?

ISO 27000

ISO 27000 is a family of International Standards that specify requirements for Information Security

The first standard in the series was ISO 27001. This covered covers all types of organizations (e.g. commercial enterprises, government agencies, not-for profit organizations) and specifies the requirements for:

  • establishing;
  • implementing;
  • operating;
  • monitoring;
  • reviewing;
  • maintaining;
  • improving;

a documented Information Security Management System (ISMS) within the context of an organization's overall business risks. It specifies requirements for the implementation of appropriate security controls based on the risks faced by the organisation and their likelihood of occurrence.

The current list of existing and planned standards in the ISO 2700x series is here.

Some other information security type standards that can be used to support the ISO 2700x series of standards are here.

ISO 27001 follows the Deming Cycle for continuous improvement;

ISO 27001 is intended to be suitable for several different types of use, including the following:

  • definition of new information security management processes and procedures;
  • identification, clarification and refinement of existing information security management processes and procedures;
  • implementation of business-enabling and risk driven information security;
  • use by organizations to provide relevant information about information security policies and procedures to trading partners and other organizations with whom they interact for operational or commercial reasons;
  • use by organizations to provide relevant information about information security to customers via a scope statement;
  • use by the internal and external auditors as a basis for determining the degree of compliance with the implementation of information security within an organization;
  • use within an organization as a process framework for the definition, implementation, monitoring and management of controls to ensure that the specific organisational security objectives are met;
  • use within organizations as a way to ensure that security risks are cost effectively managed;
  • use within organizations to ensure compliance with legislation and regulation;
  • use within organizations to formulate security requirements and objectives;

International Standards can be purchased from the British Standards Institutive Shop (BSi)