ISO/IEC 27002

ISO/IEC 27002 is an information security standard published by the International Organization for Standardization (ISO) and by the International Electrotechnical Commission (IEC), titled Information technology – Security techniques – Code of practice for information security management.

ISO/IEC 27002:2005 was developed from BS7799, published in the mid-1990s. The British Standard was adopted by ISO/IEC as ISO/IEC 17799:2000, revised in 2005, and renumbered (but otherwise unchanged) in 2007 to align with the other ISO/IEC 27000-series standards.

ISO/IEC 27002 provides best practice recommendations on information security management for use by those responsible for initiating, implementing or maintaining information security management systems (ISMS). Information security is defined within the standard in the context of the C-I-A triad:

the preservation of confidentiality (ensuring that information is accessible only to those authorized to have access), integrity (safeguarding the accuracy and completeness of information and processing methods) and availability (ensuring that authorized users have access to information and associated assets when required).

Outline

Outline for ISO27002:2013

The current version (as of January 2015) is the ISO27002:2013 and it starts with 5 introductory sections:
0. Introduction
1. Scope
2. Normative references
3. Terms and definitions
4. Structure of this standard

These are followed by 14 domains, described in chapters 5 to 18:

5. Information Security Policies
6. Organization of Information Security
7. Human Resource Security
8. Asset Management
9. Access Control
10. Cryptography
11. Physical and environmental security
12. Operation Security- procedures and responsibilities, Protection from malware, Backup, Logging and monitoring, Control of operational software, Technical vulnerability management and Information systems audit coordination
13. Communication security - Network security management and Information transfer
14. System acquisition, development and maintenance - Security requirements of information systems, Security in development and support processes and Test data
15. Supplier relationships - Information security in supplier relationships and Supplier service delivery management
16. Information security incident management - Management of information security incidents and improvements
17. Information security aspects of business continuity management - Information security continuity and Redundancies
18. Compliance - Compliance with legal and contractual requirements and Information security reviews

Outline for ISO27002:2005

After the 4 introductory sections (0. Introduction, 1. Scope, 2. Terms and Definitions, and 3. Structure of This Standard), the standard contains the following twelve main sections

4. Risk assessment
5. Security policy – management direction
6. Organization of information security – governance of information security
7. Asset management – inventory and classification of information assets
8. Human resources security – security aspects for employees joining, moving and leaving an organization
9. Physical and environmental security – protection of the computer facilities
10. Communications and operations management – management of technical security controls in systems and networks
11. Access control – restriction of access rights to networks, systems, applications, functions and data
12. Information systems acquisition, development and maintenance – building security into applications
13. Information security incident management – anticipating and responding appropriately to information security breaches
14. Business continuity management – protecting, maintaining and recovering business-critical processes and systems
15. Compliance – ensuring conformance with information security policies, standards, laws and regulations

Within each section, information security controls and their objectives are specified and outlined. The information security controls are generally regarded as best practice means of achieving those objectives. For each of the controls, implementation guidance is provided. Specific controls are not mandated since:

1. Each organization is expected to undertake a structured information security risk assessment process to determine its specific requirements before selecting controls that are appropriate to its particular circumstances. The introduction section outlines a risk assessment process although there are more specific standards covering this area such as ISO/IEC 27005. The use of information security risk analysis to drive the selection and implementation of information security controls is an important feature of the ISO/IEC 27000-series standards: it means that the generic good practice advice in this standard gets tailored to the specific context of each user organization, rather than being applied by rote. Not all of the 39 control objectives are necessarily relevant to every organization for instance, hence entire categories of control may not be deemed necessary. The standards are also open ended in the sense that the information security controls are 'suggested', leaving the door open for users to adopt alternative controls if they wish, just so long as the key control objectives relating to the mitigation of information security risks, are satisfied. This helps keep the standard relevant despite the evolving nature of information security threats, vulnerabilities and impacts, and trends in the use of certain information security controls.
2. It is practically impossible to list all conceivable controls in a general purpose standard. Industry-specific implementation guidelines for ISO/IEC 27001:2013 and ISO/IEC 27002 offer advice tailored to organizations in the telecomms industry (see ISO/IEC 27011) and healthcare (see ISO 27799), with additional guidelines for the financial services and other industries in preparation.

Most organizations implement a wide range of information security-related controls, many of which are recommended in general terms by ISO/IEC 27002. Structuring the information security controls infrastructure in accordance with ISO/IEC 27002 may be advantageous since it:

• Is associated with a well-respected international standard
• Helps avoid coverage gaps and overlaps
• Is likely to be recognized by those who are familiar with the ISO/IEC standard

Implementation example of ISO/IEC 27002

Here are a few examples of typical information security policies and other controls relating to three parts of ISO/IEC 27002. (Note: this is merely an illustration. The list of example controls is incomplete and not universally applicable.)

Physical and Environmental security

• Physical access to premises and support infrastructure (communications, power, air conditioning etc.) must be monitored and restricted to prevent, detect and minimize the effects of unauthorized and inappropriate access, tampering, vandalism, criminal damage, theft etc.
• The list of people authorized to access secure areas must be reviewed and approved periodically (at least once a year) by Administration or Physical Security Department, and cross-checked by their departmental managers.
• Photography or video recording is forbidden inside Restricted Areas without prior permission from the designated authority.
• Suitable video surveillance cameras must be located at all entrances and exits to the premises and other strategic points such as Restricted Areas, recorded and stored for at least one month, and monitored around the clock by trained personnel.
• Access cards permitting time-limited access to general and/or specific areas may be provided to trainees, vendors, consultants, third parties and other personnel who have been identified, authenticated, and authorized to access those areas.
• Other than in public areas such as the reception foyer, and private areas such as rest rooms, visitors should be escorted at all times by an employee while on the premises.
• The date and time of entry and departure of visitors along with the purpose of visits must be recorded in a register maintained and controlled by Site Security or Reception.
• Everyone on site (employees and visitors) must wear and display their valid, issued pass at all times, and must present their pass for inspection on request by a manager, security guard or concerned employee.
• Access control systems must themselves be adequately secured against unauthorized/inappropriate access and other compromises.
• Fire/evacuation drills must be conducted periodically (at least once a year).
• Smoking is forbidden inside the premises other than in designated Smoking Zones.

Human Resource security

• All employees must be screened prior to employment, including identity verification using a passport or similar photo ID and at least two satisfactory professional references. Additional checks are required for employees taking up trusted positions.
• All employees must formally accept a binding confidentiality or non-disclosure agreement concerning personal and proprietary information provided to or generated by them in the course of employment.
• Human Resources department must inform Administration, Finance and Operations when an employee is taken on, transferred, resigns, is suspended or released on long-term leave, or their employment is terminated.
• Upon receiving notification from HR that an employee's status has changed, Administration must update their physical access rights and IT Security Administration must update their logical access rights accordingly.
• An employee's manager must ensure that all access cards, keys, IT equipment, storage media and other valuable corporate assets are returned by the employee on or before their last day of employment, as a condition of authorizing their final pay....

Access control

• Users of corporate IT systems, networks, applications and information must be individually identified and authenticated.
• User access to corporate IT systems, networks, applications and information must be controlled in accordance with access requirements specified by the relevant Information Asset Owners, normally according to the user's role.
• Generic or test IDs must not be created or enabled on production systems unless specifically authorized by the relevant Information Asset Owners.
• After a predefined number of unsuccessful logon attempts, security log entries and (where appropriate) security alerts must be generated and user accounts must be locked out as required by the relevant Information Asset Owners.
• Passwords or pass phrases must be lengthy and complex, consisting of a mix of letters, numerals and special characters that would be difficult to guess.
• Passwords or pass phrases must not be written down or stored in readable format.
• Authentication information such as passwords, security logs, security configurations and so forth must be adequately secured against unauthorized or inappropriate access, modification, corruption or loss.
• Privileged access rights typically required to administer, configure, manage, secure and monitor IT systems must be reviewed periodically (at least twice a year) by Information Security and cross-checked by the appropriate departmental managers.
• Users must either log off or password-lock their sessions before leaving them unattended.
• Password-protected screensavers with an inactivity timeout of no more than 10 minutes must be enabled on all workstations/PCs.
• Write access to removable media (USB drives, CD/DVD writers etc.) must be disabled on all desktops unless specifically authorized for legitimate business reasons.

National Equivalent Standards

ISO/IEC 27002 has directly equivalent national standards in several countries. Translation and local publication often results in several months' delay after the main ISO/IEC standard is revised and released, but the national standard bodies go to great lengths to ensure that the translated content accurately and completely reflects ISO/IEC 27002.

Countries	Equivalent Standard
Australia  New Zealand	AS/NZS ISO/IEC 27002:2006
Brazil	ISO/IEC NBR 17799/2007 – 27002
Indonesia	SNI ISO/IEC 27002:2014
Chile	NCH2777 ISO/IEC 17799/2000
China	GB/T 22081-2008
Czech Republic	ČSN ISO/IEC 27002:2006
Denmark	DS/ISO27002:2014 (DK)
Estonia	EVS-ISO/IEC 17799:2003, 2005 version in translation
Germany	DIN ISO/IEC 27002:2008
Japan	JIS Q 27002
Lithuania	LST ISO/IEC 27002:2009 (adopted ISO/IEC 27002:2005, ISO/IEC 17799:2005)
Netherlands	NEN-ISO/IEC 27002:2005
Peru	NTP-ISO/IEC 17799:2007
Poland	PN-ISO/IEC 17799:2007, based on ISO/IEC 17799:2005
Russia	ГОСТ/Р ИСО МЭК 17799-2005
Slovakia	STN ISO/IEC 27002:2006
South Africa	SANS 27002:2014/ISO/IEC 27002:2013[1]
Spain	UNE 71501
Sweden	SS-ISO/IEC 27002:2014
Turkey	TS ISO/IEC 27002
Thailand	UNIT/ISO
Ukraine	СОУ Н НБУ 65.1 СУІБ 2.0:2010
United Kingdom	BS ISO/IEC 27002:2005
Uruguay	UNIT/ISO 17799:2005

Certification

ISO/IEC 27002 is an advisory standard that is meant to be interpreted and applied to all types and sizes of organization according to the particular information security risks they face. In practice, this flexibility gives users a lot of latitude to adopt the information security controls that make sense to them, but makes it unsuitable for the relatively straightforward compliance testing implicit in most formal certification schemes.

ISO/IEC 27001:2005 (Information technology – Security techniques – Information security management systems – Requirements) is a widely recognized certifiable standard. ISO/IEC 27001 specifies a number of firm requirements for establishing, implementing, maintaining and improving an ISMS, and in Annex A there is a suite of 133 information security controls that organizations are encouraged to adopt where appropriate within their ISMS. The controls in Annex A are derived from and aligned with ISO/IEC 27002. A new version of the standard is in draft; ISO/IEC 27001:2013.

Security certification remains rare. No national bank in the US is ISO-27001 certified. Google Apps has been ISO-27001 certified by Ernst & Young CertifyPoint, receiving certification #2012-001 on MAY 28, 2012.^[2] Google "has earned ISO 27001 certification for the systems, applications, people, technology, processes and data centers serving Google Apps for Business," specifically "GMail, Google Talk, Google Calendar, Google Docs (documents, spreadsheets, presentations), Google Sites, Google Control Panel (CPanel), Google Contacts, Google Video, Google Groups, Google Directory Sync," and Google's APIs for Provisioning, Single Sign On, Reporting and Audit.^[3] Texas.gov reports it complies with ISO-27002.^[4]

Ongoing development

Both ISO/IEC 27001:2005 and ISO/IEC 27002 are currently being revised by ISO/IEC JTC1/SC27. This is a routine activity every few years for ISO/IEC standards, in order to keep them current and relevant. It involves, for instance, incorporating references to other issued security standards (such as ISO/IEC 27000, ISO/IEC 27004 and ISO/IEC 27005) and various good security practices that have emerged in the field since they were last published. Due to the significant 'installed base' of organizations already using ISO/IEC 27002, particularly in relation to the information security controls supporting an ISMS that complies with ISO/IEC 27001, any changes have to be justified and, wherever possible, evolutionary rather than revolutionary in nature. The revised standards were published in 2013.

See also

• BS 7799, the original British Standard from which ISO/IEC 17799 and then ISO/IEC 27002 was derived
• ISO/IEC 27000-series
• IT baseline protection
• IT risk management
• List of ISO standards
• Sarbanes–Oxley Act
• Standard of Good Practice published by the Information Security Forum
• ISO/IEC JTC 1/SC 27 – IT Security techniques

References

External links

• The ISO 17799 Newsletter

ISO standards by standard number List of ISO standards / ISO romanizations / IEC standards 1–9999 1 2 3 4 5 6 7 9 16 31 -0 -1 -2 -3 -4 -5 -6 -7 -8 -9 -10 -11 -12 -13 128 216 217 226 228 233 259 269 302 306 428 518 519 639 -1 -2 -3 -5 -6 646 690 732 764 843 898 965 1000 1004 1007 1073-1 1413 1538 1745 1989 2014 2015 2022 2047 2108 2145 2146 2240 2281 2709 2711 2788 2852 3029 3103 3166 -1 -2 -3 3297 3307 3602 3864 3901 3977 4031 4157 4217 4909 5218 5428 5775 5776 5800 5964 6166 6344 6346 6385 6425 6429 6438 6523 6709 7001 7002 7098 7185 7200 7498 7736 7810 7811 7812 7813 7816 8000 8178 8217 8571 8583 8601 8632 8652 8691 8807 8820-5 8859 -1 -2 -3 -4 -5 -6 -7 -8 -8-I -9 -10 -11 -12 -13 -14 -15 -16 8879 9000/9001 9075 9126 9293 9241 9362 9407 9506 9529 9564 9594 9660 9897 9945 9984 9985 9995 10000–19999 10006 10116 10118-3 10160 10161 10165 10179 10206 10218 10303 -11 -21 -22 -28 -238 10383 10487 10585 10589 10646 10664 10746 10861 10957 10962 10967 11073 11170 11179 11404 11544 11783 11784 11785 11801 11898 11940 (-2) 11941 11941 (TR) 11992 12006 12182 12207 12234-2 13211 -1 -2 13216 13250 13399 13406-2 13407 13450 13485 13490 13567 13568 13584 13616 14000 14031 14224 14289 14396 14443 14496 -2 -3 -6 -10 -11 -12 -14 -17 -20 14644 -1 -2 -3 -4 -5 -6 -7 -8 -9 14649 14651 14698 -2 14750 14764 14882 14971 15022 15189 15288 15291 15292 15398 15408 15444 -3 15445 15438 15504 15511 15686 15693 15706 -2 15707 15897 15919 15924 15926 15926 WIP 15930 16023 16262 16612-2 16750 16949 (TS) 17024 17025 17203 17369 17799 18000 18004 18014 18245 18629 18916 19005 19011 19092 (-1 -2) 19114 19115 19125 19136 19439 19500 19501 19502 19503 19505 19506 19507 19508 19509 19510 19600 19752 19757 19770 19775-1 19794-5 19831 20000+ 20000 20022 20121 21000 21047 21500 21827:2002 22000 23270 23271 23360 24517 24613 24617 24707 25178 25964 26000 26300 26324 27000 series 27000 27001:2005 27001:2013 27002 27003 27004 27005 27006 27007 27729 27799 28000 29110 29148 29199-2 29500 30170 31000 32000 38500 40500 42010 80000 -1 -2 -3 -4 -5 -6 -7 -8 -9 -10 -11 -12 -13 -14 Categories ISO standards ISO 639 ISO 3166 ISO / IEC standards OSI protocols All articles with prefix "ISO"