ISO/IEC 27001

Last updated

ISO/IEC 27001 is an international standard to manage information security. The standard was originally published jointly by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) in 2005, [1] revised in 2013, [2] and again most recently in 2022. [3] There are also numerous recognized national variants of the standard. It details requirements for establishing, implementing, maintaining and continually improving an information security management system (ISMS) – the aim of which is to help organizations make the information assets they hold more secure. [4] Organizations that meet the standard's requirements can choose to be certified by an accredited certification body following successful completion of an audit. A SWOT analysis of the ISO/IEC 27001 certification process was conducted in 2020. [5]

Contents

How the standard works

Most organizations have a number of information security controls. However, without an information security management system (ISMS), controls tend to be somewhat disorganized and disjointed, having been implemented often as point solutions to specific situations or simply as a matter of convention. Security controls in operation typically address certain aspects of information technology (IT) or data security specifically; leaving non-IT information assets (such as paperwork and proprietary knowledge) less protected on the whole. Moreover, business continuity planning and physical security may be managed quite independently of IT or information security while Human Resources practices may make little reference to the need to define and assign information security roles and responsibilities throughout the organization.

ISO/IEC 27001 requires that management:

What controls will be tested as part of certification to ISO/IEC 27001 is dependent on the certification auditor. This can include any controls that the organisation has deemed to be within the scope of the ISMS and this testing can be to any depth or extent as assessed by the auditor as needed to test that the control has been implemented and is operating effectively.

Management determines the scope of the ISMS for certification purposes and may limit it to, say, a single business unit or location. The ISO/IEC 27001 certificate does not necessarily mean the remainder of the organization, outside the scoped area, has an adequate approach to information security management.

Other standards in the ISO/IEC 27000 family of standards provide additional guidance on certain aspects of designing, implementing and operating an ISMS, for example on information security risk management (ISO/IEC 27005).

History of ISO/IEC 27001

BS 7799 was a standard originally published by BSI Group [6] in 1995. It was written by the UK government's Department of Trade and Industry (DTI) and consisted of several parts.

The first part, containing the best practices for information security management, was revised in 1998; after a lengthy discussion in the worldwide standards bodies, it was eventually adopted by ISO as ISO/IEC 17799, "Information Technology - Code of practice for information security management." in 2000. ISO/IEC 17799 was then revised in June 2005 and finally incorporated in the ISO 27000 series of standards as ISO/IEC 27002 in July 2007.

The second part of BS7799 was first published by BSI in 1999, known as BS 7799 Part 2, titled "Information Security Management Systems - Specification with guidance for use." BS 7799-2 focused on how to implement an Information security management system (ISMS), referring to the information security management structure and controls identified in BS 7799-2. This later became ISO/IEC 27001:2005. BS 7799 Part 2 was adopted by ISO as ISO/IEC 27001 in November 2005.

BS 7799 Part 3 was published in 2005, covering risk analysis and management. It aligns with ISO/IEC 27001:2005.

Very little reference or use is made to any of the BS standards in connection with ISO/IEC 27001.

Key Principles of ISO/IEC 27001

The foundation of ISO/IEC 27001 is based on several key principles:

ISO/IEC 27001 emphasizes the importance of identifying and assessing information security risks. Organizations are required to implement risk management processes to identify potential threats, evaluate their impact, and develop appropriate mitigation strategies.

The latest revision of the standard ISO/IEC 27001:2022 outlines a comprehensive set of security controls in Annex A, categorized into 4 domains. These controls address various aspects of information security, such as access control, cryptography, physical security, and incident management.

ISO/IEC 27001 promotes a culture of continual improvement in information security practices. Regular monitoring, performance evaluation, and periodic reviews help organizations adapt to evolving threats and enhance their ISMS effectiveness.

ISO/IEC 27001 Certification Process

Obtaining ISO/IEC 27001 certification involves a series of well-defined steps:

Scoping: Organizations determine the scope of their ISMS, defining the boundaries and assets to be covered.

Risk Assessment: A risk assessment is conducted to identify and evaluate information security risks, ensuring that appropriate controls are implemented to manage these risks effectively.

Gap Analysis: A gap analysis compares the organization's existing information security practices against the requirements of ISO/IEC 27001 to identify areas for improvement.

ISMS Development: Based on the results of the risk assessment and gap analysis, the organization develops and implements its ISMS, incorporating the necessary security controls.

Internal Audits: Internal audits are conducted to assess the effectiveness and compliance of the implemented ISMS with the ISO/IEC 27001 standard.

Certification Audit: The organization undergoes an independent certification audit by an accredited certification body to assess its ISMS compliance with ISO/IEC 27001.

Certification Decision: If the audit demonstrates compliance, the organization is awarded the ISO/IEC 27001 certification.

Benefits of Becoming ISO/IEC 27001 Certified

Achieving ISO/IEC 27001 certification offers numerous benefits to organizations, including:

Enhanced Information Security Posture: ISO/IEC 27001 certification demonstrates a commitment to robust information security practices, bolstering the organization's ability to protect sensitive data and assets.

Building Trust with Customers and Stakeholders: Certification instils confidence in customers, partners, and stakeholders, assuring them that their information is handled with utmost care and security.

Meeting Regulatory and Legal Requirements: ISO/IEC 27001 certification aids in compliance with various data protection and privacy regulations, such as the General Data Protection Regulation (GDPR) in the European Union.

Competitive Advantage: Organizations with ISO/IEC 27001 certification gain a competitive edge over rivals, especially when participating in tenders or bidding for projects that require stringent security measures.

Risk Mitigation: By implementing a risk-based approach to information security, organizations can proactively identify and mitigate potential threats, reducing the likelihood of security incidents.

Incident Response Preparedness: The standard's incident management controls ensure that organizations are well-prepared to handle security incidents promptly and efficiently, minimizing their impact.

ISO/IEC 27001 and Data Privacy

ISO/IEC 27001 complements data protection regulations, such as the GDPR. While ISO/IEC 27001 focuses on information security management, the GDPR primarily addresses data protection and privacy. The implementation of both frameworks enables organizations to address security and privacy concerns comprehensively.

Continuous Improvement and Maintenance

Obtaining ISO/IEC 27001 certification is not a one-time accomplishment; rather, it requires continuous improvement and maintenance. Organizations must periodically review and update their ISMS to adapt to changing risks, technology, and regulatory requirements. Regular internal audits and management reviews are essential to ensure the effectiveness and relevance of the ISMS.

Certification

An ISMS may be certified compliant with the ISO/IEC 27001 standard by a number of Accredited Registrars worldwide. [7] Certification against any of the recognized national variants of ISO/IEC 27001 (e.g. JIS Q 27001, the Japanese version) by an accredited certification body is functionally equivalent to certification against ISO/IEC 27001 itself.

In some countries, the bodies that verify conformity of management systems to specified standards are called "certification bodies", while in others they are commonly referred to as "registration bodies", "assessment and registration bodies", "certification/ registration bodies", and sometimes "registrars".

The ISO/IEC 27001 certification, like other ISO management system certifications, usually involves a three-stage external audit process defined by ISO/IEC 17021 [8] and ISO/IEC 27006 [9] standards:

See also

Related Research Articles

BS 7799 was a British standard "Code of Practice for Information Security Management", first published as such by the British Standards Institution (BSI) in February 1995. Read about the origins of BS 7799 here.

ISO/IEC 20000 is the international standard for IT service management. It was developed in 2005 by ISO/IEC JTC1/SC7 and revised in 2011 and 2018. It was originally based on the earlier BS 15000 that was developed by BSI Group.

Information security standards or cyber security standards are techniques generally outlined in published materials that attempt to protect the cyber environment of a user or organization. This environment includes users themselves, networks, devices, all software, processes, information in storage or transit, applications, services, and systems that can be connected directly or indirectly to networks.

<span class="mw-page-title-main">Standard of Good Practice for Information Security</span>

The Standard of Good Practice for Information Security (SOGP), published by the Information Security Forum (ISF), is a business-focused, practical and comprehensive guide to identifying and managing information security risks in organizations and their supply chains.

<span class="mw-page-title-main">BSI Group</span> National standards body of the UK

The British Standards Institution (BSI) is the national standards body of the United Kingdom. BSI produces technical standards on a wide range of products and services and also supplies certification and standards-related services to businesses.

Information security management (ISM) defines and manages controls that an organization needs to implement to ensure that it is sensibly protecting the confidentiality, availability, and integrity of assets from threats and vulnerabilities. The core of ISM includes information risk management, a process that involves the assessment of the risks an organization must deal with in the management and protection of assets, as well as the dissemination of the risks to all appropriate stakeholders. This requires proper asset identification and valuation steps, including evaluating the value of confidentiality, integrity, availability, and replacement of assets. As part of information security management, an organization may implement an information security management system and other best practices found in the ISO/IEC 27001, ISO/IEC 27002, and ISO/IEC 27035 standards on information security.

ISO/IEC 27002 is an information security standard published by the International Organization for Standardization (ISO) and by the International Electrotechnical Commission (IEC), titled Information security, cybersecurity and privacy protection — Information security controls.

The ISO/IEC 27000-series comprises information security standards published jointly by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC).

ISO/IEC 27006 is an information security standard published by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC). Part of the ISO/IEC 27000 series of ISO/IEC Information Security Management System (ISMS) standards, it is titled Information technology - Security techniques - Requirements for bodies providing audit and certification of information security management systems.

ISO/IEC 27003 Information technology — Security techniques — Information security management systems — Guidance. It is part of a family of standards of information security management system (ISMS), which is a systematic approach to securing sensitive information, of ISO/IEC. It provides standards for a robust approach to managing information security (infosec) and building resilience. It was published on February 1, 2010, and revised in April 2017. It is currently not certifiable and is not translated into Spanish.

ISO/IEC 27004 Information Technology – Security techniques – Information Security Management – Measurement. It is part of a family of standards of information security management system (ISMS), which is a systematic approach to securing sensitive information, of ISO/IEC. It provides standards for a robust approach to managing information security (infosec) and building resilience. It was published on December 7, 2009 and revised in December 2016. It is currently not certifiable and is not translated into Spanish.

ISO/IEC 27005 "Information technology — Security techniques — Information security risk management" is an international standard published by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) providing good practice guidance on managing risks to information. It is a core part of the ISO/IEC 27000-series of standards, commonly known as ISO27k.

ISO/IEC 27007 is a standard on Information security, cybersecurity and privacy protection that provides guidance on managing an information security management system (ISMS) audit programme, on conducting audits, and on the competence of ISMS auditors, in addition to the guidance contained in ISO 19011. This standard is applicable to those needing to understand or conduct internal or external audits of an ISMS or to manage an ISMS audit programme. It was published on November 14, 2011, and revised on January 21, 2020.

Information technology risk, IT risk, IT-related risk, or cyber risk is any risk relating to information technology. While information has long been appreciated as a valuable and important asset, the rise of the knowledge economy and the Digital Revolution has led to organizations becoming increasingly dependent on information, information processing and especially IT. Various events or incidents that compromise IT in some way can therefore cause adverse impacts on the organization's business processes or mission, ranging from inconsequential to catastrophic in scale.

The ISO/IEC 27001 Lead Auditor certification consists of a professional certification for auditors specializing in information security management systems (ISMS) based on the ISO/IEC 27001 standard and ISO 19011.

The IT baseline protection approach from the German Federal Office for Information Security (BSI) is a methodology to identify and implement computer security measures in an organization. The aim is the achievement of an adequate and appropriate level of security for IT systems. To reach this goal the BSI recommends "well-proven technical, organizational, personnel, and infrastructural safeguards". Organizations and federal agencies show their systematic approach to secure their IT systems by obtaining an ISO/IEC 27001 Certificate on the basis of IT-Grundschutz.

ISO/IEC 27001 Lead Implementer is a professional certification for professionals specializing in information security management systems (ISMS) based on the ISO/IEC 27001 standard. This professional certification is intended for information security professionals wanting to understand the steps required to implement the ISO/IEC 27001 standard.

ISO/IEC 27701:2019 is a privacy extension to ISO/IEC 27001. The design goal is to enhance the existing Information Security Management System (ISMS) with additional requirements in order to establish, implement, maintain, and continually improve a Privacy Information Management System (PIMS). The standard outlines a framework for Personally Identifiable Information (PII) Controllers and PII Processors to manage privacy controls to reduce the risk to the privacy rights of individuals.

SS 584 is an information security standard, published by Singapore Standards. The standard was last revised in 2015.

ISO/IEC 27017 is a security standard developed for cloud service providers and users to make a safer cloud-based environment and reduce the risk of security problems. It was published by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) under the joint ISO and IEC subcommittee, ISO/IEC JTC 1/SC 27. It is part of the ISO/IEC 27000 family of standards, standards which provides best practice recommendations on information security management. This standard was built from ISO/IEC 27002, suggesting additional security controls for the cloud which were not completely defined in ISO/IEC 27002.

References

  1. ↑ "ISO/IEC 27001 International Information Security Standard published". bsigroup.com. BSI. Retrieved 21 August 2020.
  2. ↑ Bird, Katie (14 August 2013). "NEW VERSION OF ISO/IEC 27001 TO BETTER TACKLE IT SECURITY RISKS". ISO. Retrieved 21 August 2020.
  3. ↑ ISO/IEC. "ISO/IEC 27001:2022". ISO.org. Retrieved 29 November 2022.
  4. ↑ "ISO/IEC 27001:2013". ISO. Retrieved 9 July 2020.
  5. ↑ Akinyemi, Iretioluwa; Schatz, Daniel; Bashroush, Rabih (2020). "SWOT analysis of information security management system ISO 27001". International Journal of Services Operations and Informatics. 10 (4): 305. doi:10.1504/ijsoi.2020.111297. ISSN   1741-539X.
  6. ↑ "Facts and figures". bsigroup.com. Archived from the original on 20 October 2012. Retrieved 10 January 2018.
  7. ↑ Ferreira, Lindemberg Naffah; da Silva Constante, Silvana Maria; de Moraes Zebral, Alessandro Marcio; Braga, Rogerio Zupo; Alvarenga, Helenice; Ferreira, Soraya Naffah (October 2013). "ISO 27001 certification process of Electronic Invoice in the State of Minas Gerais". 2013 47th International Carnahan Conference on Security Technology (ICCST). Medellin: IEEE. pp. 1–4. doi:10.1109/CCST.2013.6922072. ISBN   978-1-4799-0889-9. S2CID   17485185.
  8. ↑ ISO/IEC 17021.
  9. ↑ ISO/IEC 27006.

This page is based on this Wikipedia article
Text is available under the CC BY-SA 4.0 license; additional terms may apply.
Images, videos and audio are available under their respective licenses.