Information Security Management: THE ISO 27000 (ISO 27K) SERIES

By Sarah Higgins, Aberystwyth University 

Published: 19 March 2009

• Security Standards and Digital Curation
• The ISO/IEC 27000 Series
• Functionality
• Benefits
• Implementations
• Additional Resources
• Appendix

1. Security Standards and Digital Curation

The flexibility of digital information can be regarded as a great strength. As software and hardware develop, data can be created, accessed, edited, manipulated and shared with increasing ease, The corollary is that data is vulnerable to unauthorised access, alteration or manipulation, which without checks can easily go undetected, and undermine its authoritative nature. Successful digital curation ensures that data is managed and protected so that its authority is maintained and retained throughout the curation lifecycle.¹ To be authoritative data needs to remain authentic, reliable and useable, while retaining its integrity.² These characteristics of data can be preserved through the implementation of an effective Information Security Management Systems (ISMS). The policies, procedures, human and machine resources which constitute an ISMS should ensure that the CIA Triad — Confidentiality, Integrity and Availability — is maintained across an organisation's physical, personal and organisational layers. Confidentiality ensures that data is only available to those authorised to access it. Integrity ensures that data can only be altered by authorised persons. Availability demands that authorised persons can access data when they require.

2. The ISO/IEC 27000 Series

The ISO/IEC 27000 is a series of standards which, when used together, specify the complete implementation of an ISMS. The series is still under development, with four of the planned standards currently published. Work is progressing on the completion of the remainder of standards ISO/IEC 27000 to ISO/IEC 27010. These cover the fundamental requirements of an ISMS, are applicable to any domain, and can be applied to any organisation regardless of size, structure or aim. ISO/IEC numbers after this have been reserved for sector specific implementation guidelines, most of which are still at the planning or pre-draft stage. The appendix summarises the development of the series to date.

The core documents in the series are ISO/IEC 27001, which specifies the requirements for an ISMS, and ISO/IEC 27002, which establishes guidelines and principles for implementation. These standards are based on the Plan-Do-Check-Act (PDCA) model for continuous quality control and improvement.³ An ISMS can be audited against ISO/IEC 27001 and certified for compliancy. Third party certification is available from a number of accredited providers and normally lasts for 3 years. Support for improving an implementation is usually given throughout the certification period.

3. Functionality

ISO/IEC 27001 sets out the requirements for establishing, managing, documenting and continuously improving an ISMS using a risk management approach, which must be pre-defined by an organisation.⁴ Implementers are mandated to identify, analyse and evaluate risks and reduce these to an acceptable level. Contingencies for treating these risks are selected from over 130 controls defined by the standard. These cover a range of areas where information security could be compromised, and focus on the preparation of adequate policies and procedures, and documentation of processes. Controls include: security policy; staffing issues; equipment issues; access controls to both computing equipment and data; compliance with legal requirements and standards; acquisition, development and maintenance of the system; and management of business continuity. The controls are not exhaustive and they may be customised, or additional ones developed, for a specific implementation.

The standard also mandates that a compliant ISMS will: demonstrate management commitment through provision of resource, competent staff and training; undergo internal audit and management reviews; and undertake to continually improve effectiveness.

Mappings across the related management standards ISO 9001 and ISO 14001 are provided, to ensure consistency of approach across implementations.⁵

ISO/IEC 27002 gives practical implementation guidance and further information for each of the controls identified in ISO/IEC 27001. It contains guidance on how to select appropriate controls for an implementation, including those essential for legislative compliance and those required for best practice.

4. Benefits

Implementing or certifying an ISMS against ISO/IEC 2001 can bring a number of benefits to an organisation:

• Following a defined structured approach, with international recognition, can ensure that an ISMS is fit for purpose
• Information security issues, and how to mitigate associated risks, will be identified, managed monitored and improved in a planned manner
• Appropriate processes and procedures for information security management will be defined, documented and embedded in practice
• Demonstration of organisational commitment to information security, will ensure adequate allocation of resources, identification of roles and responsibilities and appropriate training
• Data will be protected against unauthorised access, demonstrating its authoritative nature, while authorised users will have access to data when they require it
• Continuity of an organisation's business will be effectively managed, improving its profile and increasing opportunities
• Intellectual property rights can be protected
• Independent verification of compliance with the standard can ensure that an organisation has not been negligent regarding appropriate laws on the privacy of personal information. In England and Wales the standard is recognised by the Information Commissioner as an appropriate source of advice for ensuring compliance with the Data Protection Act (1998).

5. Implementations

Organisations which have achieved ISO 27001 certification are detailed in the International Register of ISMS Certificates [external]. To date 5206 certificates have been granted worldwide. Nearly two-thirds of these are for Japanese organisations, due to a Japan Ministry of Economy, Trade and Industry (METI) requirement for companies working with government agencies to be certified. India and the UK have the next largest numbers of certificates with 8% and 7% of the total respectively. UK certified organisations represent a cross-section of the business community, and include the University of Gloucestershire, the Scottish Qualifications Authority, the General Medical Council, Liverpool City Council, the Royal Mail, the Royal Bank of Scotland and the Welsh Assembly Government.

6. Additional Resources

• The full text for all published ISO 27000 series standards is available for purchase online from the British Standards Institute [external] or the International Organization for Standardization [external]. Research libraries may have subscriptions to these organisations which enable registered users to download copies free. See appropriate staff at your institution or library.
• British Standards Institute ISO 27001 Information Security Pages [external] (accessed 16 March 2009)
• CTG, Using ISO 27001 to Your Advantage — slide presentation [external] (accessed 16 March 2009)
• International Register of ISMS Certificates [external]
• ISO/IEC 27001: Plain English Introduction [external] (accessed 16 March 2009)
• ISO 27001 Security Website [external] (accessed 16 March 2009)

¹ See the DCC Curation Lifecycle Model (accessed 12 March 2009). ² The characteristics of an authoritative record as defined by ISO 15489: Information and Documentation - Records Management. ³ Also known as the Deming Cycle or Shewhart Cycle. See more information on Wikipedia (accessed 12 March 2009). ⁴ ISO/IEC 27001 recommends, but does not mandate, the use of ISO/IEC 27005, Information Technology - Security Techniques - Information Security Risk Management for defining an organisation's risk management approach. ⁵ ISO 9001: Quality Management Systems - Requirements and ISO 14001: Environmental Management Systems - Requirements with Guidance for Use.

Appendix