"ISO27k" refers to the ISO/IEC 27000 series standards, a set of 100 good practice guidelines for managing the risks affecting or involving business, commercial, national and personal information.

 

"ISO/IEC" denotes the bodies that jointly developed and maintain the standards:

• ISO is the Geneva-based International Organization for Standardisation, a non-governmental federation of representatives from national standards bodies across the world - more info;

• IEC is the International Electrotechnical Commission, another Swiss-based non-governmental global body responsible for standardising various technologies - more info.

​​​​

Effective risk management serves to protect valuable information against harm whilst also permitting its use for legitimate purposes. Both aspects are important.  Although in theory we might lock the information away forever, permanently blocking access by everyone, its value would decay to zero given such an excessive level of security.

​​​​​

The ISO standards lay out guidance in the form of generic ‘management systems’ that are flexible enough to be adapted for any organisation's unique situation, and various topics. You may already be familiar with ISO 9001 (for quality) or ISO 14001 (for environmental management).  

​​​

Management systems are specified in ISO/IEC 27001 (for information security) and ISO/IEC 27701 (for privacy).  These structures support a systematic approach to:

• Identify risks of concern, analyse and evaluate them;

• Treat (avoid, share, mitigate or accept) the risks appropriately;

• Ensure the risk treatments are working properly in practice (assurance); and

• Handle changes and drive continual improvement (maturity).

​​

Other ISO27k standards expand on various aspects in more detail: ISO/IEC 27005, for instance, elaborates on the information risk management process, while ISO/IEC 27004 offers advice on security metrics.

 

​

Certified conformity to ISO/IEC 27001 and ISO/IEC 27701 demonstrates that an organisation is serious about managing information security and privacy.

In short, ISO27k is about systematically protecting and legitimately exploiting valuable information for sound business reasons.​

 

The ISO27k standards are listed below: click to open any one for further details.