|
International standard ISO17799 (based on BS7799 "Code of Practice for Information Security Management - part 1") describes a comprehensive infosec framework, and outlines the process an organisation may adopt to implement the framework. Read a summary of ISO17799 here.
We are firm supporters of ISO17799 and recommend it to all our clients as a rule. Adopting ISO17799's structured approach to infosec management brings major benefits, including a rationality and consistency to the controls. Designing and setting up an effective information security function is invariably a major undertaking with a number of important decision points and choices. ISO17799 itself contains a lot of specific information security controls, although we prefer to concentrate on the 100 or so control objectives. Often, a single control will satisfy more than one objective but, conversely, a single control weakness may compromise the whole organisation. Therefore it is important to assess the risks logicaly, clarify the organisation's own control objectives, design a broad controls framework (properly integrated with other aspects of the organisation, such as physical security, human resources and, of course, IT operations), and implement it consistently. Thereafter, maintenance is an necessary ongoing task to prevent the controls from decaying through lack of attention, and to counter new threats. Our ISO17799 consultancy services include:
|
