Achieve ISO 27002 Compliance with Enterprise Compliance Management Solution
ISO/IEC 27002 is a code of practice for information security published together by the International Organization for Standardization (ISO) and by the International Electro technical Commission (IEC). Originally, a code of practice published by the UK government, it later evolved into a BSI standard (BS7799). When ISO/IEC adopted the British Standard,it became ISO/IEC 17799:2000. Revised in 2005 (ISO 17799:2005), it was renumbered (but otherwise unchanged) in 2007 (ISO 27002:2007) to align with the other ISO/IEC 27000-series standards.
Named as ‘Information technology – Security techniques – Code of practice for information security management’, it provides best practice recommendations on information security management for those enterprises that need to set up a comprehensive information security management program or enhance its current information security practices. Though ISO/IEC recommends enterprises to consider each of the security practices, it is not compulsory that each enterprise must implement every practice. Organizations need to implement only those practices that meet their requirements or address their information security risks.
The ISO 27002 standards provide “guidelines and general principles for initiating, implementing, maintaining, and improving information security management within an organization.” The objective of the ISO/IEC 27002 standards is to develop “organizational security standards and effective security management practices and to help build confidence in inter-organizational activities”.
The ISO/IEC 27002 standard contains the following twelve main sections:
- Risk Assessment
- Security Policy – management direction
- Organization of Information Security– governance of information security
- Asset Management – inventory and classification of information assets
- Human Resources Security– security aspects for employees joining, moving and leaving an organization
- Physical and Environmental Security– protection of the computer facilities
- Communications and Operations Management- management of technical security controls in systems and networks
- Access Control – restriction of access rights to networks, systems, applications, functions and data
- Information Systems Acquisition, Development and Maintenance– building security into applications
- Information Security Incident Management– anticipating and responding appropriately to information security breaches
- Business Continuity Management- protecting, maintaining and recovering business-critical processes and systems
- Compliance – ensuring conformance with information security policies, standards, laws and regulations
Today most of the business transactions happen online and therefore incidents of data breach is something that enterprises face regularly.Hence, enterprises must not only implement effective data security measures but also make others know about it. This can be easily done through ISO-27002 implementation.
ISO 27002 compliance helps enterprises in proving that information security practices are stringently followed and that their information is secure and in accordance with an internationally recognized standard. Hence, enterprises must deploy compliance management solution that has ready to use compliance control kits for ISO 27002 developed by security and compliance auditors with industry best practices.
Read more on – IT security and compliance, vendor management
Processing your request, Please wait....
