urity program.
• Make sure that your
management has agreed to fund your
organization's information security
• Make sure that your approach to information
consistent with your organization’s corporate culture.
• Make sure that your information security policy, objectives,
reflect your organization’s business objectives.
• Make sure that your organization understands its own
security needs and requirements.
• Make sure that your organization understands why
management is central to
your program and why a risk
assessment should be performed.
• Make sure that your information security program
explained to all managers and employees and
they understand why it’s important.
• Make sure that you distribute information that
your information security policy and
standards to all
employees and other interested parties.
• Make sure that you provide appropriate
training, education, and awareness programs.
• Make sure that your organization establishes an effective
incident management process.
• Make sure that you encourage people to provide feedback
and to suggest ways of
improving the performance of your
information security program.
• Make sure that you
develop a balanced and comprehensive
way of measuring the performance of your
STRUCTURE OF ISO IEC 27002
Each section of the ISO IEC 27002 2005 standard has been
in the same basic way. Each section uses the
same four categories:
Control, Implementation guidance,
and Other information.
Each section begins
with one or more objectives. This is
by a discussion of the controls that should be used to achieve these
objectives. This control oriented discussion is immediately followed
implementation guidance that explains how the controls
implemented. In most cases each section
also ends with
other information that further explains what the section is
While our publications have preserved this general four
we have shortened the headings to save space. Our headings are
Goals are security objectives that should be achieved.
Controls explain how goals (objectives) can be achieved.
Guidelines explain how
controls can be implemented.
Notes add helpful hints and explanations.