Table Of Content||||||||||||||||||||
||||||||||||||||||||
||||||||||||||||||||
Implementing the
ISO/IEC 27001 ISMS Standard
Second Edition
||||||||||||||||||||
||||||||||||||||||||
For a complete listing of titles in the
Artech House Information Security and Privacy Series
turn to the back of this book.
||||||||||||||||||||
||||||||||||||||||||
Implementing the
ISO/IEC 27001 ISMS Standard
Second Edition
Edward Humphreys
||||||||||||||||||||
||||||||||||||||||||
Library of Congress Cataloging-in-Publication Data
A catalog record for this book is available from the U.S. Library of Congress.
British Library Cataloguing in Publication Data
A catalogue record for this book is available from the British Library.
Cover design by John Gomes
ISBN 13: 978-1-60807-930-8
© 2016 ARTECH HOUSE
685 Canton Street
Norwood, MA 02062
All rights reserved. Printed and bound in the United States of America. No part of this book
may be reproduced or utilized in any form or by any means, electronic or mechanical, includ-
ing photocopying, recording, or by any information storage and retrieval system, without per-
mission in writing from the publisher.
All terms mentioned in this book that are known to be trademarks or service marks have
been appropriately capitalized. Artech House cannot attest to the accuracy of this information.
Use of a term in this book should not be regarded as affecting the validity of any trademark or
service mark.
10 9 8 7 6 5 4 3 2 1
||||||||||||||||||||
||||||||||||||||||||
This book is dedicated to my father (Thomas Humphreys)
and to my mother (Alice Humphreys),
to my sons (Alexander, Thomas and James),
to my grandchildren (Siena, Juliet, Penelope and Georgia)
and last but not least to Angela Elizabeth
||||||||||||||||||||
||||||||||||||||||||
||||||||||||||||||||
||||||||||||||||||||
Contents
Acknowledgments xiii
Introduction xv
1 Information Security 1
1.1 The Importance of Being Informed 1
1.2 Globally Connected 3
1.3 More Ado About Risks 4
1.4 Decoding the Secret of Information Security Management 5
1.5 Management and Awareness 6
1.6 Legislation, Regulation and Governance 7
1.7 En Route to a Certified Business Environment 8
1.7.1 Processes 9
1.7.2 Controls 9
2 ISO/IEC 27001 ISMS Family 11
2.1 ISO/IEC Standardisation 11
2.1.1 Overview 11
2.1.2 ISO/IEC JTC 1/SC 27 12
2.2 Overview 12
2.2.1 International Standards 12
2.2.2 The 27001 ISMS Family 14
2.2.3 Standards Interrelated to 27001 ISMS Family 16
2.3 Evolution of the ISO/IEC 27000 Family 19
2.3.1 The Weakest Link 19
2.3.2 Baseline Controls 19
2.3.3 Formative Years—BS 7799 Part 1 and Part 2 20
2.3.4 Internationalization 21
2.4 Overview of ISO/IEC 27001: 2013 22
2.4.1 Introduction 22
2.4.2 ISMS Audience 23
2.4.3 Mandatory Statements 23
vii
||||||||||||||||||||
||||||||||||||||||||
viii Implementing the ISO/IEC 27001 ISMS Standard
2.4.4 Processes 23
2.4.5 ISMS Stages 23
2.4.6 Risk-Based Approach 24
2.4.7 Performance Evaluation 25
2.5 Second Edition of ISO/IEC 27002 25
2.5.1 Conformance with ISO/IEC 27002 25
2.5.2 Applying ISO/IEC 27002 26
3 ISMS Business Context 27
3.1 Organisational Context 27
3.1.1 Understanding the Business 27
3.1.2 Internal Issues and Context 28
3.1.3 External Issues and Context 29
3.2 Needs and Expectations 30
3.2.1 Interested Parties 30
3.2.2 Requirements Relevant to the ISMS 30
3.2.3 Gathering Requirements Relevant to the ISMS 34
3.3 ISMS Scope 35
3.3.1 What to Consider and What to Include 35
3.3.2 Object of ISMS Scope 36
3.3.3 Defining the ISMS Scope 37
3.3.4 Scope Example 37
3.3.5 External and Internal Connections 39
4 Managing the ISMS Risks 41
4.1 The Importance of Risk and Opportunity 41
4.1.1 Definition of Risk 41
4.1.2 Opportunity 42
4.1.3 Risk Attitude, Tolerance and Appetite 42
4.1.4 Information Security Risk Appetite and Tolerance 43
4.1.5 ISMS Risks 44
4.2 Risk Management Process 45
4.2.1 Changes in the Process 45
4.2.2 Risk Assessment 45
4.2.3 Risk Treatment 52
4.2.4 Determine the Controls 57
4.2.5 Statement of Applicability 58
4.2.6 Risk Treatment Plan 58
4.2.7 Risk Owners’ Duties 58
4.3 Ongoing Reassessment of Risk 58
4.3.1 Risk Reviews and Reassessments 58
4.3.2 Risk Monitoring 59
4.3.3 Updating the Risk Treatment 59
5 ISMS Leadership and Support 61
5.1 Management Policy 61
5.1.1 Approval, Communication and Awareness 62
||||||||||||||||||||
||||||||||||||||||||
viii Implementing the ISO/IEC 27001 ISMS Standard Contents ix
5.1.2 Policy Review 63
5.1.3 Management Policy Sets the Scene 63
5.2 Leadership 63
5.3 Roles and Responsibilities 64
5.4 Resources 65
5.5 Training and Awareness 66
5.5.1 When Should Training Take Place? 67
5.5.2 Training Methods 67
5.5.3 ISMS-Related Topics 68
6 Controls to Modify the Risks 71
6.1 Determining the Controls 71
6.1.1 Control Framework 71
6.1.2 Process of Determining a Control Set 72
6.1.3 Existing Control Sets 73
6.2 System of Controls 73
6.2.1 Control Framework 73
6.2.2 System of Controls 74
6.3 Policies and Procedures 76
6.3.1 General 76
6.3.2 Approval, Communications and Awareness 78
6.3.3 Review 78
6.4 Example controls 79
6.4.1 Overview 79
6.4.2 Acceptable Use Policy 79
6.4.3 Information Handling Policy and Procedures 82
6.4.4 Access Control Policy, Procedures and Processes 92
6.4.5 Human Resource Policies, Procedures and Processes 96
6.5 Sector-Specific Controls 98
6.6 Benchmarking with ISO/IEC 27001:2013 Annex A 100
7 ISMS Operations 101
7.1 Operational ISMS Procedures 101
7.1.1 General 101
7.1.2 Example Procedures 101
7.1.3 Training, Awareness and Usage 102
7.2 Ongoing Risk Management 103
7.3 Operational Threats 104
7.3.1 Malware 104
7.3.2 Unauthorised Access 106
7.3.3 Insider Threat 107
7.3.4 System Availability 109
7.3.5 Social Engineering 111
7.4 Operational Processes 112
7.4.1 Protecting Information in the Operational Environment 112
7.4.2 Backups 113
7.4.3 Capacity Planning 116
7.4.4 Change Management 117
||||||||||||||||||||
