ISO/IEC 17799
ISO/IEC 17799 Overview
ISO/IEC 17799 is an information security standard published and most recently revised in June 2005 by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC). It is entitled Information technology - Security techniques - Code of practice for information security management. The current standard is a revision of the version published in 2000, which was a word-for-word copy of the British Standard (BS) 7799-1:1999.
ISO/IEC 17799 provides best practice recommendations on information security management for use by those who are responsible for initiating, implementing or maintaining Information Security Management Systems (ISMS). Information security is defined within the standard in the context of the C-I-A triad:
- the preservation of confidentiality (ensuring that information is accessible only to those authorised to have access), integrity (safeguarding the accuracy and completeness of information and processing methods) and availability (ensuring that authorised users have access to information and associated assets when required).
After the introductory sections, the 2005 version of the standard contains the following twelve main sections:
- 4: Risk assessment and treatment - analysis of the organization's information security risks
- 5: Security policy - management direction
- 6: Organization of information security - governance of information security
- 7: Asset management - inventory and classification of information assets
- 8: Human resources security - security aspects for employees joining, moving and leaving an organization
- 9: Physical and environmental security - protection of the computer facilities
- 10: Communications and operations management - management of technical security controls in systems and networks
- 11: Access control - restriction of access rights to networks, systems, applications, functions and data
- 12: Information systems acquisition, development and maintenance - building security into applications
- 13: Information security incident management - anticipating and responding appropriately to information security breaches
- 14: Business continuity management - protecting, maintaining and recovering business-critical processes and systems
- 15: Compliance - ensuring conformance with information security policies, standards, laws and regulations
Within each section, information security controls and their objectives are specified and outlined. The information security controls are generally regarded as best practice means of achieving those objectives. For each of the controls, implementation guidance is provided. Specific controls are not mandated since:
- Each organization is expected to undertake a structured information security risk assessment process to determine its specific requirements before selecting controls that are appropriate to its particular circumstances. (The introduction section outlines a risk assessment process although there are more specific standards covering this area such as ISO Technical Report TR 13335 GMITS Part 3 - Guidelines for the management of IT security - Security Techniques.)
- It is practically impossible to list all conceivable controls in a general purpose standard. (Industry-specific variants of ISO 17799 or ISO 27002 are anticipated to give advice tailored to organizations in the telecomms, financial services and other industries).
ISO/IEC 17799 has directly equivalent national standards in countries such as Australia and New Zealand (AS/NZS ISO/IEC 17799:2006), the Netherlands (NEN-ISO/IEC 17799:2002 nl, 2005 version in translation), Denmark (DS484:2005), Sweden (SS 627799), Japan (JIS Q 27002), UNE 71501 (Spain), the United Kingdom (BS ISO/IEC 17799:2005) and Uruguay (UNIT/ISO 17799:2005). Translation and local publication often results in several months' delay after the main ISO/IEC standard is revised and released but the national standard bodies go to great lenths to ensure that the translated content accurately and completely reflects ISO/IEC 17799.
ISO/IEC 17799:2005 is expected to be renamed ISO/IEC 27002 in 2007, moving it into line with a growing family of ISO ISMS standards, the 'ISO 27000 series'. The others, whether already published or anticipated, are:
- ISO/IEC 27000 - a standard vocabulary for the ISMS standards (in preparation)
- ISO/IEC 27001 - the certification standard against which organizations' ISMS may be certified (published in 2005)
- ISO/IEC 27002 - the proposed new name for this standard, ISO 17799 (due to be renumbered in 2007)
- ISO/IEC 27003 - a new ISMS implementation guide (in preparation)
- ISO/IEC 27004 - a standard for information security measurement and metrics (in preparation)
- ISO/IEC 27005 - a standard for risk management, potentially related to the current British Standard BS 7799 part 3
- ISO/IEC 27006 - a guide to the certification/registration process (in preparation)
- ISO/IEC 27007 - a guideline for auditing information security management systems (in preparation)
- ISO/IEC 27799 - guidance on ISO 17799 in the healthcare industry (in preparation)
Certification
ISO/IEC 27001 (Information technology - Security techniques - Information security management systems - Requirements) specifies a number of requirements for establishing, implementing, maintaining and improving an information security management system consistent with the best practices outlined in ISO/IEC 17799. This replaced BS 7799-2:2002: Information security management systems - Specification with guidance for use. Previously, organizations could only be officially certified against the British Standard (or national equivalents) by certification/registration bodies accredited by the relevant national standards organizations. The international standard can now be used for certification.
References
- ISO/IEC 17799:2005
- ISO/IEC 27001
- ISO CD 27799: Health informatics - Security management in health using ISO 17799
External links
See also
- ISO 27001,the ISMS certification standard published in October 2005.