Introduction to the standard
The ISO27000 ISMS family of standards is a collection of standards produced by the International Organisation for Standardisation (ISO) and the International Electrotechnical Commission (IEC). They form the best practice recommendations on developing and running an Information Security Management System (ISMS)
BS7799 was the original standard developed by the British Government’s Department for Trade and Industry (DTI) in 1995 that was later revised in to an International standard, now known as ISO27001, in 2005. This standard, as the name implies, is used through-out the world to build and manage corporate ISMS’s, some times as ISO27001 but in some countries as its equivalent standard, usually just a translation from English to their native language.
ISO27001 has been developed to allow it to easily integrate in with the organisations Quality Management System (QMS – ISO9000) and Environmental Management System (EMS – ISO 14000) and when implemented correctly, all three standards co-exist harmoniously to form a complete corporate management system.
The ISO27000 family comprises of several standards, each concentrating on specific areas that may or may not be relevant to all companies. The key standards are:
- ISO27000 – Information security management systems – Overview and vocabulary
- ISO27001 – Information security management systems – Requirements
- ISO27002 – Code of practice for information security management
There are other standards to cover implementation guidance (ISO27003), measurement and metrics (ISO27004), risk management (ISO27005) and more.
The ISO27000 family of standards is an evolving family with new standards being developed as needed and updates to previous ones as industry best practice changes in reflection to changes in the security landscape.
ISO27001 details the requirements on an ISMS, in summary it is that
“The organization shall establish, implement, operate, monitor, review, maintain and improve a documented ISMS within the context of the organization’s overall business activities and the risks it faces.”
This is accomplished via the Plan, Do, Check Act (PDCA) model:
| Plan (establish the ISMS) |
Establish ISMS policy, objectives, processes and procedures relevant to managing risk and improving information security to deliver results in accordance with an organization’s overall policies and objectives. |
| Do (implement and operate the ISMS) |
Implement and operate the ISMS policy, controls, processes and procedures. |
| Check (monitor and review the ISMS) |
Assess and, where applicable, measure process performance against ISMS policy, objectives and practical experience and report the results to management for review. |
| Act (maintain and improve the ISMS) |
Take corrective and preventive actions, based on the results of the internalISMS audit and management review or other relevant information, to achieve continual improvement of the ISMS. |
ISO27001 is what you are required to have (policy, objectives, processes and procedures), ISO27002 is a technical standard concerned with the best practices on implementing an ISMS, covering areas such as access control; physical security; incident management; business continuity etc.
ISO27002 is broken down in to 12 sections:
- Risk assessment and treatment
- Security policy - management direction
- Organization of information security - governance of information security
- Asset management – inventory and classification of information assets
- Human resources security – security aspects for employees joining, moving and leaving an organization
- Physical and environmental security – protection of the computer facilities
- Communications and operations management – management of technical security controls in systems and networks
- Access control – restriction of access rights to networks, systems, applications, functions and data
- Information systems acquisition, development and maintenance – building security into applications
- Information security incident management - anticipating and responding appropriately to information security breaches
- Business continuity management – protecting, maintaining and recovering business-critical processes and systems
- Compliance – ensuring conformance with information security policies, standards, laws and regulations
Each section will contain security controls and objectives specified. All the provided information is based on best practice and may or may not be suitable for all organisations. It is down to the implementation of the ISMS to develop the controls inline with business function and risk appetite.
Why is ISO27001 needed?
An organisation may have a number of security controls in place and documented, usually as the result of a point solution from an incident or a requirement (internal or external). The problem with this point based solution approach is that the controls tend to be disorganised and disjointed. By implementing a formal management system the entire information security system will have a management framework developed from objectives and policies through to processes and procedures – tailored to the business requirements, size and complexity. The system will bring together different functions to carry out same tasks as approved by the executive team. Regular auditing of these functions will report back to management on the compliance to corporate policy. Incidents will be managed by pre-defined process ensuring consistency. Reports from the audits and incidents will help to evolve and develop the system through to maturity, reducing risks, incidents and non-compliance.
The ISO27001 and ISO2002 family, like ISO9000, and more and more these days with ISO14000, are the de-facto standards for businesses to have and maintain. Most large organisations require at least ISO9000 accreditation if you wish to do business with them. For IT service providers, without ISO27001 accreditation, most large businesses (and even SME) will be hesitant to have you provide services as you are unable to show proper management of the security for information assets.
Although costly to implement and maintain, these standards are business drivers and risk reducers.
With more and more in the news relating to information security incidents, never before has there been more of a requirement for businesses to focus heavily on managing and protecting their digital assets.
With organisations open to heavy fines and public brand embarrassment if certain types of information are to be lost or stolen, the cost of implementing and managing an ISO27001 system, weighed against the financial and brand risk, is usually acceptable. It is also a requirement of other regulatory requirements such as PCI-DSS for handling and processing of credit cards, or the HMG SPF for providing services to UK Government.
Like ISO9000 and ISO14000, ISO27000 is a “living” system that must evolve through audits (internal and external) and changes both in the standards and the business.
Download a copy of this paper here
