Information Security based on ISO 27001/ISO 27002 (eBook)

1 Introduction 12
1.1Originating body: ISO/IEC JTC1/SC 27 12
1.2ISO/IEC 27001:2005 (‘ISO 27001’ or ‘the Standard’) 12
1.3ISO/IEC 27002:2005 (‘ISO 27002’) 13
1.4Definitions 13
2 Information security 14
2.1Risks to information assets 14
2.2Information security 15
2.3Information Security Management System 15
3 Background to the Standards 16
3.1First certification 16
3.2ISO 17799:2000 16
3.3BS7799-2 17
3.4International adoption 17
3.5Translations and sector schemes 18
3.6ISO 27001:2005 18
4 Relationship between the Standards 20
4.1Why develop an international code of practice? 20
4.2Correspondence between the two Standards 21
5 Use of the Standards 22
5.1Specification compared to a Code of Practice 22
5.2The ISMS 23
5.3ISO 27001 as a model for the ISMS 23
6 Certification process and 24
6.1Certification bodies 24
6.2Standards for certification bodies 24
6.3The certification process 25
6.4The formal audit 26
6.5The audit report 26
6.6Outcome of the audit 26
7 Overview of ISO 27001 28
7.1Main clauses 28
7.2ISMS building blocks: relationship between 
 
29 
7.3General requirements 30
7.4Other content 31
8 Summary of changes from 32
8.1Greater clarity in specifications 32
9 Overview of ISO 27002:2005 34
9.1The security categories 35
9.2ISMS building blocks: relationship between the control 
35 
10 Summary of changes from ISO 27002:2000 38
10.1Clause changes 38
10.2Layout of controls 38
10.3Control changes 39
11 ISO 27000 series in future 40
11.1ISO 27001 40
11.2ISO 27002 40
11.3ISO 27003 40
11.4ISO 27004 40
11.5ISO/IEC 27005:2008 41
12 Compatibility and integration with other management systems 42
12.1ISO 27001 Annex C and integration 42
12.2The integrated management system 42
12.3ISO 9001 43
12.4BS25999 43
13 Documentation requirements and record control 44
13.1Document control requirements 44
13.2Contents of the ISMS documentation 45
13.3Record control 46
13.4Annex A document controls 46
14 Management responsibility 48
14.1Management direction 48
14.2Providing evidence of management commitment 48
14.3Management-related controls 49
14.4Requirement for management review 50
15 Process approach and the PDCA cycle 52
15.1PDCA and ISO 27001 52
15.2 PDCA applied at the tactical level 53
15.3 PDCA cycle linked to the clauses of ISO 27001 53
16 Scope definition 56
16.1The scoping exercise 56
16.2Small organizations 56
16.3 Larger organizations 57
16.4 Legal and regulatory framework 57
17 Policy definition 58
17.1 Policy and business objectives 58
17.2 Information security governance and the ISMS 59
18 Risk assessment 60
18.1 Links to other standards 60
18.2 Objectives of risk treatment plans 60
18.3 Risk assessment process 61
18.4 Assets within the scope (4.2.1.d1) 61
18.5 Asset owners 62
18.6 Threats (4.2.1.d2) 62
18.7 Vulnerabilities (4.2.1.d3) 63
18.8 Impacts (4.2.1.d4) 63
18.9 Risk assessment (4.2.1.e) 63
18.10 Likelihood 64
18.11 Calculate the risk level 64
19 Risk treatment plan 66
19.1Documenting the risk treatment plan 66
19.2 Risk treatment plan and PDCA approach 67
20 The Statement of Applicability 68
20.1 Controls and Annex A 68
20.2 Controls (4.2.1.f.1) 68
20.3 Residual risks 69
20.4 Control objectives 69
20.5 Plan for security incidents 69
21 Do - implement and operate the ISMS 72
21.1 Implementation 72
22 Check - monitor and review the ISMS 74
22.1 Monitoring 74
22.2 Auditing 74
22.3 Reviewing 75
23 Act - maintain and improve the ISMS 76
23.1 Management review 76
24 ISO 27001:2005 Annex A 78
24.1 SoA and external parties 78
24.2 Annex A clauses 78
25 Annex A control areas and controls 80
25.1 Clause A5: Security policy 80
25.2 Clause A6: Organization of information security 80
25.3 Clause A7: Asset management 81
25.4 Clause A8: Human resources security 81
25.5 Clause A9: Physical and environmental security 82
25.6 Clause A10: Communications and operations 
82 
25.7 Clause A11: Access control 84
25.8 Clause A12: Information systems acquisition, 
85 
25.9 Clause A13: Information security incident management 86
25.10 Clause A14: Business continuity management 86
25.11 Clause A15: Compliance 87
26 ISO 27001 and CobiT 88
26.1 Background to CobiT 88
26.2 CobiT framework 88
26.3 CobiT process DS5 89
26.4 Gaps and overlaps 89
27 ISO 27001, ITIL and ISO 20000 92
27.1 ITIL 92
27.2 Background to ITIL 92
27.3 BS15000/ISO 20000 93
27.4 ITIL Security Management 93
27.5 ISO 27001, ITIL and CobiT 93
Appendix A Bibliography of related standards and guides 94
Appendix B Accredited certification and other bodies 96