The Full Wiki

More info on ISO/IEC 27000-series

ISO/IEC 27000-series: Wikis


Note: Many of our articles have direct quotes from sources you can cite, within the Wikipedia article! This article doesn't yet, but we're working on it! See more info or our list of citable articles.


From Wikipedia, the free encyclopedia

The ISO/IEC 27000-series (also known as the 'ISMS Family of Standards' or 'ISO27k' for short) comprises information security standards published jointly by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC).

The series provides best practice recommendations on information security management, risks and controls within the context of an overall Information Security Management System (ISMS), similar in design to management systems for quality assurance (the ISO 9000 series) and environmental protection (the ISO 14000 series).

The series is deliberately broad in scope, covering more than just privacy, confidentiality and IT or technical security issues. It is applicable to organizations of all shapes and sizes. All organizations are encouraged to assess their information security risks, then implement appropriate information security controls according to their needs, using the guidance and suggestions where relevant. Given the dynamic nature of information security, the ISMS concept incorporates continuous feedback and improvement activities, summarized by Deming's "plan-do-check-act" approach, that seek to address changes in the threats, vulnerabilities or impacts of information security incidents.

The standards are the product of ISO/IEC JTC1 (Joint Technical Committee 1) SC27 (Sub Committee 27), an international body that meets in person twice a year.

At present, six of the standards in the series are publicly available while several more are under development.


Published standards

  • ISO/IEC 27000 — Information security management systems — Overview and vocabulary [1]
  • ISO/IEC 27001 — Information security management systems — Requirements
  • ISO/IEC 27002 — Code of practice for information security management
  • ISO/IEC 27003 — Information security management system implementation guidance
  • ISO/IEC 27004 — Information security management — Measurement
  • ISO/IEC 27005 — Information security risk management
  • ISO/IEC 27006 — Requirements for bodies providing audit and certification of information security management systems
  • ISO/IEC 27011 — Information security management guidelines for telecommunications organizations based on ISO/IEC 27002

In preparation

  • ISO/IEC 27007 - Guidelines for information security management systems auditing
  • ISO/IEC 27008 - a guideline for Information Security Management auditing (focusing on the security controls)
  • ISO/IEC 27013 - a guideline on the integrated implementation of ISO/IEC 20000-1 and ISO/IEC 27001
  • ISO/IEC 27014 - an information security governance framework
  • ISO/IEC 27015 - information security management guidelines for the finance and insurance sectors
  • ISO/IEC 27031 - a guideline for ICT readiness for business continuity (essentially the ICT continuity component within business continuity management)
  • ISO/IEC 27032 - a guideline for cybersecurity (essentially, 'being a good neighbor' on the Internet)
  • ISO/IEC 27033 - IT network security, a multi-part standard based on ISO/IEC 18028:2006
  • ISO/IEC 27034 - a guideline for application security

See also

External links

Got something to say? Make a comment.
Your name
Your email address