Next Generation information security management system standard arrives

The standards which help businesses manage information security were first conceived at BSI, the business standards company, in the shape of BS 7799. The 2013 revision of the international standard will enable businesses of all sizes and sectors to accommodate the rapid evolution and increased complexity of managing information and the continual challenge that Cyber Security poses.

How business is carried out today differs vastly from the first use of BS 7799 in 1995, and technological advances mean that information security needs have also changed. The revisions will help further change perceptions amongst businesses that information security is limited to IT, and includes wider elements such as people. It also takes into account the interactions that can occur between other management system standards and issues such as Risk Management and Business Continuity Management.
 
ISO/IEC 27001 is one of the fastest growing management system standards used around the globe. The standard is used for third-party accredited certifications with at least 17,500 certificates having being issued in 100 countries with a continual trend of double digit growth year-on-year. Its use is supported by Code of Practice document ISO/IEC 27002. Both were developed through consensus of the international community with a membership of over 47 national standards bodies. 
 
Anne Hayes, Head of Market Development for Risk at BSI says,“Businesses need to avoid complacency with regard to Information Security and ensure that their practices are in line with today’s business environment. The rapid growth and pervasiveness of IT within the workplace, the rising awareness of the importance of cyber security means extra vigilance is needed and can now be better provided.”
 
ISO/IEC 27001 Information technology -- Security techniques -- Information security management systems – Requirements which specifies the requirements for establishing, implementing, maintaining and continually improving an information security management system.
 
Key changes to ISO/IEC 27001 requirements

• Modified to fit the new high-level structure used in all management system standards, simplifying its integration with other management systems
• Incorporates the feedback from users of the 2005 version and generically takes into account the changing technological landscape of the last 8 years

How businesses can benefit from ISO/IEC 27001 

• Increases reputation by belonging to large percentage of recognized global businesses who have implemented the standard
• Protects them by identifying risks and putting in controls to manage or reduce them•
• Helps gain stakeholder and customer trust that their data is protected
• Increases tender opportunities by demonstrating compliance and gaining status as a preferred supplier 

ISO/IEC 27002 Information technology -- Security techniques -- Code of practice for information security controls gives guidelines on how to use ISO/IEC 27001 for organizational information security standards and information security management.
 
Key changes to the ISO/IEC 27002 code of practice

• Modified to fit the new high-level structure used in all management system standards, simplifying its integration with other management systems
• Revised and simplified guidance to address new/existing Information Security needs

How businesses can benefit from ISO/IEC 27002

• Offers flexible set of controls to be used in the way an organization wants to protect itself (either stand-alone, with ISO/IEC 27001 or other methodologies) 
• Reflects the new threats an organization faces
   
  

Ultimately ISO/IEC 27001:2013 follows the high-level structure and text that will become accepted for all management system standards. For organizations that are already certified to ISO 27001:2005, BSI has a range of tools to help clients transition to the new standard. This includes training courses, transition guides, webinars and events.