Focus Areas of ISO/IEC 27001:2013

Information security management system ISO 27001 (formerly known as ISO/IEC 27001:2005) specification (ISMS). The legal, physical, and technical controls involved in an organization’s information risk management processes are all part of an ISMS, which is a framework of rules and procedures. For the purpose of “providing a model for establishing, implementing, operating, monitoring, reviewing, maintaining and enhancing an information security management system,” ISO 27001 was created, according to its literature.

Technology-neutral and top-down, ISO 27001 follows a risk-based methodology. A six-step planning procedure is outlined in the specification:

• Define a security policy.
• Define the scope of the ISMS.
• Conduct a risk assessment.
• Manage identified risks.
• Select control objectives and controls to be implemented.
• Prepare a statement of applicability.

The specification includes details for documentation, management responsibility, internal audits, continual improvement, and corrective and preventive action. The standard requires cooperation among all sections of an organisation.

The 27001 standards does not mandate specific information security controls, but it provides a checklist of controls that should be considered in the accompanying code of practice, ISO/IEC 27002:2005. This second standard describes a comprehensive set of information security control objectives and a set of generally accepted good practice security controls.

ISO 27002 contains 12 main sections:

1. Risk assessment
2. Security policy
3. Organization of information security
4. Asset management
5. Human resources security
6. Physical and environmental security
7. Communications and operations management
8. Access control
9. Information systems acquisition, development and maintenance
10. Information security incident management
11. Business continuity management
12. Compliance

Organizations must implement these measures correctly in accordance with their unique risks. For ISO 27001 compliance, third-party recognized certification is advised. Organizations must implement these measures in a way that is appropriate for their particular risks. For compliance with ISO 27001, third-party authorized certification is advised.