This document provides an introduction to ISO 27001, an internationally recognized standard for information security management. It defines information security as preserving the confidentiality, integrity and availability of information. ISO 27001 describes a structured methodology for establishing an Information Security Management System (ISMS) based on best practices. The standard takes a holistic approach, balancing physical, technical, procedural and personnel security controls. It outlines five mandatory requirements for an ISMS including management responsibility, internal audits, and management review. The standard also describes 11 domains of information security and the documentation required in an ISMS.

1. ISO 27001:2005
A brief Introduction

2. Information
“Information is an asset which, like other important
business assets, has value to an organization and
consequently needs to be suitably protected.”
–Printed or written on paper
–Stored electronically
–Transmitted by mail or electronic means
–Spoken in conversations

3. What is Information Security
ISO 27001 defines this as the preservation of:

4. Achieving Information Security

5. What is ISO27001?
– An internationally recognized structured
methodology dedicated to information security
–A management process to evaluate, implement and
maintain an Information Security Management
System (ISMS)
–A comprehensive set of controls comprised of best
practices in information security
–Applicable to all industry sectors
–Emphasis on prevention

6. Holistic Approach
–ISO 27001 defines best practices for information
security management
–A management system should balance physical,
technical, procedural, and personnel security
–Without a formal Information Security
Management System, such as a BS 7799-2 based
system, there is a greater risk to your security being
breached
–Information security is a a management process,
not
a technological process

7. ISO 27001 :2005 PDCA Structure

8. ISO 27001:2005 Structure
Five Mandatory requirements of the standard:
–Information Security Management System
• General requirements
• Establishing and managing the ISMS (e.g. Risk Assessment)
• Documentation Requirements
– Management Responsibility
• Management Commitment
• Resource Management (e.g. Training, Awareness)
– Internal ISMS Audits
– Management Review of the ISMS
• Review Input (e.g. Audits, Measurement, Recommendations)
• Review Output (e.g. Update Risk Treatment Plan, New Recourses)
–ISMS Improvement
• Continual Improvement
• Corrective Action
• Preventive Action

9. 11 Domains of Information Management

10. Implementation Process

11. ISMS Documentation

12. Documentation Requirement
The ISMS documentation shall include:
a) documented statements of the ISMS policy and objectives
b) the scope of the ISMS
c) procedures and controls in support of the ISMS
d) a description of the risk assessment methodology
e) the risk assessment report
f) the risk treatment plan
g) documented procedures needed by the organization to ensure the effective
planning, operation and control of its information security processes and
describe how to measure the effectiveness of controls
h) records required by this International Standard
i) the Statement of Applicability.

13. Comparison Between ISO 9001 & ISO 27001
 ISO 27001
 ISO 9001
•
•
•
•
•
•
Quality Policy & Objectives
Quality Manual
6 Mandatory Procedures
Departmental Manual
Procedures, Work Instructions,
Guidelines
Formats, Checklist
•
•
•
•
•
•
•
•
•
•
•
•
•
ISMS Manual
Control Manual
5 Mandatory Procedures
Other Work Instructions, Procedures,
Guidelines required
Formats, Checklist Required
ISMS policy & objectives
a description of the risk assessment
methodology
the risk assessment report
the risk treatment plan
the Statement of Applicability
legal & contractual requirement
points considered in the management review
input include vulnerabilities or threats not
adequately addressed in the previous risk
assessment;
results from effectiveness measurements;

14. Thank You