ISO/IEC 27001:2013 Information Technology Security Systems
₹ 8,500/NosISO/IEC 27001 formally specifies an Information Security Management System (ISMS), a suite of activities concerning the management of information security risks. The ISMS is an overarching management framework through which the organization identifies, analyzes and addresses its information security risks. The ISMS ensures that the security arrangements are fine-tuned to keep pace with changes to the security threats, vulnerabilities and business impacts - an important aspect in such a dynamic field, and a key advantage of ISO27k s flexible risk-driven approach as compared to, say, PCI-DSS.The standard covers all types of organizations (e.g. commercial enterprises, government agencies, non-profits), all sizes (from micro-businesses to huge multinationals), and all industries or markets (e.g. retail, banking, defense, healthcare, education and government). This is clearly a very wide brief.ISO/IEC 27001 does not formally mandate specific information security controls since the controls that are required vary markedly across the wide range of organizations adopting the standard. The information security controls from ISO/IEC 27002 are noted in annex A to ISO/IEC 27001, rather like a menu. Organizations adopting ISO/IEC 27001 are free to choose whichever specific information security controls are applicable to their particular information security situations, drawing on those listed in the menu and potentially supplementing them with other a la carte options (sometimes known as extended control sets). As with ISO/IEC 27002, the key to selecting applicable controls is to undertake a comprehensive assessment of the organization s information security risks, which is one vital part of the ISMS. Furthermore, management may elect to avoid, transfer or accept information security risks rather than mitigate them through controls - a risk management decision. Benefit: 1.Security policy - management direction 2. Organization of information security - governance of information security 3. Asset management - inventory and classification of information assets 4. Human resources security - security aspects for employees joining, moving and leaving an organization 5. Physical and environmental security - protection of the computer facilities 6. Communications and operations management - management of technical security controls in systems and networks 7. Access control - restriction of access rights to networks, systems, applications, functions and data 8. Information systems acquisition, development and maintenance - building security into applications 9. Information security incident management - anticipating and responding appropriately to information security breaches