ment,
monitor, evaluate, and
improve these types of security controls.
YOUR SECURITY REQUIREMENTS
But how and where do you start? ISO IEC suggests that you begin
by identifying your
organization’s information security needs and
requirements. They suggest
that you identify your security needs
and requirements in the following way:
- Perform a
Identify major security
vulnerabilities. Then determine how likely
it is that each threat
and vulnerability will cause a
security incident. Then evaluate the
potential impact each incident could have on your
given your overall business objectives and strategies. This will
help you to pinpoint your organization’s unique
security needs and requirements.
your legal requirements. Study all the legal, statutory,
regulatory, and contractual requirements that your organization,
and service providers must
meet. Look for all the
information security requirements
that must be met. This will help you to
identify your organization’s
unique legal information security needs and
Examine your own requirements. Examine your organization’s own
information processing principles, objectives, and requirements.
methods and practices
your organization has
developed in order to support its operations.
This will help you to identify
and refine your organization’s unique
information security needs and
YOUR SECURITY PROGRAM
Once you’ve identified your information security needs
you can begin to establish or improve your own
program. Choose from the
practices recommended by the
ISO IEC 27002 2005
standard. Select the
practices that meet your
organization's unique security needs and requirements,
ignore the ones that don't.
ISO IEC suggests that the following security practices
are a good
place to start, and therefore ought to be at the center of your
information security program:
YOUR SUCCESS FACTORS
According to ISO IEC, your organization’s information security program
more successful if you accept the following suggestions:
Make sure that your senior management
and is committed to your
information security program.
• Make sure that your
management has agreed to fund your
organization's information security
• Make sure that your approach to information
consistent with your organization’s corporate culture.
• Make sure that your information security policy, objectives,
reflect your organization’s business objectives.
• Make sure that your organization understands its own
security needs and requirements.
• Make sure that your organization understands why
management is central to
your program and why a risk
assessment should be performed.
• Make sure that your information security program
explained to all managers and employees and
they understand why it’s important.
• Make sure that you distribute information that
your information security policy and
standards to all
employees and other interested parties.
• Make sure that you provide appropriate
training, education, and awareness programs.
• Make sure that your organization establishes an effective
incident management process.
• Make sure that you encourage people to provide feedback
and to suggest ways of
improving the performance of your
information security program.
• Make sure that you
develop a balanced and comprehensive
way of measuring the performance of your
STRUCTURE OF ISO IEC 27002
Each section of the ISO IEC 27002 2005 standard has been
in the same basic way. Each section uses the
same four categories:
Control, Implementation guidance,
and Other information.
Each section begins
with one or more objectives. This is
by a discussion of the controls that should be used to achieve these
objectives. This control oriented discussion is immediately followed
implementation guidance that explains how the controls
implemented. In most cases each section
also ends with
other information that further explains what the section is
While our publications have preserved this general four
we have shortened the headings to save space. Our headings are
Goals are security objectives that should be achieved.
Controls explain how goals (objectives) can be achieved.
Guidel