ISO IEC 27002 2005 is a generic information security
standard. It can be used by any organization that
a comprehensive information security management program
its current information
security practices. According to the
ISO IEC 27002 2005
is a “code of practice for information
ISO/IEC recommends that you consider each
practices as you
establish or improve your organization’s
However, you don’t have to implement every recommended
practice. It all depends on your unique information security risks and
requirements. If a particular
practice helps you to address a serious
information security risk or to meet an important information security
requirement, then use it. If it doesn’t, ignore it.
ISO AND IEC
ISO is the
Organization for Standardization. It was set up
in 1947 and is
located in Geneva, Switzerland. Its purpose
is to develop
that support and facilitate international trade.
the International Electrotechnical Commission. It was set up in
is also located in
Geneva, Switzerland. Its purpose is to develop
for all types of electrotechnologies. Both ISO and IEC are
by national member bodies. These member bodies participate
standards development process through technical committees.
ISO IEC 17799
When the standard was officially published on
June 15, 2005, it was
known as ISO IEC 17799 2005. On July 1, 2007,
the name was formally
changed to ISO IEC 27002 2005. However, nothing
else has changed.
The content is still exactly the same. The name was
changed in order
to make it clear that ISO IEC 17799 belongs with the
ISO IEC 27000
series of information security standards.
The ISO IEC 17799 2005 standard (now known as
ISO IEC 27002 2005)
was developed by the IT
Security Subcommittee (SC 27)
of the Joint
Technical Committee on
Information Technology (ISO/IEC JTC 1).
and replaces the old ISO IEC
17799 2000 standard which
is now obsolete.
While much of the content is
the same, the new
ISO IEC 17799 2005 (27002)
standard has been entirely
reorganized, and updated in
order to address new and emerging
information security issues. In
addition, one new section has been
added on information security
incident management (section 13).
TYPES OF INFORMATION
The ISO 27002 standard is all about
information. Since information
can exist in many forms, the ISO 27002 standard takes a very broad
approach. In the context of this standard, the term information
includes at least
- Electronic files
- Software files
- Data files
- Paper documents
- Printed materials
- Hand written notes
- Video recordings
- Audio recordings
- Telephone conversations
- Cell phone conversations
- Face to face conversations
- Email messages
- Fax messages
- Video messages
- Instant messages
- Physical messages
From the standpoint of an organization, information has
is therefore an
asset. It therefore needs to be protected just like
other corporate asset. And because information must be protected, the
information must also be protected.
infrastructure includes all the
systems, and functions
that allow an
organization to manage and control its information
The big question is
how do you protect your information assets? That’s
ISO IEC 27002
standard comes in. It explains what you
can do to protect your
organization’s information assets.
But why should information assets need to be protected?
needs to be protected
because modern organizations are faced with
a wide range of security threats.
threats include everything
error and equipment failure to theft, fraud, vandalism,
sabotage, fire, flood,
and even terrorism.
And because most modern organizations operate in a
interconnected, technological world, information is also vulnerable to
an entirely new set of high-tech threats and attacks. Because of their
interconnectedness, modern organizations are also threatened by
hackers, malicious code, and denial of service attacks.
ISO 27002, information can be protected
using a wide
controls. In addition to hardware and software
controls include things like policies, procedures, processes,
organizational structures. In order to
protect their information,
organizations must develop, imple