of management systems. ISO/IEC 27002 — Code of practice for information
security controls – essentially a detailed catalog of information security controls that
might be managed through the ISMS ISO/IEC 27003 — Information security management
system implementation guidance ISO/IEC 27004 — Information security management
— Monitoring, measurement, analysis and evaluation
ISO/IEC 27005 — Information security risk management
ISO/IEC 27006 — Requirements for bodies providing audit and certification of information
security management systems ISO/IEC 27007 — Guidelines for information
security management systems auditing (focused on auditing the management system)
ISO/IEC TR 27008 — Guidance for auditors on ISMS controls (focused on auditing the
information security controls) ISO/IEC 27009 — Essentially an internal
document for the committee developing sector/industry-specific variants or implementation guidelines for
the ISO27K standards ISO/IEC 27010 — Information security management
for inter-sector and inter-organizational communications
ISO/IEC 27011 — Information security management guidelines for telecommunications organizations
based on ISO/IEC 27002 ISO/IEC 27013 — Guideline on the integrated
implementation of ISO/IEC 27001 and ISO/IEC 20000-1 (derived from ITIL)
ISO/IEC 27014 — Information security governance. Mahncke assessed this standard in the context
of Australian e-health. ISO/IEC TR 27015 — Information security
management guidelines for financial services – Now withdrawn
ISO/IEC TR 27016 — information security economics
ISO/IEC 27017 — Code of practice for information security controls based on ISO/IEC 27002 for
cloud services ISO/IEC 27018 — Code of practice for protection
of personally identifiable information (PII) in public clouds acting as PII processors
ISO/IEC TR 27019 — Information security for process control in the energy industry
ISO/IEC 27031 — Guidelines for information and communication technology readiness for
business continuity ISO/IEC 27032 — Guideline for cybersecurity
ISO/IEC 27033-1 — Network security – Part 1: Overview and concepts
ISO/IEC 27033-2 — Network security – Part 2: Guidelines for the design and implementation
of network security ISO/IEC 27033-3 — Network security – Part
3: Reference networking scenarios – Threats, design techniques and control issues
ISO/IEC 27033-4 — Network security – Part 4: Securing communications between networks
using security gateways ISO/IEC 27033-5 — Network security – Part
5: Securing communications across networks using Virtual Private Networks (VPNs)
ISO/IEC 27033-6 — Network security – Part 6: Securing wireless IP network access
ISO/IEC 27034-1 — Application security – Part 1: Guideline for application security
ISO/IEC 27034-2 — Application security – Part 2: Organization normative framework
ISO/IEC 27034-6 — Application security – Part 6: Case studies
ISO/IEC 27035-1 — Information security incident management – Part 1: Principles of incident
management ISO/IEC 27035-2 — Information security incident
management – Part 2: Guidelines to plan and prepare for incident response
ISO/IEC 27036-1 — Information security for supplier relationships – Part 1: Overview
and concepts ISO/IEC 27036-2 — Information security for
supplier relationships – Part 2: Requirements ISO/IEC 27036-3 — Information security for
supplier relationships – Part 3: Guidelines for information and communication technology
supply chain security ISO/IEC 27036-4 — Information security for
supplier relationships – Part 4: Guidelines for security of cloud services
ISO/IEC 27037 — Guidelines for identification, collection, acquisition and preservation of
digital evidence ISO/IEC 27038 — Specification for Digital
redaction on Digital Documents ISO/IEC 27039 — Intrusion prevention
ISO/IEC 27040 — Storage security ISO/IEC 27041 — Investigation assurance
ISO/IEC 27042 — Analyzing digital evidence ISO/IEC 27043 — Incident investigation
ISO/IEC 27050-1 — Electronic discovery – Part 1: Overview and concepts
ISO 27799 — Information security management in health using ISO/IEC 27002 – guides health
industry organizations on how to protect personal health information using ISO/IEC 27002.==In preparation==
Further ISO27K standards are in preparation covering aspects such as digital forensics
and cybersecurity, while the released ISO27K standards are routinely reviewed and updated
on a ~5 year cycle.==See also==
ISO/IEC JTC 1/SC 27 – IT Security techniques BS 7799, the original British Standard from
which ISO/IEC 17799, ISO/IEC 27002 and ISO/IEC 27001 were derived
Document management system Sarbanes–Oxley Act
Standard of Good Practice published by the Information Security Forum==References====
External links==The ISO 17799 Newsletter
Opensource software to support ISO 27000 processes

Add a Comment

Your email address will not be published. Required fields are marked *