This article is based on a review of 20 gap audit reports for a variety of organizations, including public sector …
Overview of ISO/IEC 27001: 2013
The international standard ISO/IEC 27001 is an ISMS set of requirementsfor establishing, implementing, deploying, monitoring, reviewing, maintaining, updating and improving …
Second Edition of ISO/IEC 27002
At the same time that ISO/IEC 27001 was being revised, so was the standard ISO/IEC 27002 code of practice for …
ISMS Business Context
Before embarking on the development and implementation of an ISMS, it is important to understand your organisation, its context and …
ISO/IEC 27001:2013 Information technology — Security techniques — Information security management systems — Requirements
Introduction ISO/IEC 27001 formally specifies an Information Security Management System (ISMS), a suite of activities concerning the management of information …
Cybersecurity for Everyone, Not Just the IT Department
Cybersecurity is for everyone, not just the IT department. All the time and capital you’ve invested in a robust security plan means nothing if human error is not addressed. Protect your company, your employees and your security investment by ensuring everyone in your organization is executing best practices when it comes to information security.
Disaster recovery and business continuity planning with ISO 9001
If you produce components for manufacturers who expect their suppliers to deliver on time and consistently to recognised standards, they …
ISO 27001 – PROTECTING YOUR BUSINESS AGAINST CYBER CRIME
Cyber crime is on the increase and reported incidents are regularly being publicised in the national press. Businesses can no …
ISO/IEC 27002:2013-Information technology — Security techniques — Code of practice for information security controls (second edition)
ISO/IEC 27002 is a popular, internationally-recognized standard of good practice for information security. ISO/IEC 27002’s lineage stretches back more than 30 years to the precursors of BS 7799.
ISO 27001-Information technology — Security techniques — Information security management systems — Requirements (second edition)
ISO/IEC 27001 formally specifies an Information Security Management System (ISMS), a suite of activities concerning the management of information risks (called ‘information security risks’ in the standard). The ISMS is an overarching management framework through which the organization identifies, analyzes and addresses its information risks. The ISMS ensures that the security arrangements are fine-tuned to keep pace with changes to the security threats, vulnerabilities and business impacts – an important aspect in such a dynamic field, and a key advantage of ISO27k’s flexible risk-driven approach as compared to, say, PCI-DSS.
The standard covers all types of organizations (e.g. commercial enterprises, government agencies, non-profits), all sizes (from micro-businesses to huge multinationals), and all industries or markets (e.g. retail, banking, defense, healthcare, education and government). This is clearly a very wide brief.
