What is the difference between iso 17799 and iso 27001?

ISO 27001 is an information security standard that was published in 2013. The standard is designed to help organizations keep their information assets safe.

Organizations that implement ISO 27001 can be certified by a third-party certification body. Certification demonstrates that the organization has put in place an effective information security management system (ISMS).

ISO 27001 is part of the ISO 27000 family of standards. Other standards in the family include ISO 27002, which provides guidance on how to implement an ISMS, and ISO 27005, which provides guidance on risk management.

Benefits of ISO 27001

There are many benefits to implementing ISO 27001. These benefits include:

• improved security of information assets
• reduced risk of data breaches
• increased customer confidence
• improved compliance with data protection regulations
• enhanced reputation.

How does ISO 27001 work?

ISO 27001 is a framework that organizations can use to manage their information security. The standard provides guidance on how to identify, assess, and control risks to information assets. It also includes requirements for setting up an ISMS.

To be certified to ISO 27001, organizations must go through a certification process. This process involves having their ISMS audited by a third-party certification body. The certification body will assess whether the organization has met the requirements of the standard.

Who needs to comply with ISO 27001?

Organizations of all sizes and types can benefit from implementing ISO 27001. The standard is suitable for organizations of any size, sector, or location.

What are the requirements of ISO 27001?

The requirements of ISO 27001 are divided into two parts: the ISMS requirements and the Annex A controls.

The ISMS requirements are the high-level requirements that organizations must meet in order to be certified to ISO 27001. These requirements cover topics such as risk management, security policy, and incident management.

Annex A of ISO 27001 contains a list of 114 controls that organizations can use to manage their information security. These controls are divided into 14 categories, such as asset management and access control.

Organizations do not have to implement all of the controls in Annex A. They can choose the controls that are most relevant to their organization.

How do I get started with ISO 27001?

There is no one-size-fits-all approach to implementing ISO 27001. The standard provides guidance on how to implement an ISMS, but it is up to organizations to decide how they will do this.

Organizations can get started by doing the following:

• reading ISO 27001 and ISO 27002
• conducting a gap analysis to identify where their current security practices need to be improved
• implementing the requirements of ISO 27001
• having their ISMS audited by a certification body.

How much does it cost to implement ISO 27001?

The cost of implementing ISO 27001 will vary from organization to organization. The size and complexity of the organization, as well as the number of staff involved in the project, will all affect the cost.

Organizations can expect to spend between $5,000 and $50,000 on the initial implementation of ISO 27001. The annual cost of maintaining an ISMS will be lower than this.

Is there a difference between ISO/IEC 17799 and ISO 27001?

Yes, there is a difference between ISO/IEC 17799 and ISO 27001.

ISO/IEC 17799 was published in 2000 and was replaced by ISO 27001 in 2013. The two standards are similar, but there are some key differences.

The most significant difference is that ISO 27001 is a framework for an ISMS, while ISO/IEC 17799 is a code of practice for information security.

Another difference is that ISO 27001 includes requirements for risk management, while ISO/IEC 17799 does not.

What is the history of ISO 27001?

ISO 27001 was first published in 2005. It was based on the BS 7799-2 standard, which was published in 1999.

BS 7799-2 was developed by the British Standards Institution (BSI). It was based on an earlier standard, BS 7799-1, which was published in 1995.

BS 7799-1 was developed by a team of experts from a variety of organizations, including the UK government, banks, and universities.

Who developed ISO 27001?

ISO 27001 was developed by the International Organization for Standardization (ISO). ISO is a network of national standards bodies.

What is the scope of ISO 27001?

The scope of ISO 27001 is defined in the standard’s introduction. It states that the standard is applicable to “all types of organizations (e.g. commercial enterprises, government agencies, not-for-profit organizations)”.

How is ISO 27001 structured?

ISO 27001 is divided into four parts:

– Introduction – Overview and explanation – Requirements

– Annex A – Controls.

To consolidate information security standards under the “27000” series number, ISO 17799:2005 has been changed to ISO 27002:2005. The renumbered standard has the same content and retains the same title, “Information Technology – Security Techniques – Code of Practice for Information Security Management”. 

The ISO 27000 family currently consists of:

• ISO 27001:2005 – Information Security Management Systems – Requirements
• ISO 27002:2005 – Information Technology – Security Techniques – Code of Practice for Information Security Management
• ISO 27006:2007 – Requirements for Bodies Providing Audit and Certification of Information Security Management Systems

Information security titles in development include:

• ISO 27000 – Information Security Management Systems Fundamentals and Vocabulary
• ISO 27003 – Information Security Management Systems Implementation Guidance
• ISO 27004 – Information Security Management Measurements
• ISO 27005 – Information Security Risk Management
• ISO 27007 – Information Security Management Systems Auditor Guidelines
• ISO 27011 – Information Security Management Guidelines for Telecommunications

Alan Calder

12.1 ISO 27001 AND ISO 17799—THE INFORMATION SECURITY STANDARDS

(a) Background to ISO 27001

(b) Information Security Standards Originating Body

(c) ISO/IEC 27001:2005 (ISO 27001)

(d) ISO/IEC 17799:2005 (ISO 17799)

12.2 ISO 17799 VERSUS ISO 27001

(a) Correspondence between the Two Standards

(b) Integration of Management Systems

(c) IT Governance and Information Security Management

(d) Risks to Information Assets

(e) Information Security

(f) Information Security Management System

(g) ISO 27001 as a Model for the ISMS

(h) Legal and Regulatory Framework

(i) Process Approach and the PDCA Cycle

(j) Establishing the ISMS

(k) Policy and Business Objectives

(l) Risk Assessment

(m) Risk Treatment Plan

12.3 CONCLUSION

12.4 ESSENTIAL FURTHER READING

NOTES

The replacement, in late 2005, of BS 77799-2:2002 by the international information security management system (ISMS) standard ISO/IEC 27001:2005 marks the coming of age of information security management. ISO 27001 is the international standard for information security management systems, and it provides organizations with best practice guidance for identifying, assessing, and controlling information risks in strategic business plans and everyday operational environments. It's the essential standard for the information age organization. It has an important and symbiotic relationship with another international standard, ISO/IEC 17799:2005, ...

Welcome to Maxi-Pedia Forum. Maxi-Pedia discussion forum is a free community inviting you to express your ideas and discuss various topics with other contributors.

Loading...