Supporting Material: ISO/IEC 27001

What is ISO/IEC 27001?

ISO/IEC 27001 is an international standard for an Information Security Management System (ISMS). The ISMS provides assurance of adequate security controls over information assets. ISO/IEC 27001 has evolved from British Standard BS 7799-2. Organizations can be certified against ISO/IEC 27001. ISO/IEC 27001 is related to ISO/IEC 17799.

Domain	Specifications	Best Practices	Process Model	Maturity Model
Information Security Management Systems	yes	no	no	no

ISO/IEC 27001 consists of one document:

ISO/IEC 27001-1: Information security management systems -- Requirements

This document can be purchased from the http://www.iso.org/.

ISO/IEC 27001 describes 133 specific controls, categorized into 39 control objectives, listed in 11 distinct chapters of ISO 17799. These controls were directly derived from those listed in ISO/IEC 17799.

Process Mapping

A.5. Security Policy

ISO/IEC 27001 Controls	PRM-IT Process(es)	Specific Activity or Activities
A.5.1 Provide security policies in accordance with laws, regulations, and the business	Security Management	Produce and Maintain Security Policy

A.6. Organization of Information Security

ISO/IEC 27001 Controls	PRM-IT Process(es)	Specific Activity or Activities
A.6.1 Manage internal information security	Security Management	Monitor, Assess, Audit and Report Security
A.6.2 Manage security for information accessed by external parties	Security Management	Monitor, Assess, Audit and Report Security

A.7.1 Protect organizational assets

ISO/IEC 27001 Controls

PRM-IT Process(es)

Specific Activity or Activities

A.7.1 Protect organizational assets

Asset Management

Facilities Management

Identity and Access Management

Security Management

all

A.7.2 Ensure appropriate level of information protection

Security Management

Classify Information Asset Security

Plan and Implement Security Practices

A.8. Human Resources Security

ISO/IEC 27001 Controls

PRM-IT Process(es)

Specific Activity or Activities

A.8.1 Ensure understanding by all internal and external parties concerning responsibilities to reduce theft, fraud, and misuse

Workforce Management

Security Management

Administer Human Resources

Establish Security Management Framework

A.8.2 Ensure understanding by all internal and external parties concerning security threats and concerns

Workforce Management

Security Management

Administer Human Resources

Establish Security Management Framework

A.8.2 Ensure an orderly process for exiting the organization or changing employment

Workforce Management

Security Management

Administer Human Resources

Establish Security Management Framework

A.9. Physical and Environmental Security

ISO/IEC 27001 Controls

PRM-IT Process(es)

Specific Activity or Activities

A.9.1 Prevent damage and unauthorized physical access to premises and information

Facilities Management

Operate and Maintain Facilities

A.9.2 Prevent loss, damage, theft, or compromise of equipment

Facilities Management

Asset Management

Operate and Maintain Facilities

Ready and Control Asset

A.10. Communications and Operations Management

ISO/IEC 27001 Controls	PRM-IT Process(es)	Specific Activity or Activities
A.10.1 Ensure secure operation of facilities through operational procedures and responsibilities	Facilities Management Security Management	Operate and Maintain Facilities Plan and Implement Security Practices
A.10.2 Provide appropriate level of security according to service delivery agreements	Security Management Supplier Management	Operate Security Protection Mechanisms Establish Supplier Management Framework
A.10.3 Minimize risk of system failure during system planning and acceptance	Availability Management	Plan and Implement Security Practices
A.10.4 Provide protection against malicious and mobile code	Security Management	Operate Security Protection Mechanisms
A.10.5 Provide appropriate backups to maintain information integrity and availability	Data Management	Backup and Restore Data
A.10.6 Protect information within networks and related infrastructure	Security Management	Classify Information Asset Security Plan and Implement Security Practices Operate Security Protection Mechanisms
A.10.7 Provide secure handling of media to prevent unauthorized information access	Data Management	Control, Deploy and Maintain Data
A.10.8 Maintain secure information exchange with external parties	Data Management	Control, Deploy and Maintain Data
A.10.9 Ensure secure use of electronic commerce services	Security Management Supplier Management	Plan and Implement Security Practices Manage Procurement
A.10.10 Monitor and detect unauthorized information processing activities	Security Management	Monitor, Assess, Audit and Report Security

A.11. Access Control

ISO/IEC 27001 Controls	PRM-IT Process(es)	Specific Activity or Activities
A.11.1 Control information access	Security Management	Operate Security Protection Mechanisms
A.11.2 Prevent unauthorized user access to information	Security Management	Operate Security Protection Mechanisms
A.11.3 Prevent compromise or theft of information	Security Management	Operate Security Protection Mechanisms
A.11.4 Prevent unauthorized network access	Security Management	Operate Security Protection Mechanisms
A.11.5 Prevent unauthorized operating system access	Security Management	Operate Security Protection Mechanisms
A.11.6 Prevent unauthorized application system access	Security Management	Operate Security Protection Mechanisms
A.11.7 Ensure information security for mobile users	Security Management	Operate Security Protection Mechanisms

A.12. Information Systems Acquisition, Development and Maintenance

ISO/IEC 27001 Controls	PRM-IT Process(es)	Specific Activity or Activities
A.12.1 Integrate security with information systems	Architecture Management Solution Analysis and Design Security Management	n/a
A.12.2 Prevent misuse of information in applications	Solution Requirements Solution Analysis and Design Security Management	Plan and Implement Security Practices
A.12.3 Use cryptography to protect information confidentiality, authenticity, and integrity	Security Management	Operate Security Protection Mechanisms
A.12.4 Ensure security of system files	Security Management	Plan and Implement Security Practices Operate Security Protection Mechanisms
A.12.5 Maintain security of application systems	Security Management	Plan and Implement Security Practices Operate Security Protection Mechanisms
A.12.6 Reduce exploitation of published technical vulnerabilities	Security Management	Analyze Security Threats, Vulnerabilities and Risks