[Day 3] 8. International Organisation for Standardisation (ISO) 27001

Origin:

• ISO 27001 evolved from BS 7799 (British Standard), which initially had two parts:
  • Part 1: Guidelines for information security management.
  • Part 2: Specification for an Information Security Management System (ISMS).
• Part 2 of BS 7799 was later adopted as an international standard and renamed ISO 27001.

Complementary Standards:

• ISO 27002: Provides best practices for implementing the controls outlined in ISO 27001.
• Unlike ISO 27001, ISO 27002 is not certifiable and serves as a guideline to help organisations strengthen their information security.

---

Purpose of ISO 27001

• Why is it implemented?

  • To protect the confidentiality, integrity, and availability (CIA) of an organisation’s information.
  • To safeguard information assets from threats and vulnerabilities.
  • To ensure a structured approach for managing sensitive information and reducing risks effectively.

• Key Objectives:

  • Establish, implement, monitor, and continuously improve an Information Security Management System (ISMS).
  • Provide confidence to stakeholders, customers, and regulators regarding the organisation's commitment to information security.

---

Updates to ISO 27001

• ISO 27001 is reviewed and updated approximately every 5 years to ensure relevance with emerging security challenges.
• The latest version is ISO 27001:2022.
• The official document is priced at ₹12,336 INR (approx.).

---

Information Security Management System (ISMS)

• Definition: A systematic approach to managing and securing sensitive company information.

• Role Hierarchy in ISMS Implementation:

  • The CEO is at the top of the hierarchy, with responsibilities delegated to other roles like:
    • CISO (Chief Information Security Officer) or CSO (Chief Security Officer)
    • Director (Information Security)
    • Infosec Manager
    • General Manager (Infosec) managing teams like:
      • Risk Assessment Team
      • Audit Team
  • Other departments with specific responsibilities may also exist depending on the organization's structure.

• Risk Assessment Types:

  1. Qualitative: Focuses on subjective assessment (e.g., ranking risks as high, medium, or low).
  2. Quantitative: Uses numerical and statistical methods to calculate risks.

---

Annexure A in ISO 27001

• Annex A provides a set of 93 controls

• These controls address areas like:

  • Information Security Policies
  • Access Control
  • Physical Security
  • Incident Management
  • Communication Security
  • Supplier Relationships
  • And more.

• Purpose: Helps organisations ensure they are implementing robust controls for protecting information assets.

---

Statement of Applicability (SOA) in ISO 27001

• What is SOA?
  • The Statement of Applicability (SOA) is a document that lists all the controls chosen from Annex A of ISO 27001, along with justifications for:
    • Why each control is included or excluded.
    • How each control is implemented.
  • It is a critical part of the ISO 27001 certification process, demonstrating compliance with the standard.

---

Key Difference Between ISO 27001 and ISO 27002

• ISO 27001:

  • Certifiable standard.
  • Focuses on implementing an ISMS and mandates compliance with specific requirements.

• ISO 27002:

  • Provides guidelines and best practices for security controls.
  • Not certifiable; no audits are conducted for compliance.

---