ISO/IEC 27001:2005
ISO/IEC 27001:2005
Information technology -- Security techniques -- Information security management systems -- Requirements
ISO/IEC 27001, part of the growing ISO/IEC 27000 family of standards, is an information security management system (ISMS) standard published in October 2005 by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC). Its full name is ISO/IEC 27001:2005 – Information technology – Security techniques – Information security management systems – Requirements.
ISO/IEC 27001 formally specifies a management system that is intended to bring information security under explicit management control. Being a formal specification means that it mandates specific requirements. Organizations that claim to have adopted ISO/IEC 27001 can therefore be formally audited and certified compliant with the standard (more below).
How the Standard works
Most organizations have a number of information security controls. However, without an information security management system (ISMS), controls tend to be somewhat disorganized and disjointed, having been implemented often as point solutions to specific situations or simply as a matter of convention. Security controls in operation typically address certain aspects of IT or data security specifically; leaving non-IT information assets (such as paperwork and proprietary knowledge) less protected on the whole. Moreover, business continuity planning and physical security may be managed quite independently of IT or information security while Human Resources practices may make little reference to the need to define and assign information security roles and responsibilities throughout the organization.
ISO/IEC 27001 requires that management:
. Systematically examine the organization's information security risks, taking account of the threats, vulnerabilities, and impacts;
. Design and implement a coherent and comprehensive suite of information security controls and/or other forms of risk treatment (such as risk avoidance or risk transfer) to address those risks that are deemed unacceptable; and
. Adopt an overarching management process to ensure that the information security controls continue to meet the organization's information security needs on an ongoing basis.
The key benefits of ISO/IEC 27001 are:
. It can act as the extension of the current quality system to include security
. It provides an opportunity to identify and manage risks to key information and systems assets
. Provides confidence and assurance to trading partners and clients; acts as a marketing tool
. Allows an independent review and assurance to you on information security practices
A company may want to adopt ISO 27001 for the following reasons:
. It is suitable for protecting critical and sensitive information
. It provides a holistic, risked-based approach to secure information and compliance
. Demonstrates credibility, trust, satisfaction and confidence with stakeholders, partners, citizens and customers
. Demonstrates security status according to internationally accepted criteria
. Creates a market differentiation due to prestige, image and external goodwill
. If a company is certified once, it is accepted globally.
