Search Results

Back Up Next ISO/IEC 27070 ISO/IEC 27070:2021 — Information technology — Security techniques — Requirements for establishing virtualized roots of trust (first edition) Up Abstract ISO/IEC 27070"specifies requirements for establishing virtualized roots of trust.” [Source: ISO/IEC 27070:2021] Introduction The integrity and hence value of some security functions and subsystems (particularly those relating to cryptography) relies on their being based on trustworthy foundations known as the R oot o f T rust. Special RoT security arrangements are necessary to negate threats involving low-level exploitation of data-processing chips, devices or systems, in turn compromising the higher-level firmware, device drivers, operating system and application software that build upon the RoT. Whereas trusted computing generally involves some form of H ardware S ecurity M odule (e.g. an ISO/IEC 11889 T rusted P latform M odule) providing various cryptographic functions and key storage in a physically secure tamper-resistant enclosure, that architecture is not well suited to cloud computing. In the cloud, systems are virtualised, hence they cannot readily access and rely directly upon hardware-based RoT in the conventional manner. Scope The standard specifies functional requirements and information security controls supporting the provision of trustworthy foundations for cloud computing environments, where V irtual M achines are dynamically created to provide cloud services. Structure Main clauses: 5: Functional view - describes the architecture in functional/modular terms 6: Activity view - describes how the functional modules deliver the desired level of trusted computing. Annex A: relationship between activity and functional views Status The current first edition was published in 2021 . Commentary The trust, risk and security implications of this are, frankly, above my pay grade. As my withered little old brain understands it, the standard aims to establish a rock-solid foundation on which to build the house of cards delivering cloud computing services. Regardless of all the information risks and security controls at higher levels (of which there are many), providing a sound, trustworthy platform makes RoT a fundamental security requirement. Otherwise, we’re erecting skyscrapers in the swamp. Up Up Up This page last updated: 10 July 2026

Back Up Next ISO/IEC 27555 ISO/IEC 27555:2021 — Information security, cybersecurity and privacy protection — Guidelines on personally identifiable information deletion (first edition) Up Abstract ISO/IEC 27555 "contains guidelines for developing and establishing policies and procedures for deletion of personally identifiable information (PII) in organisations by specifying: a harmonized terminology for PII deletion; an approach for defining deletion rules in an efficient way; a description of required documentation; a broad definition of roles, responsibilities and processes. ...” [Source: ISO/IEC 27555:2021] Introduction This standard gives guidance on the deletion of P ersonally I dentifiable I nformation using a systematic approach supporting ISO/IEC 29100 ’s “Privacy framework”. Scope The standard is intended for organisations that store and process PII “and other personal data”, in particular PII Controllers who are primarily accountable for compliance with privacy laws. It does not address: Specific provisions in laws and contracts (although it does reflect the general thrust of GDPR and other privacy laws and regulations based on the OECD privacy principles ); Specific deletion rules for particular types (“clusters”) of PII; Deletion mechanisms such as those for cloud storage; Security of the deletion mechanisms; nor Specific techniques for de-identification (anonymisation) of data. Standardising the approach may facilitate harmonized catalogues of PII deletion rules for industrial sectors, clarifying requirements for IT systems processing personal data. Structure Main clauses: 5: Framework for deletion 6: Clusters of PII 7: Specification of deletion periods 8: Deletion classes 9: Requirements for implementation 10: Responsibilities ~30 pages Status The current first edition was published in 2021 . It is currently being revised with publication of the second edition planned for mid-2027. Changes are mostly for readability and consistency, with minor technical updates e.g . PII clusters can include PII within or inferred from Machine Learning/AI models. Commentary The standard discusses deletion of “clusters” of PII, an intriguing yet complex concept relating to how PII is used for various business purposes. Whereas privacy standards, laws, regulations and guidelines typically focus on protecting distinct items of PII, the clustering or collation of PII items concerning individual people, drawn from various sources/systems and provided for various purposes with various constraints, potentially represents an insidious Big Brother-style threat. Up Up Up This page last updated: 10 July 2026

Back Up Next ISO/IEC 27032 ISO/IEC 27032:2023 — Cybersecurity — Guidelines for Internet security (second edition) Up Abstract ISO/IEC 27032 "provides: an explanation of the relationship between Internet security, web security, network security and cybersecurity; an overview of Internet security; identification of interested parties and a description of their roles in Internet security; high-level guidance for addressing common Internet security issues. [ISO/IEC 27032] is intended for organizations that use the Internet.” [Source: ISO/IEC 27032:2023] Introduction ISO/IEC 27032 addresses Internet security i.e. “protecting Internet-related services and related ICT systems and networks as an extension of network security”. Scope The abstract above covers the scope and purpose. The introduction notes that “[ISO/IEC 27032] does not specifically address controls that organizations can require for systems supporting critical infrastructure or national security. However, most of the controls mentioned in [ISO/IEC 27032] can be applied to such systems.” In other words it primarily concerns the ordinary everyday network security threats facing all Internet users, particularly businesses rather than the more extreme spooky threats of concern in the governmental and defence domain. Structure Main clauses: 5: Relationship between Internet security, web security, network security and cybersecurity. 6: Overview of Internet security. 7: Interested parties. 8: Internet security risk assessment and treatment. 9: Security guidelines for the Internet. Annex A: Cross-references between this standard and ISO/IEC 27002 . The annex cites a reasonable assortment of 50 controls from ISO/IEC 27002:2022 i.e.: 25 Organizational controls; 2 People controls; 0 Physical controls*; and 23 Technological controls. * It doesn't explicitly cover physical security for network cabling and equipment, nor the range and remote access concerns with wireless networking. Status The first edition was published in 2012 . The current second , thoroughly revised edition was published in 2023 . Commentary FWIW see also ISO/IEC TS 27100 . Since the term emerged in 1990, “cyber” as in “cybersecurity” has gradually become buzzword, buzzier than a hive fully of excited honeybees, and yet doubts and disagreements over what it actually means persists. SC 27 had the opportunity to clarify cyber-related terms when revising this standard but the second edition simply reproduces the definition of cybersecurity from ISO/IEC TS 27100:2020 vis “safeguarding of people, society, organizations and nations from cyber risks. Note 1 to entry: Safeguarding means to keep cyber risk at a tolerable level.” ... but fails to define "cyber" or “cyber risk”, failing yet again to clarify what it is that we are supposedly being safeguarded against. Other cyber terms defined in the first edition were simply dropped. Meanwhile, the second edition remains myopically focused on deliberate attacks perpetrated via the Internet by hackers, malware, phishers and spammers. If those are your only concerns relating to the Internet, well it appears you have led a very sheltered life ... Up Up Up This page last updated: 10 July 2026

Back Up Next ISO/IEC 27034-7 ISO/IEC 27034-7:2018 — Information technology — Security techniques — Application security — Part 7: Assurance prediction framework (first edition) Up Abstract ISO/IEC 27034 part 7 ”describes the minimum requirements when the required activities specified by an Application Security Control (ASC) are replaced with a Prediction Application Security Rationale (PASR). The ASC mapped to a PASR define the Expected Level of Trust for a subsequent application. In the context of an Expected Level of Trust, there is always an original application where the project team performed the activities of the indicated ASC to achieve an Actual Level of Trust. The use of Prediction Application Security Rationales (PASRs), defined by [ISO/IEC 27034-7], is applicable to project teams which have a defined Application Normative Framework (ANF) and an original application with an Actual Level of Trust. Predictions relative to aggregation of multiple components or the history of the developer in relation to other applications is outside the scope of [ISO/IEC 27034-7].” [Source: ISO/IEC 27034-7:2018] Introduction Part 7 specifies a framework to deliver the assurance necessary to place trust in a computer program’s security arrangements, for example: When one program (such as an application) relies on another (e.g. a database management system, utility, operating system or companion program) to perform critical security functions (such as user authentication, logical access control or cryptography), or When an organisation updates or patches a trusted program. Scope Specifies minimum requirements when the required activities specified by an A pplication S ecurity C ontrol are replaced with a P rediction A pplication S ecurity R ationale. The ASC mapped to a PASR defines the Expected Level of Trust for a subsequent application. The use of PASRs is applicable to project teams which have a defined A pplication N ormative F ramework and an original application with an Actual Level of Trust. Structure Main clauses: 5: Prediction concepts 6: Predictions 7: Substantial changes 8: Confidence 9: Prediction application security rationale 10: PASR audit 11: PASR verification 12: PASR implementation 13: Expected level of trust report Annex A: Expected level of trust assurance case Annex B: Comparison of ASC to PASR Status The current first edition of part 7 was published in 2018 and confirmed unchanged in 2023. Commentary The language in part 7 is decidedly formal and stilted (e.g. “An application security claim is a claim that the application team implemented certain security controls and those controls mitigate specific security risks to an acceptable level. A security prediction is the transfer of confidence in the original claim to a claim that the same security controls are also present in a subsequent version of the application and mitigate, to the same acceptable level, the same specific security risks.” - got that?). It falls a long way short of ISO’s guidance on plain English . Up Up Up This page last updated: 10 July 2026

Back Up Next ISO/IEC 27038 ISO/IEC 27038:2014 — Information technology — Security techniques — Specification for digital redaction (first edition) Up Abstract “ISO/IEC 27038:2014 specifies characteristics of techniques for performing digital redaction on digital documents. It also specifies requirements for software redaction tools and methods of testing that digital redaction has been securely completed. ISO/IEC 27038:2014 does not include the redaction of information from databases.” [Source: ISO/IEC 27038:2014] Introduction Digital data sometimes have to be revealed to third parties, occasionally even published to the general public, for reasons such as disclosure of official documents under Freedom of Information laws or as evidence in commercial disputes or legal cases. However, where it is deemed inappropriate to disclose certain sensitive data within the files (such as the names or locations of people or sources who must remain anonymous and various other personal or proprietary information that must remain strictly confidential), those must be securely removed from the files prior to their release. ‘Redaction’ is the conventional term for the process of denying file recipients knowledge of certain sensitive data within the original files. Given that redaction is usually relevant to the protection of highly confidential information, failures in the process that lead to inappropriate data disclosure are almost bound to be serious and in the worst cases can be grave. Redaction failures have led to incidents such as identity theft, disclosure of confidential security matters, privacy breaches and compromising the identities of undercover agents and informants, while disclosure of trade secrets could prove extremely costly in a commercial context. At the very least, redaction failures are embarrassing to those deemed responsible. Information risks associated with digital redaction include: Making bad decisions about the data to be redacted, the technical methods or process to be used and/or the suitability (primarily competency and diligence) of those tasked to do it; Failing to identify correctly all the sensitive data that must be redacted (both the individual data items and the files); Failing to render the redacted data totally unrecoverable, for example: Using inappropriate or ineffective technical methods for redaction, such as crudely modifying rather than permanently deleting the sensitive data using methods that can be completely or partially reversed (for example simply reformatting or overlaying redacted text to appear invisible, or applying readily-reversed mechanistic transformations or tokenization of textual identifiers); Accidentally leaving one or more copies of the sensitive data completely or partially unredacted (perhaps releasing multiple, independently and differently redacted versions of a sensitive document, enabling it to be reconstructed directly or by inference); Partially deleting the sensitive data, leaving data remnants or sufficient information (such as the editing journal or cached copies) enabling the data to be restored from the redacted file; Relying excessively on pixellation, blurring or similar methods of obfuscation to obscure parts of images (typically for personal privacy reasons), whereas deconvolution and other more or less advanced image manipulation/transformation techniques may restore enough of the original image to permit recognition; Neglecting to redact sensitive metadata (e.g . in document properties or reviewer comments, GPS data on digital images, or alternate data streams); Failing to distinguish all redacted from non-redacted data, consistently and accurately, such that recipients know unambiguously which parts are no longer original; Excessive or inappropriate redaction, removing more than just the specific sensitive items that were supposed to have been redacted or doing so clumsily (which raises the prospect of having to justify redaction decisions and activities to a trustworthy intermediary or authority); Inappropriately or inadvertently altering the meaning of the remaining data as a result of contextual issues (e.g. deleting selected data records may invalidate statistical analysis of the remainder), or by causing collateral damage to the file structure (such as file integrity issues and inappropriate formatting changes) during the redaction process; Leaving sufficient data in the file to enable recipients to infer sensitive information, perhaps in conjunction with other available information sources (e.g. replacing people’s names with anonymous labels in a redacted file but separately disclosing the relationship between labels and names; disclosing anonymous statistical data on known small populations; disclosing the number of characters redacted, and perhaps even giving clues to the most likely characters by dint of their printed size; applying data mining, correlation and inference techniques to glean sensitive data from redacted or anonymized content); Placing excessive reliance on redaction, believing it sufficient to keep sensitive data totally confidential under all circumstances whereas technical and process failures are possible and incidents sometimes occur in practice; conversely, placing zero reliance on redaction, believing it to be totally incapable of protecting sensitive information (these are governance and assurance risks); Information security issues that are incidental or peripheral to the redaction process itself such as: Sending the original files, redaction instructions, redacted content or indeed the redacted files to the wrong recipients; Failing to secure information relating to the redaction process, such as the original files or detailed redaction instructions, while in transit, during processing and in storage (e.g . interception of sensitive content in clear on the network); Accidentally disclosing unredacted versions of the file, whether at the same time and through the same disclosure mechanism or separately; Deliberate disclosure or ‘leakage’ of unredacted versions of the file without permission or inappropriately (e.g. to Wikileaks); Accidentally or deliberately disclosing the redacted information by some means other than by releasing the digital data (e.g. by releasing the redaction instructions, or being overheard discussing sensitive matters); Damaging the integrity and/or availability of the original unredacted files (e.g . overwriting them with the redacted versions); Use of redaction to conceal illegal or inappropriate activities; Use of AI/ML/NLP to surmise the redacted content based on linguistic principles and the surrounding context, plus broader analysis of related materials; Various other risks (the risk analysis implied here is generic and not comprehensive : it does not necessarily reflect any specific situation). [Thanks to colleagues on CISSPforum for contributing to this long list.] Scope The standard formally defines redaction as “permanent removal of information within a document” where document is formally defined as “recorded information which can be treated as a unit”. The definitions are important because, in other contexts and general use, these terms often mean other things ... and indeed later in the standard, redaction is expanded to include not just the removal of confidential content but also, if appropriate, indicating where content has been removed. The standard “specifies characteristics of techniques for performing digital redaction on digital documents [... and ...] requirements for software redaction tools and methods of testing that digital redaction has been securely completed [... but ...] does not include the redaction of information from databases.” Databases qualify as ‘units of recorded information’ but redaction of databases is specifically excluded from the scope of the standard. Even though this standard has a restricted scope, the risks it covers are significant and many of the associated controls are technically and procedurally complex. Like other ISO27k standards , it does not attempt to cover all the vagaries of the redaction process in great detail but provides sound if rather generic and high-level guidance. Structure Main clauses: 4: General principles of digital redaction - an introduction 5: Requirements - an overview of the redaction process 6: Redaction processes - such as printing and physically redacting content, editing the original documents in various ways, dealing with metadata (such as document properties and change records) and, in the case of ‘enhanced’ redaction, considering the broader context as well as the specific content (e.g. the possibility of guessing, inferring or reconstructing redacted content from other content in redacted files, or by using other sources) 7: Keeping records of redaction work - in order to be able to explain or justify redaction decisions and actions 8: Characteristics of software redaction tools - a core, generic set of functional requirements 9: Requirements for redaction testing - five simple if basic ways to check whether the redaction has been successful Annex A: Redacting of PDF documents Status The current first edition was published in 2014 and confirmed unchanged in 2019 Commentary The title uses the keyword ‘specification’ which, in ISO-speak, implies a formal definition against which organisations may be independently audited and certified compliant. Whereas ISO specification standards normally use the key-word “shall” exclusively to indicate mandatory requirements, the DIS version also used “should” in places, providing guidance above and beyond the formal specifications. In practice, this makes the standard easier for users to understand and apply, but harder to audit and certify against, if indeed that was ever intended. The standard doesn’t say much about the governance or overall management of the redaction process (e.g. identifying what has to be redacted, why, how and by whom, nor about analysing and treating the risks in a given redaction situation), nor on the security controls that ought to be applied to or associated with the process (e.g. to prevent the inappropriate release of unredacted content or explicit redaction instructions). There is room here for further implementation guidance. Up Up Up This page last updated: 10 July 2026

Generic content to kick-start your ISMS - pretty basic but sound and FREE! These materials were kindly donated by members of the ISO27k Forum and website sponsors. ISO27k Toolkit The ISO27k Toolkit is a collection of generic ISMS-related materials contributed by members of the ISO27k Forum . We are very grateful for the generosity and community-spirit of the donors in allowing us to share them with you, free of charge. The materials have been donated by individuals with differing backgrounds, competence and expertise, working for a variety of organisations and contexts. They are models or templates, starting points if you will. Your information risks are unique, so it is incumbent on you to assess and treat your risks as you and your management see fit. Good luck! ISO27k Toolkit Most of these files, packaged into a zip file All FREE! Two Portuguese translations added in April 2026 are not yet added to the zip. DOWNLOAD ISMS implementation and cert process French Merci a Laurent Jaunaux, Integr'Action Conseil DOWNLOAD ISMS implementation guideline Explains the requirements in ISO/IEC 27001 with pragmatic implementation guidance DOWNLOAD ISMS gap analysis questionnaire Portuguese Questionário para avaliar sistematicamente as práticas de gestão de segurança da informação em relação à norma ISO/IEC 27001. DOWNLOAD 4 Generic cost-benefit analysis The basis for an ISO27k ISMS business case, proposal or budget request DOWNLOAD 5.2 Policy management process Splits the process into policy development and operation DOWNLOAD 6.1 Iterative risk analysis Double-sided guide to a cyclical risk analysis method that revolves around incidents DOWNLOAD 6.1 Plain SoA Español Cristian Celdeiro ayudó en la traducción a Español DOWNLOAD 6.3 Change management policy Addresses the requirement to mange changes to the ISMS DOWNLOAD 7.4 Introduction and gap analysis email Template for a kick-off message introducing the ISMS implementation project DOWNLOAD 9.2 Audit exercise - Português Brasileiro Audit exercise translated to Português Brasileiro DOWNLOAD 9.3 ISMS management review agenda Agenda items for a meeting to discuss an ISMS management review DOWNLOAD A5.9 Technology types, risks and controls 3 pages outlining 5 types of technology with the associated risks and controls DOWNLOAD A5.19 Policy on outsourcing Model policy on risks and controls in business process outsourcing DOWNLOAD A5.34 Briefing on ISO27k for GDPR Where information security and privacy requirements coincide, go for common controls DOWNLOAD A6.3 Policy on awareness and training Rolling programme of security awareness and training for managers, staff, contractors etc. DOWNLOAD A7.9 Policy on working offsite 7 generic policy statements to bootstrap a workable policy DOWNLOAD A8.12 Policy on data leakage prevention 4 crude policy statements to expand upon DOWNLOAD A8.32 Policy on change management Construct your own policy, elaborating on these 5 brief statements DOWNLOAD ISO27k Toolkit terms and conditions A Creative Commons license covers most of the items DOWNLOAD ISMS implementation checklist Pragmatic guidance for ISO/IEC 27001 implementers DOWNLOAD ISMS implementation project estimator Excel model to estimate how long it will take to implement an ISO/IEC 27001 ISMS DOWNLOAD Adaptive SME security Pragmatic approach to information risk and security for SMEs, even micro-orgs DOWNLOAD 4.4 Documentation mind map Just the mandatory ISMS docs required by main body clauses DOWNLOAD 6.1 Security control attributes Use ‘control attributes’ to specify, select and improve information security controls DOWNLOAD 6.1 Smart SoA with custom controls Customise Annex A controls to address your organisation's unique situation DOWNLOAD 6.1 Plain SoA Português Cristian Celdeiro ajudou na tradução para o Português Brasileiro DOWNLOAD 7.3 Prepare to be audited leaflet Awareness on being audited by ISMS internal, certification or technology auditors DOWNLOAD 9.2 Audit exercise A basic exercise or test for ISMS auditors DOWNLOAD 9.2 Audit exercise - crib - Português Brasileiro Crib sheet in Português Brasileiro DOWNLOAD A5.4 Policy on mgmt responsibilities A bare-bones policy skeleton to flesh out DOWNLOAD A5.10 Professional services infosec checklist Security activities for the start, middle and end of professional services engagements DOWNLOAD A5.32 Policy on intellectual property 3 basic policy statements to set you off on the right foot DOWNLOAD A6 Policy on HR A very basic HR security policy starter: lots worth adding! DOWNLOAD A7.1 Policy on physical controls Another skeletal policy starter with a dozen policy statements to set you thinking DOWNLOAD A7.12 Policy on cabling security Just 5 simple policy statements to expand into an actual security policy DOWNLOAD A8.13 Policy on backups An important topic for strategies, policies and procedures DOWNLOAD ISMS implementation and certification process One-page diagram on building, implementing and certifying an ISMS DOWNLOAD ISMS implementation checklist Portuguese Checklist do projeto de implementação de um SGSI DOWNLOAD ISMS gap analysis questionnaire Generic questionnaire on conformity to ISO/IEC 27001 DOWNLOAD Adaptive SME security executive summary An executive summary for busy SME owners, CEOs or managers DOWNLOAD 4.4 ISMS documentation Checklist for 14 types of ‘documented information’ plus additional discretionary materials DOWNLOAD 6.1 Information risk register Systematically assess, evaluate, rank and decide how to treat your information risks DOWNLOAD 6.1 Plain SoA with metrics Generate and record your S tatement o f A pplicability, along with basic metrics DOWNLOAD 6.1.2 Information risk catalogue A checklist of 80 commonplace information risks for risk identification DOWNLOAD 7.3 Single-page FAQ awareness example Succinct set of F requently A sked Q uestions about "ISO 27001” DOWNLOAD 9.2 Audit exercise - crib sheet Suggested answers for the audit exercise, with tips on audit principles DOWNLOAD 9.2 ISMS internal audit procedure Describes the typical process for conducting ISMS internal audits DOWNLOAD A5.9 Information asset checkllist How can you protect your stuff if you don't know what you've got? DOWNLOAD A5.15 Policy on access control A skeleton to beef-up according to your needs DOWNLOAD A5.34 Policy on privacy Minimalist starting point for customisation DOWNLOAD A6.2 Policy on employment contracts Extreme minimalism - just 3 generic policy statements to elaborate on DOWNLOAD A7.4 Policy on physical security monitoring Bare bones, just 6 policy statements DOWNLOAD A7.14 Policy on secure disposal 8 policy statements about disposing of potentially valuable information DOWNLOAD A8.20 Policy on network security Just 9 policy statements scratch the surface of this deep topic DOWNLOAD Not quite what you need? Willing to contribute? Get in touch! Further toolkit contributions are most welcome, whether to plug the many gaps (e.g. materials covering other clauses and controls from ISO/IEC 27001 and 27002 ), offer constructive criticism, translate these materials or provide additional examples. Case study materials would be great. Novel ways of satisfying the standards’ requirements, plus creative, inspirational and innovative approaches are particularly welcome, but so too are simplifications, checklists, diagrams and starting points. Please get in touch if you are willing to donate or seek other materials. We'll see what we can do to help. Given name Family name Email Message Send

General info about the ISO27k standards as a whole - their scope and objectives, the core standards, that sort of thing Previous Back to FAQ summary Next ISO27k standards What use is ISO27k for my organisation? For more on this, see the free ISMS business case template , part of the ISO27k Toolkit . Organisations that use the ISO27k standards gain worthwhile business benefits such as: Protecting valuable information : more specifically, information security enhances the confidentiality, integrity and/or availability of the information content, plus the associated processes, IT systems, networks, services etc ., without imposing excessive security that would prevent it being exploited for legitimate business purposes. Reducing losses : cost-effective security controls minimise the probability and severity of incidents caused deliberately (e.g. hacks, frauds, disinformation) or accidentally (e.g . floods, equipment failures, misconfigurations, inadvertent disclosures). Increasing assurance and trust : conformity with ISO/IEC 27001 and ISO/IEC 27701 demonstrates the organisation’s commitment towards good practices for information security and privacy respectively, plus more broadly support for compliance, ethics etc . to interested parties such as its customers, employees, partners, investors and the authorities. Achieving and maintaining compliance : various laws, regulations and contractual terms impose requirements relating to information security, privacy, accuracy, completeness, timeliness etc. Enhancing resilience : adequately protecting the information, IT systems and processes that are vital to important operational activities and business objectives reduces the possibility of costly disruptive incidents, adverse publicity, customer defections etc. Bolstering brands : aside from merely claiming to protect information, certified conformity with ISO/IEC 27001 and ISO/IEC 27701 enhances the organisation’s reputation. It is increasingly being expected or demanded by discerning customers, partners, investors and regulators - in other words, it confers competitive advantage. To be clear, there are costs associated with sound governance, risk management, security, privacy, assurance, incident management and so on ... but the business benefits outlined above substantially exceed the costs. The risks and costs involved in not taking security and privacy seriously can be existential, as is clear from the news headlines : serious hacking, ransomware and fraud incidents have devastated companies such as Sony Pictures Entertainment, Travelex and Barings Bank. Government institutions, defence, charities and healthcare organisations are far from immune. With such limited resources, S mall to M edium-sized E nterprises stand little chance if targeted, or if mistakes are made in their accounting and tax processes, IT systems and networks. Protecting and exploiting computer data and other forms of information is critically important for business and vital for human safety. There's no need to design a completely bespoke approach for your particular organisation. ISO27k constitutes a suite of internationally-recognised good security practices to suit any organisation, a stable platform on which to build. Are these IT security (cybersecurity) standards? When assessing and treating information risks, focus primarily on risks affecting critical business activities and information - the organisation's crown jewels'. The related computer systems, services and data play a secondary, supporting or enabling role, but don't forget the associated processes, people and relationships. Yes, largely, but they are not limited to IT. The ISO27k standards are about protecting and exploiting valuable information in all forms, not just computer systems, services, networks and data. Aside from computer data, 'information' includes: Printed or written information such as completed forms, signed contracts and rough notes; Information expressed verbally and visually at meetings, videoconferences, phone calls, briefings, seminars, even casual water-cooler or corridor conversations; Policies, procedures and work instructions; Shared corporate culture expressed through attitudes, priorities and ethics, plus personal angles such as body language, prejudices and bias; Knowledge and expertise in workers' heads, plus concepts, ideas, strategies, thoughts ...; Proprietary, business, personal, shared and public information; Intellectual property such as trade secrets, patents, trademarks and copyright information. Various business units, departments and teams generate or acquire, use and benefit from valuable information. IT Department is a custodian for much but not all of it. People throughout the business are accountable for both protecting and (legitimately) exploiting information in support of the organisation’s strategic objectives, with the guidance and assistance of IT, risk, security and other specialists. Suppliers of telecommunications and cloud services, plus utilities such as power and water, all have parts to play in maximising the value of information, while information is an integral and important part of the organisation's products supplied to customers, partners and the authorities (e.g. company accounts and tax reports). Where can I obtain [name any ISO27k standard]? Google and shop around for the best deal. Published ISO27k standards may be purchased directly from the ISO store or from the various national standards bodies and commercial organisations (agents). A few popular ISO27k standards are available through Amazon and other retailers. It is worth checking for localised/national versions of the standards. Several national standards bodies release translated versions of the standards in their own languages. They go to great lengths to ensure that the translations remain true to the originals, although naturally this takes time. ISO27k standards can be purchased as electronic documents or printed hardcopies. In addition to single-user PDFs, standards bodies may license electronic versions of the standards for multi-user internal corporate use, making the definitive standards readily available to workers on the intranet. Are there qualifications for ISO27k professionals? Hands-on ISO27k ISMS implementation and audit experience, ideally with several organisations, is by far the best ‘qualification’ in the field. General information security and technology audit qualifications (such as CISSP, CISM and CISA) can help, and business/management qualifications (such as MBAs) are well worthwhile. Not exactly, but there are certifications or designations. Unlike some IT certifications, ISO27k certifications lack a universally-recognized governing body. Common designations include ISO/IEC 27001 Lead Auditor (LA) , with various paths from formal training and audits to experience-based qualification, and ISO/IEC 27001/27002 Lead Implementer (LI) , which focuses on implementing the ISO27k standards. However, the value of such course-completion certificates is questionable. Demonstrable experience and competence are worth far more. Refer to ISO/IEC 27021 for guidance on “Competence requirements for information security management systems professionals”. Where else can I find answers on ISO27k and information security? Whatever your current state of expertise, actively engaging in study and debate gets you onto the personal development fast-track. Besides the ISO27k standards themselves, consider participating in professional social groups such as: ACM SIG SAC CSA ISC2 ISACA ENGAGE ISO27k Forum ISSA LinkeDin OWASP What is ISO/IEC? “ISO” is not an abbreviation but is in fact derived from the Greek word isos meaning equal. ISO primarily coordinates, facilitates and encourages collaboration between the national standards bodies, driving global standardisation. ISO is the name of the Swiss-based standards body known in English as the International Organization for Standardization . IEC is an abbreviation for the I nternational E lectrotechnical C ommission, another international standards body working closely with ISO on electrical, electronic and related technical standards. Standards developed jointly with ISO are prefixed “ISO/IEC” although in casual terms, we often shorten it to plain “ISO”. ISO/IEC also collaborate with other international organisations (both governmental and private sector) such as the ITU, the I nternational T elecommunication U nion. The ITU is primarily a trade body coordinating telecoms organisations and practices to enable worldwide communications. It allocates radio frequencies, for example, to minimise co-channel interference and encourage the manufacture of radio equipment that can be sold and used internationally. What are all those other obscure abbreviations? The processes are regimented - highly structured and consequently s-l-o-w. At several stages during the development of a standard, national standards body members are invited to vote and comment formally. The following abbreviations are used by the committee developing ISO27k standards: AG - A dvisory G roup AMD - Am end ment ARO - A pproved R S O riginator BRM - B allot R esolution M eeting CB - [IEC] C ouncil B oard CD - C ommittee D raft (1st CD, 2ndCD etc. , a quality-control phase, addressing editorial matters and typoos *) CDV - [IEC] C ommittee D raft for V ote COR - Technical Cor rigendum CS - [ISO] C entral S ecretariat DAM - D raft Am endment DCOR - D raft Technical Cor rigendum DIS - D raft I nternational S tandard (nearly there, down to proofreading, hold your breath *} DoC - D isposition o f C omments DR - Defect Report DTR - Draft Technical Report DTS - Draft Technical Specification FCD - F inal C ommittee D raft (ready for final approval (voting), but rarely used *) FDAM - Final Draft Amendment FDIS - F inal D raft/D istribution I nternational S tandard (just about ready to publish, final tweaks, pinch your nose and count to 100 *) HoD - H ead o f D elegation ICT - I nformation and C ommunications T echnology IEC - I nternational E lectrotechnical C ommission IPR - I ntellectual P roperty R ights IS - I nternational S tandard (published! Yay!) ISO - International Organization for Standardization ITTF - I nformation T echnology T ask F orce ITU - I nternational T elecommunication U nion ITU-R – ITU - R adiocommunications Sector ITU-T – ITU - T elecommunication Standardization Sector JCG - J oint C oordination G roup JTAB - J oint T echnical A dvisory B oard JTC 1 – [ISO + IEC] J oint T echnical C ommittee 1 JWG - J oint W orking G roup MB - (ISO) M ember B ody NB - N ational B ody NC - (IEC) N ational C ommittee NP - N ew P roject (the formal scoping phase, clarifying the proposal and formally seeking approval to proceed with the standards development project *) NWI - N ew W ork I tem OWG - O ther W orking G roup PAS - P ublicly A vailable S pecification PC - P roject C ommittee PDAM - P roposed D raft Am endment PDTR - P roposed D raft T echnical R eport PDTS - P roposed D raft T echnical S pecification PT - P roject T eam PWI - P reliminary W ork I tem - initial feasibility and outline scoping activities PWI - P reliminary W ork I tem RER - R eferencing E xplanatory R eport RG - R apporteur G roup RS - R eferenced S pecification SC - S ubC ommittee SD - S tanding D ocument - now known as Committee Document SG - S tudy G roup SMB - (IEC) S tandardization M anagement B oard SP - S tudy P eriod (preparing the NWIP …) SWG - S pecial W orking G roup TAG - (ISO) T echnical A dvisory G roup TC - T echnical C ommittee TMB - T echnical M anagement B oard TR - T echnical R eport (published! See next Q&A) TS - T echnical S pecification (published! See next Q&A) WD - W orking D raft (1st WD, 2ndWD etc . - content development “preparatory” drafting phase WG - W orking G roup Aside from international standards, what are TRs and TSs? See the ISO DIrectives for even more detail. ISO/IEC publishes a range of different types of standards, as well as covering a number of different subjects: An I nternational S tandard (IS) is the most common form of ISO/IEC standard, including product/technical standards, test methods, ‘codes of practice’ (good practices) and management standards. An IS “provides rules, guidelines or characteristics for activities or for their results, aimed at the achievement of the optimum degree of order in a given context”. Most aim to describe the final objective without prescribing the method of getting there (although they don’t all meet that aim!). The review cycle is 5 years (maximum). A T echnical S pecification (TS) is a standard on an immature subject that is still being developed, and is not quite ready to become a full IS. Feedback is encouraged in order to drive further development leading, eventually, to the release of an IS. Internally within the committee, final drafts are called PDTS P roposed D raft T echnical S pecifications. A T echnical R eport (TR) is informative rather than providing firm guidance. It may draw on surveys and reports, and may attempt to describe the state of the ar’. Final drafts of these are called PDTR P roposed D raft T echnical R eports. A P ublicly A vailable S pecification (PAS) responds to an urgent need to drive consensus on some emerging topic. Alternative and perhaps incompatible views may be expressed by parallel PASs from different expert streams. A PAS is supposed to be replaced by a TS or IS, or withdrawn, within 6 years. An I nternational W orkshop A greement (IWA) is a PAS produced outside of the ISO/IEC world - for example by some technical or industry body. It too has a maximum life of 6 years. What is JTC 1/SC 27 and what are WGs? Once you have ISMS experience, consider getting involved with SC27's standards work by contacting your national standards body and volunteering. ISO/IEC JTC 1/SC 27 is the J oint T echnical C ommittee 1 /S ubC ommittee 27 responsible for numerous information security, privacy and technological standards, including ISO27k series. SC 27 is spread across five W orking G roups focused in particular areas: · WG1 for I nformation S ecurity M anagement S ystems; · WG2 for cryptography; · WG3 for security evaluation; · WG4 for security controls and services; · WG5 for identity management and privacy technologies. How can I keep up with ISO27k? If you have ISO27k news, please share it with the user community via the ISO27k Forum. An easy way to keep in touch with developments is to bookmark this very website and call back every so often to see what's new. Another option is to Google ISO 27001 news or related terms. Professional information security-related organisations such as ISSA and ISACA often carry content on ISO27k. There are a few ISO27k groups on LinkeDin and other social media, of variable quality. Unfortunately most of them (other than the ISO27k Forum) are infested with spammers and well-meaning but inept commentators. Previous Up Next