[{"@context":"http:\/\/schema.org\/","@type":"BlogPosting","@id":"https:\/\/wiki.edu.vn\/en\/wiki4\/iso-iec-27000-series-wikipedia\/#BlogPosting","mainEntityOfPage":"https:\/\/wiki.edu.vn\/en\/wiki4\/iso-iec-27000-series-wikipedia\/","headline":"ISO\/IEC 27000-series – Wikipedia","name":"ISO\/IEC 27000-series – Wikipedia","description":"From Wikipedia, the free encyclopedia Information security standards The ISO\/IEC 27000-series (also known as the ‘ISMS Family of Standards’ or","datePublished":"2016-03-25","dateModified":"2016-03-25","author":{"@type":"Person","@id":"https:\/\/wiki.edu.vn\/en\/wiki4\/author\/lordneo\/#Person","name":"lordneo","url":"https:\/\/wiki.edu.vn\/en\/wiki4\/author\/lordneo\/","image":{"@type":"ImageObject","@id":"https:\/\/secure.gravatar.com\/avatar\/c9645c498c9701c88b89b8537773dd7c?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/c9645c498c9701c88b89b8537773dd7c?s=96&d=mm&r=g","height":96,"width":96}},"publisher":{"@type":"Organization","name":"Enzyklop\u00e4die","logo":{"@type":"ImageObject","@id":"https:\/\/wiki.edu.vn\/wiki4\/wp-content\/uploads\/2023\/08\/download.jpg","url":"https:\/\/wiki.edu.vn\/wiki4\/wp-content\/uploads\/2023\/08\/download.jpg","width":600,"height":60}},"image":{"@type":"ImageObject","@id":"https:\/\/en.wikipedia.org\/wiki\/Special:CentralAutoLogin\/start?type=1x1","url":"https:\/\/en.wikipedia.org\/wiki\/Special:CentralAutoLogin\/start?type=1x1","height":"1","width":"1"},"url":"https:\/\/wiki.edu.vn\/en\/wiki4\/iso-iec-27000-series-wikipedia\/","wordCount":1871,"articleBody":"From Wikipedia, the free encyclopediaInformation security standardsThe ISO\/IEC 27000-series (also known as the ‘ISMS Family of Standards’ or ‘ISO27K’ for short) comprises information security standards published jointly by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC).[1]The series provides best practice recommendations on information security management\u2014the management of information risks through information security controls\u2014within the context of an overall Information security management system (ISMS), similar in design to management systems for quality assurance (the ISO 9000 series), environmental protection (the ISO 14000 series) and other management systems.[2][3]The series is deliberately broad in scope, covering more than just privacy, confidentiality and IT\/technical\/cybersecurity issues.  It is applicable to organizations of all shapes and sizes.  All organizations are encouraged to assess their information risks, then treat them (typically using information security controls) according to their needs, using the guidance and suggestions where relevant.  Given the dynamic nature of information risk and security, the ISMS concept incorporates continuous feedback and improvement activities to respond to changes in the threats, vulnerabilities or impacts of incidents.The standards are the product of ISO\/IEC JTC 1 (Joint Technical Committee 1) SC 27 (Subcommittee 27), an international body that meets in person (face-to-face or virtually) twice a year.The ISO\/IEC standards are sold directly by ISO, mostly in English, French and Chinese.  Sales outlets associated with various national standards bodies also sell directly translated versions in several languages.Table of ContentsEarly history[edit]Published standards[edit]In preparation[edit]See also[edit]References[edit]Early history[edit]Many people and organisations are involved in the development and maintenance of the ISO27K standards.  The first standard in this series was ISO\/IEC 17799:2000; this was a fast-tracking of the existing British standard BS\u00a07799 part 1:1999. The initial release of BS\u00a07799 was based, in part, on an information security policy manual developed by the Royal Dutch\/Shell Group in the late 1980s and early 1990s.  In 1993, what was then the Department of Trade and Industry (United Kingdom) convened a team to review existing practice in information security, with the goal of producing a standards document.  In 1995, the BSI Group published the first version of BS 7799.[4] One of the principal authors of BS 7799 recalls that, at the beginning of 1993, “The DTI decided to quickly assemble a group of industry representatives from seven different sectors: Shell ([David Lacey] and Les Riley), BOC Group (Neil Twist), BT (Dennis Willets), Marks & Spencer (Steve Jones), Midland Bank (Richard Hackworth), Nationwide (John Bowles) and Unilever (Rolf Moulton).”[5]  David Lacey credits the late Donn B. Parker as having the “original idea of establishing a set of information security controls”, and with producing a document containing a “collection of around a hundred baseline controls” by the late 1980s for “the I-4 Information Security circle[6] which he conceived and founded.Published standards[edit]The published ISO27K standards related to “information security, cybersecurity and privacy protection” are:ISO\/IEC 27000 \u2014 Information security management systems \u2014 Overview and vocabulary[7]ISO\/IEC 27001 \u2014 Information security, cybersecurity and privacy protection \u2014 Information security management systems \u2014 Requirements.[8] – specifies requirements for an information security management system in the same formalized, structured and succinct manner as other ISO standards specify other kinds of management systems.ISO\/IEC 27002 \u2014 Information security, cybersecurity and privacy protection \u2014 Information security controls  – essentially a detailed catalog of information security controls that might be managed through the ISMSISO\/IEC 27003 \u2014 Information security management system implementation guidanceISO\/IEC 27004 \u2014 Information security management \u2014 Monitoring, measurement, analysis and evaluation[9]ISO\/IEC 27005 \u2014 Guidance on managing information security risks[10]ISO\/IEC 27006 \u2014 Requirements for bodies providing audit and certification of information security management systemsISO\/IEC 27007 \u2014 Guidelines for information security management systems auditing (focused on auditing the management system)ISO\/IEC TR 27008 \u2014 Guidance for auditors on ISMS controls (focused on auditing the information security controls)ISO\/IEC 27009 \u2014 Information technology \u2014 Security techniques \u2014 Sector-specific application of ISO\/IEC 27001 \u2014 RequirementsISO\/IEC 27010 \u2014 Information security management for inter-sector and inter-organizational communicationsISO\/IEC 27011 \u2014 Information security management guidelines for telecommunications organizations based on ISO\/IEC 27002ISO\/IEC 27013 \u2014 Guideline on the integrated implementation of ISO\/IEC 27001 and ISO\/IEC 20000-1ISO\/IEC 27014 \u2014 Information security governance.[11](Mahncke assessed this standard in the context of Australian e-health.)[12]ISO\/IEC TR 27015 \u2014 Information security management guidelines for financial services (now withdrawn)[13]ISO\/IEC TR 27016 \u2014 information security economicsISO\/IEC 27017 \u2014 Code of practice for information security controls based on ISO\/IEC 27002 for cloud servicesISO\/IEC 27018 \u2014 Code of practice for protection of personally identifiable information (PII) in public clouds acting as PII processorsISO\/IEC 27019 \u2014 Information security for process control in the energy industryISO\/IEC 27021 \u2014 Competence requirements for information security management systems professionalsISO\/IEC TS 27022 \u2014 Guidance on information security management system processes \u2013 under development[14]ISO\/IEC TR 27023 \u2014 Mapping the revised editions of ISO\/IEC 27001 and ISO\/IEC 27002ISO\/IEC 27028 \u2014 Guidance on ISO\/IEC 27002 attributesISO\/IEC 27031 \u2014 Guidelines for information and communication technology readiness for business continuityISO\/IEC 27032 \u2014 Guideline for cybersecurityISO\/IEC 27033-1 \u2014 Network security \u2013 Part 1: Overview and conceptsISO\/IEC 27033-2 \u2014 Network security \u2013 Part 2: Guidelines for the design and implementation of network securityISO\/IEC 27033-3 \u2014 Network security \u2013 Part 3: Reference networking scenarios \u2014 Threats, design techniques and control issuesISO\/IEC 27033-4 \u2014 Network security \u2013 Part 4: Securing communications between networks using security gatewaysISO\/IEC 27033-5 \u2014 Network security \u2013 Part 5: Securing communications across networks using Virtual Private Networks (VPNs)ISO\/IEC 27033-6 \u2014 Network security \u2013 Part 6: Securing wireless IP network accessISO\/IEC 27033-7 \u2014 Network security \u2013 Part 7: Guidelines for network virtualization securityISO\/IEC 27034-1 \u2014 Application security \u2013 Part 1: Guideline for application securityISO\/IEC 27034-2 \u2014 Application security \u2013 Part 2: Organization normative frameworkISO\/IEC 27034-3 \u2014 Application security \u2013 Part 3: Application security management processISO\/IEC 27034-4 \u2014 Application security \u2013 Part 4: Validation and verification (under development)[15]ISO\/IEC 27034-5 \u2014 Application security \u2013 Part 5: Protocols and application security controls data structureISO\/IEC 27034-5-1 \u2014 Application security \u2014 Part 5-1: Protocols and application security controls data structure, XML schemasISO\/IEC 27034-6 \u2014 Application security \u2013 Part 6: Case studiesISO\/IEC 27034-7 \u2014 Application security \u2013 Part 7: Assurance prediction frameworkISO\/IEC 27035-1 \u2014 Information security incident management \u2013 Part 1: Principles of incident managementISO\/IEC 27035-2 \u2014 Information security incident management \u2013 Part 2: Guidelines to plan and prepare for incident responseISO\/IEC 27035-3 \u2014 Information security incident management \u2013 Part 3: Guidelines for ICT incident response operationsISO\/IEC 27035-4 \u2014 Information security incident management \u2013 Part 4: Coordination (under development)[16]ISO\/IEC 27036-1 \u2014 Information security for supplier relationships \u2013 Part 1: Overview and conceptsISO\/IEC 27036-2 \u2014 Information security for supplier relationships \u2013 Part 2: RequirementsISO\/IEC 27036-3 \u2014 Information security for supplier relationships \u2013 Part 3: Guidelines for information and communication technology supply chain securityISO\/IEC 27036-4 \u2014 Information security for supplier relationships \u2013 Part 4: Guidelines for security of cloud servicesISO\/IEC 27037 \u2014 Guidelines for identification, collection, acquisition and preservation of digital evidenceISO\/IEC 27038 \u2014 Specification for Digital redaction on Digital DocumentsISO\/IEC 27039 \u2014 Intrusion preventionISO\/IEC 27040 \u2014 Storage security[17]ISO\/IEC 27041 \u2014 Investigation assuranceISO\/IEC 27042 \u2014 Analyzing digital evidenceISO\/IEC 27043 \u2014 Incident investigationISO\/IEC 27050-1 \u2014 Electronic discovery \u2014 Part 1: Overview and conceptsISO\/IEC 27050-2 \u2014 Electronic discovery \u2014 Part 2: Guidance for governance and management of electronic discoveryISO\/IEC 27050-3 \u2014 Electronic discovery \u2014 Part 3: Code of practice for electronic discoveryISO\/IEC 27050-4 \u2014 Electronic discovery \u2014 Part 4: Technical readinessISO\/IEC TS 27110 \u2014 Information technology, cybersecurity and privacy protection \u2014 Cybersecurity framework development guidelines[18]ISO\/IEC 27557 \u2014 Information security, cybersecurity and privacy protection \u2014 Application of ISO 31000:2018 for organizational privacy risk management[19]ISO\/IEC 27701 \u2014 Information technology \u2014 Security Techniques \u2014 Information security management systems \u2014 Privacy Information Management System (PIMS).ISO 27799 \u2014 Information security management in health using ISO\/IEC 27002 (guides health industry organizations on how to protect personal health information using ISO\/IEC 27002)In preparation[edit]Further ISO27K standards are in preparation covering aspects such as digital forensics AI\/ML security and IoT security, while the released ISO27K standards are routinely reviewed and if appropriate updated every five years or so.See also[edit]References[edit]"},{"@context":"http:\/\/schema.org\/","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"https:\/\/wiki.edu.vn\/en\/wiki4\/#breadcrumbitem","name":"Enzyklop\u00e4die"}},{"@type":"ListItem","position":2,"item":{"@id":"https:\/\/wiki.edu.vn\/en\/wiki4\/iso-iec-27000-series-wikipedia\/#breadcrumbitem","name":"ISO\/IEC 27000-series – Wikipedia"}}]}]