ISO 27001

ISO/IEC 27001 was established as the substitute of BS 7799 and was called BS 7799 part 2 in 1999. This standard was revised in 2002 by BSI explicitly incorporating Demings Plan  Do Check Action cyclic process and was adopted by ISO/IEC in 2005.

ISO/IEC 27001:2005 has several requirements which includes establishment, implementation, monitoring and review, maintenance, and improvement of a management system. This set of requirements allows the organization to manage and control the information security risk of the organization.

This standard can be applied in all type of organizations (e.g commercial enterprises, government agencies, and non-profit organizations) and all sizes from micro-businesses to huge multinationals organizations.

Sustainability and continual improvement cannot be separated with the management of information security. According to JTC1/SC27, which is the committe responsible for ISO 27000, ISO/IEC 27001 is intended to be suitable for several different types of use which include:

• Formulation of security’s requirements and objectives
• Ensure cost management for security risks
• Ensure compliance with laws and regulations
• Used as a process framework for the implementation and management of controls to ensure specific security objectives will be achieved.
• Definition of new information security management processes
• Identification and clarification of existing information security management processes
• Determination of the status of information security management activities
• Implementation of a business enabling information security