ISO/IEC 17799 is an information security standard published in December 2000 by the International Organization for Standardization and the International Electrotechnical Commission in 2000 entitled Information technology - Code of practice for information security management. ISO 17799 will be revised and re-issued this year (2005).

ISO/IEC 17799 provides best practice recommendations on information security management for use by those who are responsible for initiating, implementing or maintaining information security management systems. Information security is defined within the standard as the preservation of confidentiality (ensuring that information is accessible only to those authorised to have access), integrity (safeguarding the accuracy and completeness of information and processing methods) and availability (ensuring that authorised users have access to information and associated assets when required).

ISO/IEC 17799 contains the following ten main sections:

• Security policy
• Security organization
• Asset classification and control
• Personnel security
• Physical and environmental security
• Communications and operations management
• Access control
• Systems development and maintenance
• Business continuity management
• Compliance

Within each section, information security control objectives are specified and a range of controls are outlined that are generally regarded as best practice means of achieving those objectives. Specific controls are not mandated since (a) each organization is expected to undertake a structured information security risk assessment process to determine its requirements before selecting controls that are appropriate to its particular circumstances (the introduction section outlines a risk assessment process although there are more specific standards covering this area such as ISO Technical Report TR 13335 GMITS Part 3 - Guidelines for the management of IT security - Security Techniques); and (b) it is practically impossible to list all conceivable controls in a general purpose standard.

ISO/IEC 17799 has directly equivalent national standards in countries such as Australia and New Zealand (AS/NZS 7799), the Netherlands (SPE 20003), Sweden (SS 627799), Japan (JIS X 5080) and the United Kingdom (BS7799:1999 Part 1 - the original British Standard which became word-for-word ISO/IEC 17799:2000). The second part of BS7799 (BS7799:2002 Part 2 Information security management systems - Part 2: Specification with guidance for use) specifies a number of requirements for establishing, implementing, maintaining and improving an information security management system consistent with the best practices outlined in ISO/IEC 17799. Organizations may be officially certified against BS7799-2 (or national equivalents) by certification/registration bodies accredited by the relevant national standards organizations.

Reference

• ISO/IEC 17799:2000
• BS 7799-2:2002

External links

• ISO 17799 Source from BSI
• British Standards Institute
• ISO 17799 Wiki
• The ISO 17799 Newsletter