It is a specification internationally recognized work to assess the security measures used in information technology environments, moreover it pays a special attention to procedures for related work and identifies the priority actions. It also identifies stipulations and obligations to establish and implement, operate and maintain the content of the International Standard document ISO / IEC 27001 within the organization to take into account all the potential dangers that the organization may be exposed to, whether this organization was a government organization or commercial or charity facility. The specification also defines the conditions necessary for the application of security control points that meet the needs of each individual organization or any branch of that organization.
And the specification is designed to ensure the freedom of choice of the appropriate security control points that works to maintain the information and give confidence to related parties.
The basis and principles of the confidentiality of the information`s management system ISMS
The set of international standards 27000 ISO \ IEC issued by the International Organization for Standardization ISO in cooperation with the IEC in 2005 by the technical committees ISO / IEC JTC 1, ISO / SC 27 which is developing the British specifications of BS 7799 and this to address the issues concerning the confidentiality of information.
Since then the organization of the ISO releases a large number of specifications and technical reports and manuals for serving confidential information management systems, and that, as illustrated by the following statement which shows the red color of those documents that have been issued (please refer to the Organization`s site ISO to make sure of the versions):
The most important of the two International specifications ISO / IEC 27001:2005 and ISO / IEC 27002:2005 and the first gives the requirements for management system for information security and the second covers methods of good practice for control over information security.
The specification ISO / IEC 27001:2005 apply to any organization of any size or products and it is possible after the application of the system to apply to the concerned authority for certification to obtain a certificate of compliance for the organization.
The confidentiality of information in the view of the specification: ISO / IEC 27001:2005
The specification ISO / IEC 27002:2005 also specifies the confidentiality of information as to maintain:
Privacy: Confirm that the information is obtained only by those who have the authority to do so.
Integration: confirm the accuracy and integrity of information and working methods
Availability: confirmation that the persons authorized to have access to the information and other sources where it is required.
Areas of The specification ISO/IEC 27001 :
• The risk management of Information Technology
• Information Security Policy
• The organization`s staff of the organization security
• The safety of the work environment and the security of property
• Communication Management and Operations
• Control access to places.
• Information Security and Incident Management
• Continuity Management and Work Readiness.
Stages of application and evaluation of the information security