ISO 27001:2005
Information Security Standard
A brief Overview
Information
Information is an asset which, like other important business assets, has value to an organization and consequently needs to be suitably protected. Printed or written on paper Stored electronically Transmitted by mail or electronic means Spoken in conversations
What is Information Security
ISO 27001 defines this as preservation of:
Achieving Information Security
4 Ps of Information Security
3 Basic Principles for ISMS
Confidentiality
Ensuring that information is accessible only to those authorised to have access. Safeguarding the accuracy and completeness of information and processing methods. Ensuring that authorised users have access to information and associated assets when required.
Integrity
Availability
ISMS Relationships
11 Domains of ISO27001
Procedural
Technical
Information Assets Physical Integrity
People
2006 IBM Corporation
11 Domains of ISO 27001
1.
2. 3.
Security Policy
Organization of Information Security Asset Management
4.
5. 6.
Human Resources Security
Physical & Environmental Security Access Control
7.
8. 9.
Communications & Operations Management
Information Systems acquisition, development and maintenance Compliance
10. Business Continuity Management
11. Information Security Incident management
What is ISO 27001?
International Standard for Information Security Management
Specifications for Information Security Management
Code of practice for Information Security Management Can be Certified by Certification Bodies Applicable to all industry sectors
ISO 27001 Drivers
Corporate Governance
Increased Risk Awareness Competition Customer Expectation
Market Expectation
Market Image Legislative drivers
Reasons for seeking Certification according to BSI-DISC Survey
Few Benefits of Compliance
Effective Controls of Information Security Market Differentiation Confidence to trading partners,stakeholders and
customers
ONLY standard with global acceptance
Legislative Compliance
ISO 27001:2005 PDCA
ISO 27001 can be..
Without genuine support from the top- a Failure
Without proper implementation-a burden With full support,proper implementation and
ongoing commitment a
major benefit
ISO 27001:2005 Information Security
GSDC certified against ISO/IEC 27001:2005 standard
- 27 April 2006
ITD GD completed the 1st Surveillance Audit March
2007
ITD GD is scheduled for the combined 2nd & 3rd
Surveillance Audit 24th to 26th March 2008
THANK YOU
