Contents 1 How the standard works 2 The PDCA Cycle 3 History of ISO/IEC 27001 4 Certification 5 ISO 27001:2005 Domains 5.1 Asset Management 5.1.1 Asset Register 5.1.2 Asset Classification 5.1.3 Asset Labeling 5.2 Access Control 5.2.1 User Registration 5.2.2 Password Management 5.2.3 Clear Work Environment 5.2.4 Operating System & Application Control 5.2.5 Network Security 6 Structure of the standard 7 Changes from the 2005 standard 8 Controls 9 See also 10 References 11 External links

How the standard works[edit] This section does not cite any sources. Please help improve this section by adding citations to reliable sources. Unsourced material may be challenged and removed. (February 2012) (Learn how and when to remove this template message) Most organizations have a number of information security controls. However, without an information security management system (ISMS), controls tend to be somewhat disorganized and disjointed, having been implemented often as point solutions to specific situations or simply as a matter of convention. Security controls in operation typically address certain aspects of IT or data security specifically; leaving non-IT information assets (such as paperwork and proprietary knowledge) less protected on the whole. Moreover, business continuity planning and physical security may be managed quite independently of IT or information security while Human Resources practices may make little reference to the need to define and assign information security roles and responsibilities throughout the organization. ISO/IEC 27001 requires that management: Systematically examine the organization's information security risks, taking account of the threats, vulnerabilities, and impacts; Design and implement a coherent and comprehensive suite of information security controls and/or other forms of risk treatment (such as risk avoidance or risk transfer) to address those risks that are deemed unacceptable; and Adopt an overarching management process to ensure that the information security controls continue to meet the organization's information security needs on an ongoing basis. Technical security controls such as antivirus and firewalls are not normally audited in ISO/IEC 27001 certification audits: the organization is essentially presumed to have adopted all necessary information security controls since the overall ISMS is in place and is deemed adequate by satisfying the requirements of ISO/IEC 27001. Management determines the scope of the ISMS for certification purposes and may limit it to, say, a single business unit or location. The ISO/IEC 27001 certificate does not necessarily mean the remainder of the organization, outside the scoped area, has an adequate approach to information security management. Other standards in the ISO/IEC 27000 family of standards provide additional guidance on certain aspects of designing, implementing and operating an ISMS, for example on information security risk management (ISO/IEC 27005).

The PDCA Cycle[edit] The PDCA cycle[3] The 2002 version of BS 7799-2 introduced the Plan-Do-Check-Act (PDCA) cycle (Deming cycle), aligning it with quality standards such as ISO 9000. 27001:2005 applies this to all the processes in ISMS. Plan (establishing the ISMS) Establish the policy, the ISMS objectives, processes and procedures related to risk management and the improvement of information security to provide results in line with the global policies and objectives of the organization. Do (implementing and workings of the ISMS) Implement and exploit the ISMS policy, controls, processes and procedures. Check (monitoring and review of the ISMS) Assess and, if applicable, measure the performances of the processes against the policy, objectives and practical experience and report results to management for review. Act (update and improvement of the ISMS) Undertake corrective and preventive actions, on the basis of the results of the ISMS internal audit and management review, or other relevant information to continually improve the said system. ISO 27001:2013 does not put so much emphasis on this cycle.

History of ISO/IEC 27001[edit] BS 7799 was a standard originally published by BSI Group[4] in 1995. It was written by the United Kingdom Government's Department of Trade and Industry (DTI), and consisted of several parts. The first part, containing the best practices for information security management, was revised in 1998; after a lengthy discussion in the worldwide standards bodies, it was eventually adopted by ISO as ISO/IEC 17799, "Information Technology - Code of practice for information security management." in 2000. ISO/IEC 17799 was then revised in June 2005 and finally incorporated in the ISO 27000 series of standards as ISO/IEC 27002 in July 2007. The second part of BS7799 was first published by BSI in 1999, known as BS 7799 Part 2, titled "Information Security Management Systems - Specification with guidance for use." BS 7799-2 focused on how to implement an Information security management system (ISMS), referring to the information security management structure and controls identified in BS 7799-2. This later became ISO/IEC 27001:2005. BS 7799 Part 2 was adopted by ISO as ISO/IEC 27001 in November 2005. BS 7799 Part 3 was published in 2005, covering risk analysis and management. It aligns with ISO/IEC 27001:2005.

Certification[edit] An ISMS may be certified compliant with ISO/IEC 27001 by a number of Accredited Registrars worldwide. Certification against any of the recognized national variants of ISO/IEC 27001 (e.g. JIS Q 27001, the Japanese version) by an accredited certification body is functionally equivalent to certification against ISO/IEC 27001 itself. In some countries, the bodies that verify conformity of management systems to specified standards are called "certification bodies", while in others they are commonly referred to as "registration bodies", "assessment and registration bodies", "certification/ registration bodies", and sometimes "registrars". The ISO/IEC 27001 certification,[5] like other ISO management system certifications, usually involves a three-stage external audit process defined by the ISO/IEC 17021[6] and ISO/IEC 27006[7] standards: Stage 1 is a preliminary, informal review of the ISMS, for example checking the existence and completeness of key documentation such as the organization's information security policy, Statement of Applicability (SoA) and Risk Treatment Plan (RTP). This stage serves to familiarize the auditors with the organization and vice versa. Stage 2 is a more detailed and formal compliance audit, independently testing the ISMS against the requirements specified in ISO/IEC 27001. The auditors will seek evidence to confirm that the management system has been properly designed and implemented, and is in fact in operation (for example by confirming that a security committee or similar management body meets regularly to oversee the ISMS). Certification audits are usually conducted by ISO/IEC 27001 Lead Auditors. Passing this stage results in the ISMS being certified compliant with ISO/IEC 27001. Ongoing involves follow-up reviews or audits to confirm that the organization remains in compliance with the standard. Certification maintenance requires periodic re-assessment audits to confirm that the ISMS continues to operate as specified and intended. These should happen at least annually but (by agreement with management) are often conducted more frequently, particularly while the ISMS is still maturing.

ISO 27001:2005 Domains[edit] Asset Management[edit] Asset Management Components The asset register documents the assets of the company or scope in question. The asset management domain deals with analyzing and attaining the necessary level of protection of organizational assets. The typical objectives of the asset management domain is to identify and create an inventory of all assets, establish an ownership on all assets identified, establish a set of rules for the acceptable use of assets, establish a framework for classification of assets, establish an asset labeling and handling guideline. Asset management, broadly defined, refers to any system that monitors and maintains things of value to an entity or group. It may apply to both tangible assets such as buildings and to intangible concepts such as intellectual property and goodwill. An asset is anything that has value to the organization. Assets can include infrastructure (e.g. buildings, store houses, towers etc.), physical assets (computer equipment, communications, utility equipment, heavy machinery), software assets (applications, software code, development tools, operational software etc.), information (database information, legal documentation, manuals, policies & procedures, organizational documents etc.), services (transport, air conditioning, communications, utilities etc.), people (management, skills, experience etc.) and imperceptible (reputation, image etc.). Also consider the assets which have been shared by the client (client related documents, H/w, S/w). Asset management is a systematic process of operating, maintaining, upgrading, and disposing of assets cost-effectively. Organizations need to identify all assets and create and maintain security controls around them. For each asset, a designated owner (any team, designation) needs to be identified (it's better to avoid using a person's name) who will be responsible for implementation of appropriate security controls. When creating an asset management policy, the organization needs to define the scope of the policy (which parts of the organization are covered under the policy), responsibility (who is ultimately responsible for the policy), compliance (is compliance mandatory or not, what are the guidelines to follow), waiver criteria (on what basis can someone ask for a waiver) and effective date (from when to when is the policy applicable). Typical policy statements for Asset Management include: All assets shall be clearly identified, documented and regularly (define the periodicity) updated in an asset register All assets shall have designated owners and custodians listed in the asset register All assets will have the respective CIA (Confidentiality, Integrity and Availability) rating established in the asset register All employees shall use company assets according to the acceptable use of assets procedures All assets shall be classified according to the asset classification guideline of the company Asset Register[edit] Typically all business functions are required to maintain an asset register of their business units. The asset register is required to contain, at a minimum, the following information about the assets: the asset identifier, the asset name, the type and location of assets; the name of the function and process that uses this asset, the asset owner, custodian and user and the CIA (Confidentiality, Integrity, Availability) ratings of the asset. Organizations can choose to include additional information in the asset register as deemed necessary; for example, IT assets can have IP addresses as part of the asset register. For all asset registers, a primary person responsible for the asset register needs to be identified. Typically the business unit head or director is the owner of the asset register and recognized functional heads identified are asset custodians. The asset owner is accountable for the comprehensive protection of assets owned by him/her. The asset owner may delegate the responsibility of applying the relevant controls for the maintenance of the assets to an individual/ function referred to as the ‘asset custodian’. It is the responsibility of the asset custodian to implement appropriate security controls that are required for the protection of information assets. It is the responsibility of all employees and third party staff to maintain the confidentiality, integrity and availability of the assets that they use. Asset Classification[edit] Assets need to be classified in order to provide an appropriate level of protection for a certain category of assets. Information assets need to be classified in terms of its value, requirements and criticality to the business operations of the company. Typical company classification guidelines follow restrictive principles. Asset Labeling[edit] All important and critical assets to the company shall be labeled physically / electronically as per the information labeling and handling procedures of the company. The asset owners are required to ensure that their assets are appropriately labeled (marked) for ease of identification. This may exclude information classified as ‘public’. For each classification level, the handling procedures should include the assets introduction; secure processing, storage; transmission and destruction. Classification level must be indicated wherever possible for all forms of physical / electronic information that are sensitive in nature. For example: subject of email stamped with "Confidential" etc. Access Control[edit] The access control domain deals with implementation of access controls across all electronic forms of information processing systems like operating systems, applications, networks or mobile platforms. Access control is the selective restriction of access to a place or other resource. Typically an organization's access control policy establishes the requirement of controls that need to be implemented for controlling access to information, information processing facilities and business processes on the basis of business and security requirements. The policy should aim to control the assimilation, authorization, and dissemination of information in a controlled manner. The typical organizational objectives of the access control policy are to establish a procedure for user registration and de-registration, establish a procedure to grant the correct level of access privilege, establish a procedure to control password use, password change and password removal, establish a procedure for managements review of access rights, establish a procedure for unattended equipment, maintain a clear desk policy, establish a procedure to control network service access, establish a control method for authentication of remote users, establish a procedure for configuration ports, establish a procedure to segregate networks, establish a procedure to use precise routing controls, establish a procedure to control system utilities and to establish a procedure to secure communications over mobile computing devices. User Registration[edit] A registered user is one who uses an information processing facility and provides his/her credentials, effectively proving his/her identity. Generally speaking, any person can become a registered user by providing some credentials, usually in the form of a username (or email) and password. After that, one can access information and privileges unavailable to non-registered users, usually referred to simply as guests. The action of providing the proper credentials for a system is called logging in, or signing in. Without proper policies to govern user registration, unauthorized people can gain access to confidential company information and leak it out causing harm to the organization economic status and repute. Organizations need to establish a user registration procedure which shall include controls for operating systems and applications access. Typical policy statements can include: All users shall have a unique user ID based on a standard naming convention A formal authorization process shall be defined and followed for provisioning of user IDs. An audit trail shall be kept of all requests to add, modify or delete user accounts/IDs User accounts shall be reviewed at regular intervals Employee shall sign a privilege form acknowledging their access rights Access rights will be revoked for employee changes or leaving jobs Privileges shall be allocated to individuals on a ‘need-to-have’ basis. A record of all privilege accounts shall be maintained and updated on regular basis Password Management[edit] The password management deals with allocation, regulation and change of password rules of the organization. Organizations face significant security exposure in the course of routine IT operations. For example, dozens of system administrators may share passwords for privileged accounts on thousands of devices. When system administrators move on, the passwords they used during their work often remain unchanged, leaving organizations vulnerable to attack by former employees and contractors. Weak password management means that the most sensitive passwords are often the least well defended. The need to coordinate password updates among multiple people and programs makes changing the most sensitive passwords technically difficult. Inability to secure sensitive passwords exposes organizations to a variety of security exploits. Strong, manual controls over access to privileged accounts may sometimes create unanticipated risks, such as impaired service in IT operations and escalation of physical disasters from one site to an entire organization. Inability to associate administrative actions with the people who initiated them may violate internal control requirements. Clear Work Environment[edit] The clear work environment can go a long way in securing the organizations security situation. Most important organizational documents are generally lying around on employee’s desks open to all individuals within the company. The main reasons for a clean desk policy are manifold including: a clean desk can produce a positive image when our customers visit the company; it reduces the threat of a security incident as confidential information will be locked away when unattended, sensitive documents left in the open can be stolen by a malicious entity. Example of clear work environment policies include: Critical information shall be protected when not required for use Only authorized users shall use the photocopier machines All loose documents from employee’s desks shall be confiscated at the end of business day A users desktop shall not contain reference to any document directly or indirectly Operating System & Application Control[edit] Management of configurable security controls that are built into the operating system or application. In the scope of the ISMS framework, objective is to ensure system / application security settings are restrictive enough to protect the system (information) whilst not adversely impacting availability to the business (end user). If an attacker can easily view someone's username and password, he can impersonate that user, and do massive damage by modifying critical information, read corporate emails, damage corporate websites etc. The procedure to log into an operating system or application control should minimize the risk of unauthorized access. The procedure shall therefore follow a strict set of rules to govern what information is displayed to the potential user during the process of log-in. Sample operating system and application control policies include: All users in the organization shall have a unique ID No systems or application details shall be displayed before log-in In the condition of log-in failure, the error message shall not indicate which part of the credential is incorrect The number of unsuccessful log-in attempts shall be limited to 3/5/6 attempts During log-in process, all password entries shall be hidden by a symbol The use of system utility program shall be restricted e.g. password utility All operating systems and application shall time out due to inactivity in 5/10/15/30 minutes All applications shall have dedicated administrative menus to control access rights of users Network Security[edit] Network security assumes importance to the organization when viewed in light that networks change frequently as new users and devices are added and newer data communication technologies are introduced, usage of various networking, communications, and computing technologies to effectively meet the expanding need, sensitive data is increasingly transmitted over networks, proliferation of internet access has increased the vulnerability as employees use internet more for information and knowledge. The primary objectives of a network security policy should be to ensure that access to company’s network is only provided to authorized users, that adequate controls are in place to manage remote users, that all equipment can be recognized uniquely, that networks should be segregated based on needs, and that appropriate network routing protocols are enabled. Typical policy statements for Network Security include: Appropriate authentication mechanisms shall be used to control the access by remote users. Allocation of network access rights shall be provided as per the business and security requirements Two-factor authentication shall be used for authenticating users using mobile/remote systems

Structure of the standard[edit] The official title of the standard is "Information technology — Security techniques — Information security management systems — Requirements" ISO/IEC 27001:2013 has ten short clauses, plus a long annex, which cover: 1. Scope of the standard 2. How the document is referenced 3. Reuse of the terms and definitions in ISO/IEC 27000 4. Organizational context and stakeholders 5. Information security leadership and high-level support for policy 6. Planning an information security management system; risk assessment; risk treatment 7. Supporting an information security management system 8. Making an information security management system operational 9. Reviewing the system's performance 10. Corrective action Annex A: List of controls and their objectives This structure mirrors other management standards such as ISO 22301 (business continuity management);[8] this helps organizations comply with multiple management systems standards if they wish.[9] Annexes B and C of 27001:2005 have been removed.[10]

Changes from the 2005 standard[edit] The 2013 standard puts more emphasis on measuring and evaluating how well an organization's ISMS is performing,[11] and there is a new section on outsourcing, which reflects the fact that many organizations rely on third parties to provide some aspects of IT.[12] It does not emphasize the Plan-Do-Check-Act cycle that 27001:2005 did. Other continuous improvement processes like Six Sigma's DMAIC method can be implemented.[13] More attention is paid to the organizational context of information security, and risk assessment has changed.[14] Overall, 27001:2013 is designed to fit better alongside other management standards such as ISO 9000 and ISO/IEC 20000, and it has more in common with them.[15] New controls: A.6.1.5 Information security in project management A.12.6.2 Restrictions on software installation A.14.2.1 Secure development policy A.14.2.5 Secure system engineering principles A.14.2.6 Secure development environment A.14.2.8 System security testing A.15.1.1 Information security policy for supplier relationships A.15.1.3 Information and communication technology supply chain A.16.1.4 Assessment of and decision on information security events A.16.1.5 Response to information security incidents A.17.2.1 Availability of information processing facilities

Controls[edit] Clause 6.1.3 describes how an organization can respond to risks with a risk treatment plan; an important part of this is choosing appropriate controls. A very important change in the new version of ISO 27001 is that there is now no requirement to use the Annex A controls to manage the information security risks. The previous version insisted ("shall") that controls identified in the risk assessment to manage the risks must have been selected from Annex A. Thus almost every risk assessment ever completed under the old version of ISO 27001 used Annex A controls but an increasing number of risk assessments in the new version do not use Annex A as the control set. This enables the risk assessment to be simpler and much more meaningful to the organization and helps considerably with establishing a proper sense of ownership of both the risks and controls. This is the main reason for this change in the new version. There are now 114 controls in 14 groups and 35 control objectives; the 2005 standard had 133 controls in 11 groups.[16] A.5: Information security policies (2 controls) A.6: Organization of information security (7 controls) A.7: Human resource security - 6 controls that are applied before, during, or after employment A.8: Asset management (10 controls) A.9: Access control (14 controls) A.10: Cryptography (2 controls) A.11: Physical and environmental security (15 controls) A.12: Operations security (14 controls) A.13: Communications security (7 controls) A.14: System acquisition, development and maintenance (13 controls) A.15: Supplier relationships (5 controls) A.16: Information security incident management (7 controls) A.17: Information security aspects of business continuity management (4 controls) A.18: Compliance; with internal requirements, such as policies, and with external requirements, such as laws (8 controls) The new and updated controls reflect changes to technology affecting many organizations - for instance, cloud computing - but as stated above it is possible to use and be certified to ISO/IEC 27001:2013 and not use any of these controls.[9]

See also[edit] ISO/IEC JTC 1/SC 27 - IT Security techniques ISO/IEC 15408 ISO/IEC 27000-series ISO 9001 BS 7799 Cyber security standards International Organization for Standardization List of ISO standards Standard of Good Practice published by the Information Security Forum

References[edit] ^ "ISO/IEC 27001:2013 - Information technology -- Security techniques -- Information security management systems -- Requirements". International Organization for Standardization. Retrieved 20 May 2017.  ^ "ISO - ISO Standards - ISO/IEC JTC 1/SC 27 - IT Security techniques". International Organization for Standardization. Retrieved 20 May 2017.  ^ "Taking the First Step with PDCA". 2 February 2009. Retrieved 17 March 2011.  ^ "Facts and figures".  ^ The ISO/IEC 27001 Certification Process. ^ ISO/IEC 17021. ^ ISO/IEC 27006. ^ Zhou, James (March 2011). "ISO 27001 Information Security Management". Nanyang Technological University. Retrieved 20 May 2017.  ^ a b Breslin, Paul (14 March 2014). "Security updates: The upcoming revision of ISO/IEC 27001". DNV Business Assurance. Retrieved 20 May 2017.  ^ "ISO/IEC 27001:2013(en) Table of Contents". ISO. Retrieved 20 May 2017.  ^ Herbert, Chantall (3 June 2014). "More changes ahead…..ISO 27001:2005 Information Security Management Standard". QSL. Retrieved 20 May 2017.  ^ "ISO 27001 update is around the corner". British Assessment Bureau. Archived from the original on 3 Mar 2016. Retrieved 20 May 2017.  ^ "Update to ISO 27001 Planned for 2013". Dionach. 25 January 2011. Retrieved 20 May 2017.  ^ "BS ISO/IEC DIS 27001 (Draft ISO27001 2013)". IT Governance. Archived from the original on 1 May 2013. Retrieved 20 May 2017.  ^ Mackie, Ryan (2 April 2013). "ISO 27001:2013 – Understanding the New Standard". The Pragmatic Auditor. Retrieved 20 May 2017.  ^ "The new versions of ISO/IEC 27001 and 27002 are now Final Draft International Standards". Gamma. Retrieved 20 May 2017. 

External links[edit] ISO 17799 and ISO 27001 Wiki v t e ISO standards by standard number List of ISO standards / ISO romanizations / IEC standards 1–9999 1 2 3 4 5 6 7 9 16 31 -0 -1 -2 -3 -4 -5 -6 -7 -8 -9 -10 -11 -12 -13 128 216 217 226 228 233 259 269 302 306 428 518 519 639 -1 -2 -3 -5 -6 646 690 732 764 843 898 965 1000 1004 1007 1073-1 1413 1538 1745 1989 2014 2015 2022 2047 2108 2145 2146 2240 2281 2709 2711 2788 2848 2852 3029 3103 3166 -1 -2 -3 3297 3307 3602 3864 3901 3977 4031 4157 4217 4909 5218 5428 5775 5776 5800 5964 6166 6344 6346 6385 6425 6429 6438 6523 6709 7001 7002 7098 7185 7200 7498 7736 7810 7811 7812 7813 7816 8000 8178 8217 8571 8583 8601 8632 8652 8691 8807 8820-5 8859 -1 -2 -3 -4 -5 -6 -7 -8 -8-I -9 -10 -11 -12 -13 -14 -15 -16 8879 9000/9001 9075 9126 9293 9241 9362 9407 9506 9529 9564 9594 9660 9897 9899 9945 9984 9985 9995 10000–19999 10005 10006 10007 10116 10118-3 10160 10161 10165 10179 10206 10218 10303 -11 -21 -22 -28 -238 10383 10487 10585 10589 10646 10664 10746 10861 10957 10962 10967 11073 11170 11179 11404 11544 11783 11784 11785 11801 11898 11940 (-2) 11941 11941 (TR) 11992 12006 12182 12207 12234-2 13211 -1 -2 13216 13250 13399 13406-2 13450 13485 13490 13567 13568 13584 13616 14000 14031 14224 14289 14396 14443 14496 -2 -3 -6 -10 -11 -12 -14 -17 -20 14644 14649 14651 14698 14750 14764 14882 14971 15022 15189 15288 15291 15292 15398 15408 15444 -3 15445 15438 15504 15511 15686 15693 15706 -2 15707 15897 15919 15924 15926 15926 WIP 15930 16023 16262 16612-2 16750 16949 (TS) 17024 17025 17100 17203 17369 17442 17799 18000 18004 18014 18245 18629 18916 19005 19011 19092 (-1 -2) 19114 19115 19125 19136 19439 19500 19501 19502 19503 19505 19506 19507 19508 19509 19510 19600:2014 19752 19757 19770 19775-1 19794-5 19831 20000+ 20000 20022 20121 20400 21000 21047 21500 21827:2002 22000 23270 23271 23360 24517 24613 24617 24707 25178 25964 26000 26300 26324 27000 series 27000 27001 27002 27006 27729 28000 29110 29148 29199-2 29500 30170 31000 32000 38500 40500 42010 55000 80000 -1 -2 -3 Category Retrieved from "" Categories: Information assurance standardsISO/IEC 27000-seriesHidden categories: Articles needing additional references from April 2014All articles needing additional referencesUse British English Oxford spelling from January 2012Articles needing additional references from February 2012Use dmy dates from October 2017

Navigation menu Personal tools Not logged inTalkContributionsCreate accountLog in Namespaces ArticleTalk Variants Views ReadEditView history More Search Navigation Main pageContentsFeatured contentCurrent eventsRandom articleDonate to WikipediaWikipedia store Interaction HelpAbout WikipediaCommunity portalRecent changesContact page Tools What links hereRelated changesUpload fileSpecial pagesPermanent linkPage informationCite this page Print/export Create a bookDownload as PDFPrintable version Languages Add links This page was last edited on 10 January 2018, at 23:10. Text is available under the Creative Commons Attribution-ShareAlike License; additional terms may apply. By using this site, you agree to the Terms of Use and Privacy Policy. Wikipedia® is a registered trademark of the Wikimedia Foundation, Inc., a non-profit organization. Privacy policy About Wikipedia Disclaimers Contact Wikipedia Developers Cookie statement Mobile view (window.RLQ=window.RLQ||[]).push(function(){mw.config.set({"wgPageParseReport":{"limitreport":{"cputime":"0.244","walltime":"0.310","ppvisitednodes":{"value":1018,"limit":1000000},"ppgeneratednodes":{"value":0,"limit":1500000},"postexpandincludesize":{"value":64770,"limit":2097152},"templateargumentsize":{"value":566,"limit":2097152},"expansiondepth":{"value":12,"limit":40},"expensivefunctioncount":{"value":4,"limit":500},"entityaccesscount":{"value":0,"limit":400},"timingprofile":["100.00% 216.266 1 -total"," 45.54% 98.481 1 Template:Reflist"," 35.14% 75.998 13 Template:Cite_web"," 23.77% 51.411 1 Template:Refimprove"," 17.43% 37.685 2 Template:Ambox"," 11.09% 23.977 1 Template:ISO_standards"," 10.16% 21.962 1 Template:Navbox"," 6.81% 14.733 1 Template:Use_British_(Oxford)_English"," 6.04% 13.068 2 Template:DMCA"," 5.38% 11.645 2 Template:Dated_maintenance_category"]},"scribunto":{"limitreport-timeusage":{"value":"0.093","limit":"10.000"},"limitreport-memusage":{"value":3944636,"limit":52428800}},"cachereport":{"origin":"mw1273","timestamp":"20180110231003","ttl":1900800,"transientcontent":false}}});});(window.RLQ=window.RLQ||[]).push(function(){mw.config.set({"wgBackendResponseTime":62,"wgHostname":"mw1333"});});

ISO/IEC_27001 - Photos and All Basic Informations

ISO/IEC_27001 More Links

Wikipedia:VerifiabilityHelp:Introduction To Referencing With Wiki Markup/1Help:Maintenance Template RemovalISO/IEC 27000-seriesInternational Organization For StandardizationInternational Electrotechnical CommissionISO/IEC JTC 1/SC 27AuditWikipedia:Citing SourcesWikipedia:VerifiabilityHelp:Introduction To Referencing With Wiki Markup/1Wikipedia:VerifiabilityHelp:Maintenance Template RemovalSecurity ControlsInformation Security Management SystemData SecurityISO/IEC 27000-seriesISO/IEC 27005EnlargePlan-Do-Check-ActW. Edwards DemingBS 7799BSI GroupDepartment Of Trade And Industry (United Kingdom)Information Security Management SystemAccredited RegistrarCertificationAuditAuditAuditAuditEnlargeInformation SecuritySecurity ControlsOutsourcingPlan-Do-Check-ActSix SigmaDMAICISO 9000ISO/IEC 20000Security ControlsCloud ComputingISO JTC 1/SC 27ISO/IEC 15408ISO/IEC 27000-seriesISO 9001BS 7799Cyber Security StandardsInternational Organization For StandardizationList Of ISO StandardsStandard Of Good PracticeInformation Security ForumInternational Organization For StandardizationInternational Organization For StandardizationNanyang Technological UniversityTemplate:ISO StandardsTemplate Talk:ISO StandardsInternational Organization For StandardizationList Of International Organization For Standardization StandardsList Of ISO RomanizationsList Of IEC StandardsISO 1ISO 2Preferred NumberISO 4ISO 5ISO 6ISO 7ISO 9A440 (pitch Standard)ISO 31ISO 31-0ISO 31-1ISO 31-2ISO 31-3ISO 31-4ISO 31-5ISO 31-6ISO 31-7ISO 31-8ISO 31-9ISO 31-10ISO 31-11ISO 31-12ISO 31-13ISO 128ISO 216ISO 217ISO 226British Standard Pipe ThreadISO 233ISO 259EnvelopeKappa NumberVicat Softening PointISO 428ISO 518ISO 519ISO 639ISO 639-1ISO 639-2ISO 639-3ISO 639-5ISO 639-6ISO/IEC 646ISO 690ISO 732Antimagnetic WatchISO 843ISO 898ISO 965ISO 1000Magnetic Ink Character Recognition135 FilmOCR-A FontISO 1413ALGOL 60ISO 1745ISO 1989ISO 2014ISO 2015ISO/IEC 2022ISO 2047International Standard Book NumberISO 2145ISO 2146ISO 2240Water Resistant MarkISO 2709ISO 2711ISO 2788ISO 2848ISO 2852126 FilmISO 3103ISO 3166ISO 3166-1ISO 3166-2ISO 3166-3International Standard Serial NumberISO 3307Kunrei-shiki RomanizationISO 3864International Standard Recording CodeISO 3977ISO 4031ISO 4157ISO 4217ISO/IEC 4909ISO/IEC 5218ISO 5428ISO 5775ISO 5776ISO 5800ISO 5964ISO 6166ISO 6344ISO 6346ISO 6385Water Resistant MarkANSI Escape CodeISO 6438ISO 6523ISO 6709ISO 7001ISO 7002PinyinPascal (programming Language)ISO 7200OSI ModelISO 7736ISO/IEC 7810ISO/IEC 7811ISO/IEC 7812ISO/IEC 7813ISO/IEC 7816ISO 8000ISO 8178Fuel OilFTAMISO 8583ISO 8601Computer Graphics MetafileISO/IEC 8652ISO 8691Language Of Temporal Ordering SpecificationISO/IEC 8820-5ISO/IEC 8859ISO/IEC 8859-1ISO/IEC 8859-2ISO/IEC 8859-3ISO/IEC 8859-4ISO/IEC 8859-5ISO/IEC 8859-6ISO/IEC 8859-7ISO/IEC 8859-8ISO-8859-8-IISO/IEC 8859-9ISO/IEC 8859-10ISO/IEC 8859-11ISO/IEC 8859-12ISO/IEC 8859-13ISO/IEC 8859-14ISO/IEC 8859-15ISO/IEC 8859-16Standard Generalized Markup LanguageISO 9000SQLISO/IEC 9126File Allocation TableISO 9241ISO 9362Shoe SizeManufacturing Message SpecificationISO 9529ISO 9564X.500ISO 9660ISO 9897C (programming Language)POSIXISO 9984ISO 9985ISO/IEC 9995ISO 10005ISO 10006ISO 10007ISO/IEC 10116Whirlpool (cryptography)ISO 10160ISO 10161Guidelines For The Definition Of Managed ObjectsDocument Style Semantics And Specification LanguageISO 10206ISO 10218ISO 10303EXPRESS (data Modeling Language)ISO 10303-21ISO 10303-22ISO 10303-28STEP-NCISO 10383ISO 10487ArmSCIIIS-ISUniversal Coded Character SetTorxRM-ODPMultibusInternational Standard Music NumberISO 10962ISO/IEC 10967ISO/IEEE 11073ISO 11170ISO/IEC 11179ISO/IEC 11404JBIGISO 11783ISO 11784 & 11785ISO 11784 & 11785ISO/IEC 11801ISO 11898ISO 11940ISO 11940-2ISO/TR 11941ISO/TR 11941ISO 11992ISO 12006ISO/IEC TR 12182ISO/IEC 12207Tag Image File Format / Electronic PhotographyPrologPrologPrologIsofixTopic MapsISO 13399ISO 13406-2110 FilmISO 13485ISO 13490ISO 13567Z NotationISO 13584International Bank Account NumberISO 14000ISO 14031ISO 14224PDF/UAHorsepowerISO/IEC 14443MPEG-4MPEG-4 Part 2MPEG-4 Part 3Delivery Multimedia Integration FrameworkH.264/MPEG-4 AVCMPEG-4 Part 11MPEG-4 Part 12MPEG-4 Part 14MPEG-4 Part 14MPEG-4 Part 14ISO 14644STEP-NCISO 14651ISO 14698ISO 14750Software MaintenanceC++ISO 14971ISO 15022ISO 15189ISO/IEC 15288Ada Semantic Interface SpecificationISO 15292ISO 15398Common CriteriaJPEG 2000Motion JPEG 2000HTMLPDF417ISO/IEC 15504International Standard Identifier For Libraries And Related OrganizationsISO 15686ISO/IEC 15693International Standard Audiovisual NumberISO 15706-2International Standard Musical Work CodeISO 15897ISO 15919ISO 15924ISO 15926ISO 15926 WIPPDF/XMaxiCodeECMAScriptPDF/VTISO 16750ISO/TS 16949ISO/IEC 17024ISO/IEC 17025ISO 17100:2015Open Virtualization FormatSDMXLegal Entity IdentifierISO/IEC 27002ISO/IEC 18000QR CodeISO/IEC 18014ISO 18245Process Specification LanguagePhotographic Activity TestPDF/AISO 19011ISO 19092-1ISO 19092-2ISO 19114ISO 19115Simple Feature AccessISO 19136ISO 19439Common Object Request Broker ArchitectureUnified Modeling LanguageMeta-Object FacilityXML Metadata InterchangeUnified Modeling LanguageKnowledge Discovery MetamodelObject Constraint LanguageMeta-Object FacilityXML Metadata InterchangeBusiness Process Model And NotationISO 19600:2014ISO/IEC 19752RELAX NGISO/IEC 19770X3DISO/IEC 19794-5Cloud Infrastructure Management InterfaceISO/IEC 20000ISO 20022ISO 20121ISO 20400MPEG-21International Standard Text CodeISO 21500ISO/IEC 21827ISO 22000C Sharp (programming Language)Common Language InfrastructureLinux Standard BasePDF/ELexical Markup FrameworkISO-TimeMLCommon LogicISO 25178ISO 25964ISO 26000OpenDocumentDigital Object IdentifierISO/IEC 27000-seriesISO/IEC 27000ISO/IEC 27002ISO/IEC 27006International Standard Name IdentifierISO 28000ISO 29110Requirements EngineeringJPEG XROffice Open XMLRuby (programming Language)ISO 31000Portable Document FormatISO/IEC 38500Web Content Accessibility GuidelinesISO/IEC 42010ISO 55000ISO/IEC 80000ISO 80000-1ISO 80000-2ISO 80000-3Category:ISO StandardsHelp:CategoryCategory:Information Assurance StandardsCategory:ISO/IEC 27000-seriesCategory:Articles Needing Additional References From April 2014Category:All Articles Needing Additional ReferencesCategory:Use British English Oxford Spelling From January 2012Category:Articles Needing Additional References From February 2012Category:Use Dmy Dates From October 2017Discussion About Edits From This IP Address [n]A List Of Edits Made From This IP Address [y]View The Content Page [c]Discussion About The Content Page [t]Edit This Page [e]Visit The Main Page [z]Guides To Browsing WikipediaFeatured Content – The Best Of WikipediaFind Background Information On Current EventsLoad A Random Article [x]Guidance On How To Use And Edit WikipediaFind Out About WikipediaAbout The Project, What You Can Do, Where To Find ThingsA List Of Recent Changes In The Wiki [r]List Of All English Wikipedia Pages Containing Links To This Page [j]Recent Changes In Pages Linked From This Page [k]Upload Files [u]A List Of All Special Pages [q]Wikipedia:AboutWikipedia:General Disclaimer

view link view link view link view link view link