Information Security

The ISO 27000-family of information security management standards align with other ISO management system standards, such as ISO 9001 (quality management) and ISO 14001 (environmental management), regarding both general structure and the nature of integrating best practices with certification standards. Certification of an organization to ISO/IEC 27001 is one means of providing assurance that the organization has not only implemented a system for the management of information security in line with the international standard, but also maintains and continuously improves the system.

With increased usage of new technology to store, transmit, and retrieve information, we have exposed ourselves to increased numbers and types of threats. The overall approach to Information Security and integration of different security initiatives needs to be managed in order for each element to be most effective. An ISMS allows you to coordinate your security efforts effectively. The implementation of ISO/IEC 27001:2005 will reassure customers and suppliers that information security is taken seriously within your organization and defined processes are in place to deal with information security threats and issues.

The new standard can be used by a broad range of organizations – small, medium and large – in most of the commercial and industrial market sectors: finance and insurance, telecommunications, healthcare, utilities, retail and manufacturing sectors, various service industries, transportation sector, government and many others. ISO/IEC 27001:2005 specifies the processes to enable a business to establish, implement, review and monitor, manage and maintain effective ISMS.

ISO/IEC 27001 is intended to be used with ISO/IEC 17799, the Code of Practice for Information Security Management, which lists objectives, controls, and implementation guidelines. Organizations that implement ISMS in accordance with ISO 17799 are likely to also meet the requirements of ISO/IEC 27001. This ISO standard is the first in a family of information security related standards which are assigned numbers in the 27000 series.

They include:

§ ISO/IEC 27000 - a vocabulary or glossary of terms used in the ISO 27000-series standards

§ ISO/IEC 27002 - the proposed re-naming of existing standard ISO 17799

§ ISO/IEC 27003 - a new ISMS implementation guide

§ ISO/IEC 27004 - a new standard for information security measurement and metrics

§ ISO/IEC 27005 - a proposed standard for risk management, potentially related to the current British Standard BS 7799 part 3

§ ISO/IEC 27006 - a guide to the certification process

The ISO 27001:2005 standard effectively covers twelve sections:

§ security policy

§ organization of information security

§ asset management

§ human resources security

§ physical and environmental security

§ communications and operations

§ management

§ access control

§ information systems acquisition, development and maintenance

§ information security incident management

§ business continuity management

§ compliance

To start with, an assessment is made on how your ISMS have been implemented to identify the gap vs. the standard requirements. After gaps have been filled, the initial audit follows. From the audit, you will receive a report that outlines the key measures needed to receive positive certification. Once no major corrective action is required, you’ll obtain direct certification. Annual compliance audits will follow and the certificate will be renewed every three years as long as systems are maintained.

Steps for Implementing ISO 27001: 2005

1. Define an information security policy

2. Define scope of the information security management system

3. Perform a security risk assessment

4. Manage the identified risk

5. Select controls to be implemented and applied

6. Prepare an SOA (a "statement of applicability").

2-ISO 27001:2005 Online Application Form