This standard essentially defines an Information Security Management System (known as an ISMS), and compliments the ISO 17799 'code of practice' standard, which was re-published earlier in the year. It specifies the framework for the design, management and maintenance of information security processes within an organization.

These two standards are closely aligned, but fulfill clear and distinct roles:

ISO 17799

This details many hundreds of individual security controls, which may be selected and applied as part of the security management system.

ISO 27001

This specifies the requirements for the security management system itself. It is this standard, as opposed to ISO 17799, against which certification is offered. ISO 27001 has also been "harmonized" to be compatible with other management standards, such as ISO 9000 and ISO 14000.

The publication of the new standard, earlier versions of which were published as BS7799-2, is likely to herald a rapid increase in interest in both information security and certification. Organizations already certified under BS7799-2 will embark on a transitional route, whereas the international status of the new certification standard is bound to have a global impact in terms of numbers following the certification route generally.

It should also be mentioned that BSI has published the following publications:

• Guidelines on requirements and preparation for ISMS certification based on ISO/IEC 27001 (BIP 0071)
  
• Are you ready for an ISMS audit based on ISB/IEC 27001? (BIP 0072)
  
• Guide to the implementation and auditing of ISMS controls based on ISO/IEC 27001 (BIP 0073)

Related links: (Open in a new window.)
www.bsi-global.com
17799.standardsdirect.org
www.standards-online.net/InformationSecurityStandard.htm
www.17799-toolkit.com

View printable version (opens in new window)
Back