Mountainview ITSM


ITIL  20000  27000  more


eLearning  Virtual  Classroom  Exams


License  Corporate


Contacts  Downloads  Reviews  Search

ITIL 4 Foundation Sale

ITIL V3 Foundation Sale

ITIL V3 Intermediate Sale

ITIL V3 Expert Sale

Select Primer: Navigator  ITSM  ITIL  20000  27000  38500  COBIT  TOGAF  PMBoK  PRINCE2  Six Sigma

ISO/IEC 27000 Primer


ISO/IEC 27000 defines a Information Security Management System (ISMS).  It provides an overview of and introduction to the entire ISO/IEC 27000 family of ISMS standards; and provides a glossary or vocabulary of fundamental terms and definitions used throughout the ISO/IEC 27000 family.  The 'ISO/IEC 27000 series' is an information security standard published by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC).


  • ISO/IEC 27000 — Information security management systems — Overview and vocabulary

    • The ISO/IEC 27000 specification is available as a FREE download from the ITTF site associated with.

  • ISO/IEC 27001 — Information security management systems — Requirements

    • 0 Introduction - the standard uses a process approach.

    • 1 Scope: it specifies generic ISMS requirements suitable for organizations of any type, size or nature.

    • 2 Normative references 

    • 3 Terms and definitions: brief, formalized glossary

    • 4 Context of the organization: understanding the organizational context, the needs and expectations of ‘interested parties’, and defining the scope of the ISMS - “The organization shall establish, implement, maintain and continually improve” a compliant ISMS

    • 5 Leadership: top management must demonstrate leadership and commitment to the ISMS, mandate policy, and assign information security roles, responsibilities and authorities

    • 6 Planning: outlines the process to identify, analyze and plan to treat information risks, and clarify the objectives of information security

    • 7 Support: adequate, competent resources must be assigned, awareness raised, documentation prepared and controlled

    • 8 Operation: more detail about assessing and treating information risks, managing changes, and documenting things

    • 9 Performance evaluation: monitor, measure, analyze and evaluate/audit/review the information security controls, processes and management system in order to make systematic improvements where appropriate

    • 10 Improvement: address the findings of audits and reviews (e.g. nonconformities and corrective actions), make continual refinements to the ISMS

    • Annex A:  reference control objectives and controls - little more in fact than a list of titles of the control sections in ISO/IEC 27002 - the annex is ‘normative’, implying that certified organizations are expected to use it, but they are free to deviate from or supplement it in order to address their particular information risks

    • Bibliography:

  • ISO/IEC 27002 — Code of practice for information security management

    • It was originally ISO/IEC 17799:2005 and subsequently renumbered ISO/IEC 27002:2005 in July 2007, bringing it into line with the other ISO/IEC 27000-series standards.
    • It provides best practice recommendations on information security management for use by those who are responsible for initiating, implementing or maintaining Information Security Management Systems (ISMS). Information security is defined within the standard in the context of CIA:
      • Confidentiality: Ensuring that information is accessible only to those authorised to have access
      • Integrity: safeguarding the accuracy and completeness of information and processing methods
      • Availability: Ensuring that authorised users have access to information and associated assets when required
  • ISO/IEC 27003 — Information security management system implementation guidance

  • ISO/IEC 27004 — Information security management — Measurement

  • ISO/IEC 27005 — Information security risk management

  • ISO/IEC 27006 — Requirements for bodies providing audit and certification of information security management systems

  • ISO/IEC 27007 — Guidelines for information security management systems auditing (focused on the management system)

  • ISO/IEC 27008 — Guidance for auditors on ISMS controls (focused on the information security controls)

  • ISO/IEC 27010 — Information technology -- Security techniques -- Information security management for inter-sector and inter-organizational communications

  • ISO/IEC 27011 — Information security management guidelines for telecommunications organizations based on ISO/IEC 27002

  • ISO/IEC 27013 — Guideline on the integrated implementation of ISO/IEC 20000-1 and ISO/IEC 27001

  • ISO/IEC 27014 — Information security governance framework

  • ISO/IEC 27015 — Information security management guidelines for the finance and insurance sectors

  • ISO/IEC 27031 — Guidelines for information and communications technology readiness for business continuity

  • ISO/IEC 27032 — Guideline for cyber security

  • ISO/IEC 27033 — IT network security, a multi-part standard based on ISO/IEC 18028:2006

  • ISO/IEC 27033-1 — Network security overview and concepts

  • ISO/IEC 27034 — Guideline for application security

  • ISO/IEC 27035 — Security incident management

  • ISO/IEC 27036 — Guidelines for security of outsourcing

  • ISO/IEC 27037 — Guidelines for identification, collection and/or acquisition and preservation of digital evidence

  • ISO/IEC 27799 — Information security management in health using ISO/IEC 27002


World-wide Accedited ITIL Training and Courseware


Contact us  Primers   Accreditation  About us   Consult & Audit  Partners   Alumni   Trainers  Careers

AXELOS Partner

TwitterGoogle +1StumbleuponFacebook LikeLinkedinPinterest

   Mountainview ITSM 1992-2018

Trademarks and Terms & Conditions of Use

No part of this website may be reproduced in any form without the written permission of both Mountainview and AXELOS Limited. Permission can be requested at and