词条 | ISO/IEC 27000-series |
释义 |
The ISO/IEC 27000-series (also known as the 'ISMS Family of Standards' or 'ISO27K' for short) comprises information security standards published jointly by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC).[1] The series provides best practice recommendations on information security management - the management of information risks through information security controls - within the context of an overall Information security management system (ISMS), similar in design to management systems for quality assurance (the ISO 9000 series), environmental protection (the ISO 14000 series) and other management systems.[2][3][4] The series is deliberately broad in scope, covering more than just privacy, confidentiality and IT/technical/cybersecurity issues. It is applicable to organizations of all shapes and sizes. All organizations are encouraged to assess their information risks, then treat them (typically using information security controls) according to their needs, using the guidance and suggestions where relevant. Given the dynamic nature of information risk and security, the ISMS concept incorporates continuous feedback and improvement activities to respond to changes in the threats, vulnerabilities or impacts of incidents. The standards are the product of ISO/IEC JTC1 (Joint Technical Committee 1) SC27 (Subcommittee 27), an international body that meets in person twice a year. The ISO/IEC standards are sold directly by ISO, mostly in English, French and Chinese. Sales outlets associated with various national standards bodies also sell directly translated versions in other languages. Early historyMany people and organisations are involved in the development and maintenance of the ISO27K standards. The first standard in this series was ISO/IEC 17799:2000; this was a fast-tracking of the existing British standard BS 7799 part 1:1999[5] The initial release of BS 7799 was based, in part, on an information security policy manual developed by the Royal Dutch/Shell Group in the late 1980s and early 1990s. In 1993, what was then the Department of Trade and Industry (United Kingdom) convened a team to review existing practice in information security, with the goal of producing a standards document. In 1995, the BSI Group published the first version of BS 7799.[6] One of the principal authors of BS 7799 recalls that, at the beginning of 1993, "The DTI decided to quickly assemble a group of industry representatives from seven different sectors: Shell ([David Lacey] and Les Riley), BOC Group (Neil Twist), BT (Dennis Willets), Marks & Spencer (Steve Jones), Midland Bank (Richard Hackworth), Nationwide (John Bowles) and Unilever (Rolf Moulton)."[7] David Lacey credits Donn B. Parker as having the "original idea of establishing a set of information security controls", and with producing a document containing a "collection of around a hundred baseline controls" by the late 1980s for "the I-4 Information Security circle[8] which he conceived and founded." Published standardsThe published ISO27K standards related to "information technology - security techniques" are:
In preparation
See also
References1. ^ISO Freely Available Standards - see ISO/IEC 27000:2014 2. ^{{cite web|url=https://www.iso.org/standard/54534.html|title=ISO/IEC 27001:2013 - Information technology -- Security techniques -- Information security management systems -- Requirements|publisher=International Organization for Standardization|accessdate=20 May 2017}} 3. ^{{cite web|url=https://qualitymanagement.co.uk/iso-27001/ |title=ISO 27001 Information Security Management (ISMS) |accessdate= June 14, 2017 | archiveurl=https://www.webcitation.org/6rCMuBJKy |archivedate=June 14, 2017 |deadurl=no}} 4. ^{{cite web| url=https://www.iso.org/committee/45306/x/catalogue/| accessdate=20 May 2017| publisher=International Organization for Standardization| title=ISO - ISO Standards - ISO/IEC JTC 1/SC 27 - IT Security techniques}} 5. ^{{cite web|title=ISO27K timeline|url=http://www.iso27001security.com/html/timeline.html|website=ISO27001security.com|publisher=IsecT Ltd.|access-date=1 April 2016|ref=timeline}} 6. ^{{cite book|title=Information Technology Risk Management in Enterprise Environments : a Review of Industry Practices and a Practical Guide to Risk Management Teams| author=Jake Kouns, Daniel Minoli|publisher=Somerset: Wiley|year=2011}} 7. ^{{cite web|title=David Lacey on the Origins of ISO27K|url=http://www.tripwire.com/state-of-security/regulatory-compliance/david-lacey-on-the-origins-of-iso27K/|date=18 October 2013|publisher=Tripwire.com}} 8. ^{{cite web|url=https://i4online.com/ |title=Home « I-4 |publisher=I4online.com |date= |accessdate=2017-04-15}} 9. ^{{cite web|url=http://standards.iso.org/ittf/PubliclyAvailableStandards/c066435_ISO_IEC_27000_2016(E).zip|title=ISO - International Organization for Standardization|last=Standardization|first=ISO - International Organization for|date=2006-09-29|website=standards.iso.org|language=en|access-date=2016-12-02}} 10. ^{{cite web|last=Gasiorowski |first=Elizabeth |url=http://www.iso.org/iso/home/store/catalogue_ics/catalogue_detail_ics.htm?csnumber=64120 |title=ISO/IEC 27004:2016 - Information technology - Security techniques - Information security management - Monitoring, measurement, analysis and evaluation |publisher=Iso.org |date=2016-12-16 |accessdate=2017-04-15}} 11. ^{{cite web|last=Humphreys |first=Edward |url=http://www.iso.org/iso/home/store/catalogue_ics/catalogue_detail_ics.htm?csnumber=56742 |title=ISO/IEC 27005:2011 - Information technology - Security techniques - Information security risk management |publisher=Iso.org |date= |accessdate=2017-04-15}} 12. ^ISO/IEC 27014 13. ^Mahncke, R. J. (2013). The Applicability of ISO/IEC27014:2013 For Use Within General Medical Practice. 14. ^{{Cite web|url=https://www.iso.org/standard/43755.html|title=ISO/IEC TR 27015:2012 - Information technology -- Security techniques -- Information security management guidelines for financial services|website=www.iso.org|language=en|access-date=2018-04-03}} 15. ^{{cite web|title=ISO/IEC 27040|url=http://www.iso.org/iso/home/store/catalogue_tc/catalogue_detail.htm?csnumber=44404|website=ISO Standards Catalogue|publisher=ISO|accessdate=2014-06-15}} External links
2 : Information technology management|ISO/IEC standards |
随便看 |
|
开放百科全书收录14589846条英语、德语、日语等多语种百科知识,基本涵盖了大多数领域的百科知识,是一部内容自由、开放的电子版国际百科全书。