ISO/IEC 27000 –Information Security Risk Management Standards for Companies of All Sizes


Hide Menu

The International Organization for Standardization (ISO) joined forces with the International Electrotechnical Commission (IEC) to create a set of information security standards by the name of ISO/IEC 27000 series. This set of best practices as a whole works on ensuring more than privacy and technical security issues, which is why all the organizations of the world work to ensure their compliance with them.

Whereas many believed that the ISO/IEC 27000 is similar to the ISO 9000 series for quality assurance and the ISO 14000 series for environmental protection, the series aims at doing more than ensure the privacy and technical security of IT systems. The series of best practices encourages companies implementing it to:

  • Assess IT security risks
  • Implement the right IT security controls based on their needs
  • Use the guidance and suggestions marked by the series when appropriate
  • Incorporate feedback and improvement activities to tend to threats and vulnerabilities

Major Published Standards

The ISO/IEC 27000 series consists of 10 published standards –

  1. ISO/IEC 27000 – This standard offers an overview on the standards and provides a list of the vocabulary used.
  2. ISO/IEC 27001 – This standard goes over the requirements needed to ensure the security of IT systems.
  3. ISO/IEC 27002 – This best practice offers a code of practice for IT security management.
  4. ISO/IEC 27003 – The ISO/IEC 27003 provides guidance for implementing IT security management systems.
  5. ISO/IEC 27004 – Since metrics are necessary in risk management, this standard offers assistance in the measurement of IT security management.
  6. ISO/IEC 27005 – For a broader look at IT security risk management, this standard is ideal.
  7. ISO/IEC 27006 – Individuals or companies which provide audit and certification of IT security management systems should be aware of the requirements mentioned in this standard.
  8. ISO/IEC 27011 – Telecommunication organizations which implemented the ISO/IEC 27002 standard may consider adding the guidelines of this standard to their companies.
  9. ISO/IEC 27033-1 – As the network is usually the source of many risks, this standard offers an overview of Network security and its concepts.
  10. ISO 27799 – For organizations in the health field, especially those which use ISO/IEC 27002 should be acquainted with the IT security management information mentioned in this best practice.

Standards to be Published

To ensure that the best practices of ISO/IEC 27000 are up to date and able to accommodate today’s IT risks, more standards are under development. Some of those standards companies should expect are:

  • ISO/IEC 27007 – This standard offers guidance for auditing IT security management systems.
  • ISO/IEC 27008 – This standard provides auditors on ISMS controls with guidance.
  • ISO/IEC 27013 – For companies which seek to implement ISO/IEC 2000-1 and ISO/IEC 27001, this standard offers a set of guidelines to be followed.
  • ISO/IEC 27036 – This standard offers guidelines which help companies and individuals ensure the security of outsourcing.

There are similar standards across the world, for example the BS 7799, thus companies should consider which set of best practices they need to implement.

Risk Management Standards (RMS)


Risk management standards (RMS) are values that are fixed in order to support risk assessment. The main objective of risk management (RM) is to control negative impact of risks associated with business. There are numerous forms of risk that vary with the form of business. This is why in every business institute there are standard best practices that must be complied with.

There are two main categories of RM standards. These are international RM standards and standards set by the management of the company. Standards are set based on compliance with laws and regulations of the country or state. Moreover, there are RM standards governing every profession that exists today. The International Organization for Standards has issued more than 19, 000 standards for risk management. These are implemented as best practices worldwide.

Importance of Risk Management Standards

Fixing standards for RM is very important because they compel businesses to provide the best quality. Compliance with RM standards protects the business from unforeseen losses. There are cases where failure to ensure compliance with RM has led to legal action. To prevent this from happening, business owners set their own standards. Other business owners implement standards established by the government.

No matter what profession or form of business it is, there are quality and service expectations that must be fulfilled. For instance, in banks there are specific business protocols that have to be met. These protocols or best practices are synchronized with those of other banks worldwide. As a result of this international banking has become feasible and convenient. When standards are not fulfilled, banks fail to satisfy the financial needs of their customers.

Similarly, in healthcare intuitions, there are healthcare standards that must be met. For example, if health care insurance is involved there are requirements (best practices) that must be fulfilled. These protect both the patient and the healthcare practitioners. If a patient is wrongly treated, it proves failure of compliance with RMS. The consequence is that health care facilities get sued and shut down.

Advantage of Risk Management Standards

The main advantage of developing or implementing RM Standards is that, managers and CEOs can plan their business strategies. These standards provide the option to limit the extent of risk to be taken in the first place.

There are risks attached with every form of business and investment. RM Standards help by avoiding occurrence of circumstances that can lead to unforeseen losses. They also outline the approach business owners have to take to mitigate the risk. This is why compliance is the basic tool required for the success of every business.

In this section we will discuss:


Contact Links
Copyright 2009 Best-Practice.com. All Rights Reserved.