| Revision as of 12:27, 25 February 2023 editAdolorin (talk | contribs)15 editsm Restructured the content fo the second and depricated edition ISO/IEC 27001:2013← Previous edit | Revision as of 14:48, 2 March 2023 edit undo212.247.65.246 (talk) →Depricated Editions: typoNext edit → | ||
| Line 199: | Line 199: | ||
| Clause 6.1.3 (Information security risk treatment) describes how an organization can respond to risks with a risk treatment plan; an important part of this is choosing appropriate controls. Organizations can design controls as required, or identify them from any source; the security controls listed are not exhaustive as additional controls may be included if needed. Nevertheless, the risk treatment process needs to compare the controls with those in Annex A and verify that no necessary information security controls are overlooked. | Clause 6.1.3 (Information security risk treatment) describes how an organization can respond to risks with a risk treatment plan; an important part of this is choosing appropriate controls. Organizations can design controls as required, or identify them from any source; the security controls listed are not exhaustive as additional controls may be included if needed. Nevertheless, the risk treatment process needs to compare the controls with those in Annex A and verify that no necessary information security controls are overlooked. | ||
| == |
== Deprecated Editions== | ||
| === ISO/IEC 27001:2013 === | === ISO/IEC 27001:2013 === | ||
Revision as of 14:48, 2 March 2023
Information security standard | This article needs additional citations for verification. Please help improve this article by adding citations to reliable sources. Unsourced material may be challenged and removed. Find sources: "ISO/IEC 27001" – news · newspapers · books · scholar · JSTOR (April 2014) (Learn how and when to remove this message) |
ISO/IEC 27001 is an international standard to manage information security. The standard was originally published jointly by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) in 2005, revised in 2013, and again most recently in 2022. There are also numerous recognized national variants of the standard. It details requirements for establishing, implementing, maintaining and continually improving an information security management system (ISMS) – the aim of which is to help organizations make the information assets they hold more secure. Organizations that meet the standard's requirements can choose to be certified by an accredited certification body following successful completion of an audit. The effectiveness of the ISO/IEC 27001 certification process and the overall standard has been addressed in a large-scale study conducted in 2020.
How the standard works
Most organizations have a number of information security controls. However, without an information security management system (ISMS), controls tend to be somewhat disorganized and disjointed, having been implemented often as point solutions to specific situations or simply as a matter of convention. Security controls in operation typically address certain aspects of information technology (IT) or data security specifically; leaving non-IT information assets (such as paperwork and proprietary knowledge) less protected on the whole. Moreover, business continuity planning and physical security may be managed quite independently of IT or information security while Human Resources practices may make little reference to the need to define and assign information security roles and responsibilities throughout the organization.
ISO/IEC 27001 requires that management:
- Systematically examine the organization's information security risks, taking account of the threats, vulnerabilities, and impacts;
- Design and implement a coherent and comprehensive suite of information security controls and/or other forms of risk treatment (such as risk avoidance or risk transfer) to address those risks that are deemed unacceptable; and
- Adopt an overarching management process to ensure that the information security controls continue to meet the organization's information security needs on an ongoing basis.
What controls will be tested as part of certification to ISO/IEC 27001 is dependent on the certification auditor. This can include any controls that the organisation has deemed to be within the scope of the ISMS and this testing can be to any depth or extent as assessed by the auditor as needed to test that the control has been implemented and is operating effectively.
Management determines the scope of the ISMS for certification purposes and may limit it to, say, a single business unit or location. The ISO/IEC 27001 certificate does not necessarily mean the remainder of the organization, outside the scoped area, has an adequate approach to information security management.
Other standards in the ISO/IEC 27000 family of standards provide additional guidance on certain aspects of designing, implementing and operating an ISMS, for example on information security risk management (ISO/IEC 27005).
History of ISO/IEC 27001
BS 7799 was a standard originally published by BSI Group in 1995. It was written by the UK government's Department of Trade and Industry (DTI) and consisted of several parts.
The first part, containing the best practices for information security management, was revised in 1998; after a lengthy discussion in the worldwide standards bodies, it was eventually adopted by ISO as ISO/IEC 17799, "Information Technology - Code of practice for information security management." in 2000. ISO/IEC 17799 was then revised in June 2005 and finally incorporated in the ISO 27000 series of standards as ISO/IEC 27002 in July 2007.
The second part of BS7799 was first published by BSI in 1999, known as BS 7799 Part 2, titled "Information Security Management Systems - Specification with guidance for use." BS 7799-2 focused on how to implement an Information security management system (ISMS), referring to the information security management structure and controls identified in BS 7799-2. This later became ISO/IEC 27001:2005. BS 7799 Part 2 was adopted by ISO as ISO/IEC 27001 in November 2005.
BS 7799 Part 3 was published in 2005, covering risk analysis and management. It aligns with ISO/IEC 27001:2005.
Very little reference or use is made to any of the BS standards in connection with ISO/IEC 27001.
Certification
An ISMS may be certified compliant with the ISO/IEC 27001 standard by a number of Accredited Registrars worldwide. Certification against any of the recognized national variants of ISO/IEC 27001 (e.g. JIS Q 27001, the Japanese version) by an accredited certification body is functionally equivalent to certification against ISO/IEC 27001 itself.
In some countries, the bodies that verify conformity of management systems to specified standards are called "certification bodies", while in others they are commonly referred to as "registration bodies", "assessment and registration bodies", "certification/ registration bodies", and sometimes "registrars".
The ISO/IEC 27001 certification, like other ISO management system certifications, usually involves a three-stage external audit process defined by ISO/IEC 17021 and ISO/IEC 27006 standards:
- Stage 1 is a preliminary, informal review of the ISMS. For example there are checks for the existence and completeness of key documentation, such as the organization's information security policy, Statement of Applicability (SoA), and Risk Treatment Plan (RTP). This stage serves to familiarize the auditors with the organization and vice versa.
- Stage 2 is a more detailed and formal compliance audit, independently testing the ISMS against the requirements specified in ISO/IEC 27001. The auditors will seek evidence to confirm that the management system has been properly designed and implemented, and is in fact in operation (for example by confirming that a security committee or similar management body meets regularly to oversee the ISMS). Certification audits are usually conducted by ISO/IEC 27001 Lead Auditors. Passing this stage results in the ISMS being certified compliant with ISO/IEC 27001.
- Ongoing involves follow-up reviews or audits to confirm that the organization remains in compliance with the standard. Certification maintenance requires periodic re-assessment audits to confirm that the ISMS continues to operate as specified and intended. These should happen at least annually but (by agreement with management) are often conducted more frequently, particularly while the ISMS is still maturing.
Structure of the standard (ISO/IEC 27001:2022)
The official title of the standard is "Information security, cybersecurity and privacy protection - Information security management systems - Requirements"
ISO/IEC 27001:2022 has ten short clauses, plus a longer annex:
- Foreword
- Introduction
- 1 Scope
- 2 Normative references
- 3 Terms and definitions
- 4 Context of the organization
- 4.1 Understanding the organization and its context
- 4.2 Understanding the needs and expectations of interested parties
- 4.3 Determining the scope of the information security management system
- 4.4 Information security management system
- 5 Leadership
- 5.1 Leadership and commitment
- 5.2 Policy
- 5.3 Organizational roles, responsibilities and authorities
- 6 Planning
- 6.1 Actions to address risks and opportunities
- 6.1.1 General
- 6.1.2 Information security risk assessment
- 6.1.3 Information security risk treatment
- 6.2 Information security objectives and planning to achieve them
- 6.3 Planning of changes
- 6.1 Actions to address risks and opportunities
- 7 Support
- 7.1 Resources
- 7.2 Competence
- 7.3 Awareness
- 7.4 Communication
- 7.5 Documented information
- 7.5.1 General
- 7.5.2 Creating and updating
- 7.5.3 Control of documented information
- 8 Operation
- 8.1 Operational planning and control
- 8.2 Information security risk assessment
- 8.3 Information security risk treatment
- 9 Performance evaluation
- 9.1 Monitoring, measurement, analysis and evaluation
- 9.2 Internal audit
- 9.2.1 General
- 9.2.2 Internal audit programme
- 9.3 Management review
- 9.3.1 General
- 9.3.2 Management review inputs
- 9.3.3 Management review results
- 10 Improvement
- 10.1 Continual improvement
- 10.2 Nonconformity and corrective action
- Annex A (normative) Information security controls reference
- Bibliography
This structure mirrors other management standards such as ISO 22301 (business continuity management) and this helps organizations comply with multiple management systems standards if they wish.
Information Security Controls (ISO/IEC 27001:2022)
Annex A lists information security controls. The numbering (starting with 5) references ISO/IEC 27002:2022 which details and explains those security controls.
- 5: Organizational controls
- 5.1: Policies for information security
- 5.2: Information security roles and responsibilities
- 5.3: Segregation of duties
- 5.4: Management responsibilities
- 5.5: Contact with authorities
- 5.6: Contact with special interest groups
- 5.7: Threat intelligence
- 5.8: Information security in project management
- 5.9: Inventory of information and other associated assets
- 5.10: Acceptable use of information and other associated assets
- 5.11: Return of assets
- 5.12: Classification of information
- 5.13: Labelling of information
- 5.14: Information transfer
- 5.15: Access control
- 5.16: Identity management
- 5.17: Authentication information
- 5.18: Access rights
- 5.19: Information security in supplier relationships
- 5.20: Addressing information security within supplier agreements
- 5.21: Managing information security in the information and communication technology (ICT) supply chain
- 5.22: Monitoring, review and change management of supplier services
- 5.23: Information security for use of cloud services
- 5.24: Information security incident management planning and preparation
- 5.25: Assessment and decision on information security events
- 5.26: Response to information security incidents
- 5.27: Learning from information security incidents
- 5.28: Collection of evidence
- 5.29: Information security during disruption
- 5.30: ICT readiness for business continuity
- 5.31: Legal, statutory, regulatory and contractual requirements
- 5.32: Intellectual property rights
- 5.33: Protection of records
- 5.34: Privacy and protection of personal identifiable information (PII)
- 5.35: Independent review of information security
- 5.36: Compliance with policies, rules and standards for information
- 5.37: Documented operating procedures
- 6: People controls
- 6.1: Screening
- 6.2: Terms and conditions of employment
- 6.3: Information security awareness education and training
- 6.4: Disciplinary process
- 6.5: Responsibilities after termination
- 6.6: Confidentiality or non-disclosure agreements
- 6.7: Remote working
- 6.8: Information security event reporting
- 7: Physical controls
- 7.1: Physical security perimeters
- 7.2: Physical entry
- 7.3: Securing offices, rooms and facilities
- 7.4: Physical security monitoring
- 7.5: Protecting against physical and environmental threats
- 7.6: Working in secure areas
- 7.7: Clear desk and clear screen
- 7.8: Equipment siting and protection
- 7.9: Security of assets off-premises
- 7.10: Storage media
- 7.11: Supporting utilities
- 7.12: Cabling security
- 7.13: Equipment maintenance
- 7.14: Secure disposal or re-use of equipment
- 8: Technological controls
- 8.1: User end point devices
- 8.2: Privileged access rights
- 8.3: Information access restriction
- 8.4: Access to source code
- 8.5: Secure authentication
- 8.6: Capacity management
- 8.7: Protection against malware
- 8.8: Management of technical vulnerabilities
- 8:9: Configuration management
- 8.10: Information deletion
- 8.11: Data masking
- 8.12: Data leakage prevention
- 8.13: Information backup
- 8.14: Redundancy of information processing facilities
- 8:15: Logging
- 8.16: Monitoring activities
- 8.17: Clock synchronization
- 8.18: Use of privileged utility programs
- 8.19: Installation of software on operational systems
- 8.20: Networks security
- 8.21: Security of network services
- 8.22: Segregation of networks
- 8.23: Web filtering
- 8.24: Use of cryptography
- 8.25: Secure development life cycle
- 8.26: Application security requirements
- 8.27: Secure system architecture and engineering principles
- 8.28: Secure coding
- 8.29: Security testing in development and acceptance
- 8.30: Outsourced development
- 8.31: Separation of development, test and production environments
- 8.32: Change management
- 8.33: Test information
- 8.20: Protection of information systems during audit testing
Clause 6.1.3 (Information security risk treatment) describes how an organization can respond to risks with a risk treatment plan; an important part of this is choosing appropriate controls. Organizations can design controls as required, or identify them from any source; the security controls listed are not exhaustive as additional controls may be included if needed. Nevertheless, the risk treatment process needs to compare the controls with those in Annex A and verify that no necessary information security controls are overlooked.
Deprecated Editions
ISO/IEC 27001:2013
The official title of the standard is "Information technology — Security techniques — Information security management systems — Requirements"
ISO/IEC 27001:2013 has ten short clauses, plus a long annex, which cover:
- 1. Scope of the standard
- 2. How the document is referenced
- 3. Reuse of the terms and definitions in ISO/IEC 27000
- 4. Organizational context and stakeholders
- 5. Information security leadership and high-level support for policy
- 6. Planning an information security management system; risk assessment; risk treatment
- 7. Supporting an information security management system
- 8. Making an information security management system operational
- 9. Reviewing the system's performance
- 10. Corrective action
- Annex A: List of controls and their objectives
This structure mirrors other management standards such as ISO 22301 (business continuity management) and this helps organizations comply with multiple management systems standards if they wish. Annexes B and C of 27001:2005 have been removed.
Clause 6.1.3 describes how an organization can respond to risks with a risk treatment plan; an important part of this is choosing appropriate controls. A very important change in ISO/IEC 27001:2013 is that there is now no requirement to use the Annex A controls to manage the information security risks. The previous version insisted ("shall") that controls identified in the risk assessment to manage the risks must have been selected from Annex A. Thus almost every risk assessment ever completed under the old version of ISO/IEC 27001 used Annex A controls but an increasing number of risk assessments in the new version do not use Annex A as the control set. This enables the risk assessment to be simpler and much more meaningful to the organization and helps considerably with establishing a proper sense of ownership of both the risks and controls. This is the main reason for this change in the new version.
There are 114 controls in 14 groups and 35 control categories:
- A.5: Information security policies (2 controls)
- A.6: Organization of information security (7 controls)
- A.7: Human resource security - 6 controls that are applied before, during, or after employment
- A.8: Asset management (10 controls)
- A.9: Access control (14 controls)
- A.10: Cryptography (2 controls)
- A.11: Physical and environmental security (15 controls)
- A.12: Operations security (14 controls)
- A.13: Communications security (7 controls)
- A.14: System acquisition, development and maintenance (13 controls)
- A.15: Supplier relationships (5 controls)
- A.16: Information security incident management (7 controls)
- A.17: Information security aspects of business continuity management (4 controls)
- A.18: Compliance; with internal requirements, such as policies, and with external requirements, such as laws (8 controls)
The controls reflect changes to technology affecting many organizations—for instance, cloud computing—but as stated above it is possible to use and be certified to ISO/IEC 27001:2013 and not use any of these controls.
See also
- ISO/IEC JTC 1/SC 27 - IT Security techniques
- ISO/IEC 27000-series
- ISO 9001
- BS 7799
- Cybersecurity standards
- NIST Cybersecurity Framework
- International Organization for Standardization
- List of ISO standards
References
- "ISO/IEC 27001 International Information Security Standard published". bsigroup.com. BSI. Retrieved 21 August 2020.
- Bird, Katie. "NEW VERSION OF ISO/IEC 27001 TO BETTER TACKLE IT SECURITY RISKS". iso.org. ISO. Retrieved 21 August 2020.
- ISO/IEC. "ISO/IEC 27001:2022". ISO.org. Retrieved 29 November 2022.
- "ISO/IEC 27001:2013". ISO. ISO. Retrieved 9 July 2020.
- Akinyemi, Iretioluwa; Schatz, Daniel; Bashroush, Rabih (2020). "SWOT analysis of information security management system ISO 27001". International Journal of Services Operations and Informatics. 10 (4): 305. doi:10.1504/ijsoi.2020.111297. ISSN 1741-539X.
- "Facts and figures". bsigroup.com.
- Ferreira, Lindemberg Naffah; da Silva Constante, Silvana Maria; de Moraes Zebral, Alessandro Marcio; Braga, Rogerio Zupo; Alvarenga, Helenice; Ferreira, Soraya Naffah (October 2013). "ISO 27001 certification process of Electronic Invoice in the State of Minas Gerais". 2013 47th International Carnahan Conference on Security Technology (ICCST). Medellin: IEEE: 1–4. doi:10.1109/CCST.2013.6922072. ISBN 978-1-4799-0889-9. S2CID 17485185.
- ISO/IEC 17021.
- ISO/IEC 27006.
- ISO/IEC. "ISO/IEC 27001:2022". ISO.org. Retrieved 29 November 2022.
- ISO/IEC 27001:2022, International Organization for Standardization.
External links
