In this article, we will talk a little bit about ISO 27001 and ISO 27002. You may already know that ISO 17799 is now ISO 27002. So we will first cover the Information Security Management System requirements (27001) and then the Code of Practice (27002).

Introduction

ISO/IEC 2700x is the growing family of Information Security related standards, published and maintained by the International Organization for Standardization (ISO). At the time being, the family is consisting of:

• ISO/IEC 27001 — Information security management systems — Requirements
• ISO/IEC 27002 — Code of practice for information security management
• ISO/IEC 27003 — Information security management system implementation guidance
• ISO/IEC 27004 — Information security management — Measurement
• ISO/IEC 27005 — Information security risk management
• ISO/IEC 27006 — Requirements for bodies providing audit and certification of information security management systems
• ISO/IEC 27011 — Information security management guidelines for telecommunications organizations based on ISO/IEC 27002
• ISO/IEC 27031 — Guidelines for information and communications technology readiness for business continuity
• ISO/IEC 27033-1 — Network security overview and concepts
• ISO/IEC 27035 — Security incident management
• ISO 27799 — Information security management in health using ISO/IEC 27002

The following standards are in preparation:

• ISO/IEC 27007 — Guidelines for information security management systems auditing (focused on the management system)
• ISO/IEC 27008 — Guidance for auditors on ISMS controls (focused on the information security controls)
• ISO/IEC 27013 — Guideline on the integrated implementation of ISO/IEC 20000-1 and ISO/IEC 27001
• ISO/IEC 27014 — Information security governance framework
• ISO/IEC 27015 — Information security management guidelines for the finance and insurance sectors
• ISO/IEC 27032 — Guideline for cybersecurity (essentially, 'being a good neighbor' on the Internet)
• ISO/IEC 27033 — IT network security, a multi-part standard based on ISO/IEC 18028:2006 (part 1 published already)
• ISO/IEC 27034 — Guideline for application security
• ISO/IEC 27036 — Guidelines for security of outsourcing
• ISO/IEC 27037 — Guidelines for identification, collection and/or acquisition and preservation of digital evidence