ISO IEC 27001:2005 pdf download – Information technology — Security techniques — Information security management systems — Requirements.
1 Scope 1.1 General This International Standard covers all types of organizations (e.g. commercial enterprises, government agencies, not-for profit organizations). This International Standard specifies the requirements for establishing, implementing, operating, monitoring, reviewing, maintaining and improving a documented ISMS within the context of the organization’s overall business risks. It specifies requirements for the implementation of security controls customized to the needs of individual organizations or parts thereof. The ISMS is designed to ensure the selection of adequate and proportionate security controls that protect information assets and give confidence to interested parties. NOTE 1: References to ‘business’ in this International Standard should be interpreted broadly to mean those activities that are core to the purposes for the organization’s existence. NOTE 2: ISO/IEC 17799 provides implementation guidance that can be used when designing controls. 1.2 Application The requirements set out in this International Standard are generic and are intended to be applicable to all organizations, regardless of type, size and nature. Excluding any of the requirements specified in Clauses 4, 5, 6, 7, and 8 is not acceptable when an organization claims conformity to this International Standard. Any exclusion of controls found to be necessary to satisfy the risk acceptance criteria needs to be justified and evidence needs to be provided that the associated risks have been accepted by accountable persons. Where any controls are excluded, claims of conformity to this International Standard are not acceptable unless such exclusions do not affect the organization’s ability, and/or responsibility, to provide information security that meets the security requirements determined by risk assessment and applicable regulatory requirements. NOTE: If an organization already has an operative business process management system
4.2 Establishing and managing the ISMS 4.2.1 Establish the ISMS The organization shall do the following. a) Define the scope and boundaries of the ISMS in terms of the characteristics of the business, the organization, its location, assets, technology, and including details of and justification for any exclusions from the scope (see 1.2). b) Define an ISMS policy in terms of the characteristics of the business, the organization, its location, assets and technology that: 1) includes a framework for setting objectives and establishes an overall sense of direction and principles for action with regard to information security; 2) takes into account business and legal or regulatory requirements, and contractual security obligations; 3) aligns with the organization’s strategic risk management context in which the establishment and maintenance of the ISMS will take place; 4) establishes criteria against which risk will be evaluated (see 4.2.1c)); 5) has been approved by management. NOTE: For the purposes of this International Standard, the ISMS policy is considered as a superset of the information security policy. These policies can be described in one document.
c) Define the risk assessment approach of the organization. 1) Identify a risk assessment methodology that is suited to the ISMS, and the identified business information security, legal and regulatory requirements. 2) Develop criteria for accepting risks and identify the acceptable levels of risk. (see 5.1f)). The risk assessment methodology selected shall ensure that risk assessments produce comparable and reproducible results. NOTE: There are different methodologies for risk assessment. Examples of risk assessment methodologies are discussed in ISO/IEC TR 13335-3, Information technology — Guidelines for the management of IT Security — Techniques for the management of IT Security. d) Identify the risks. 1) Identify the assets within the scope of the ISMS, and the owners 2) of these assets. 2) Identify the threats to those assets. 3) Identify the vulnerabilities that might be exploited by the threats. 4) Identify the impacts that losses of confidentiality, integrity and availability may have on the assets.