BS 7799 Certification

In the Information Security Space we believe that people are the strongest and weakest link in the attempt of securing ones IT resources. Security professionals are responsible for the making and breaking the best security systems developed till date.

The best method to validate ones attempt to provide an Effective Information Security Management is to first benchmark the same with BS 7799 Standard and then certify the same through an external vendor.

In the earlier articles we looked at finer aspects of the standard where we discussed the standard itself, risk assessment, implementation and risk management.

In this final session we would attempt to understand the structure and steps involved in certification for BS7799.

A quick recap

Before we go in to the details of acquiring certification we need to go back and look at what constitutes the standard and what will a company be certified for:

ISO/IEC 17799:2000 (Part 1) is the standard code of practice , which can be regarded as a comprehensive catalogue of "the best things to do in Information Security"

BS7799-2: 1999 (Part 2) is a standard specification for Information Security Management Systems (ISMS). ISMS is the means by which Senior Management monitor can control their security, minimising the residual business risk and ensuring that security continues to fulfill corporate, customer and legal requirements.

Please note that certification is against BS7799-2:1999.

In order to be awarded a certificate, a BS7799 assessor will audit the ISMS. The assessor cannot also be a consultant. There are very strict rules about this. The assessor will work for a Certification Body (such as Det Norske Veritas and BSI Assessment Services Limited).

The Certification Body will award you the certificate. The certificate will document the scope of your ISMS and other relevant details, such as the statement of applicability. Only Certification Bodies that have been duly accredited by a National Accreditation Body can issue certificates.

The assessor will return periodically to check that your ISMS is working as intended.

Domains on which one would be assessed:

As discussed in the earlier sessions the company needs to prepare its policies and procedures, which would cover the following domains.:

•Security policy

•Security organisation

•Asset classification and control

•Personnel security

•Physical and environmental security

•Communications and operations management

•Access control

•Systems development and maintenance

•Business continuity management

•Compliance

Statement of applicability

BS 7799 requires a company to identify process and controls , which they practically work on. If for example the company does not require to outsource any of its functions to any external vendor they can state that 4.2.3.1 (Security Requirements in outsourcing contracts ) is not relevant to that particular organisation.

You are required to identify all of your chosen security controls, justify why you feel they are appropriate, and explain why those BS7799 controls that have not been chosen are not relevant.

Preparing oneself for Certification:

The traditional formula of PLAN DO CHECK and ACT (PDCA CYCLE) works well with BS- 7799 too and this is a good place to either start or review the progress of the implementation team.

Plan

While planning one has to particularly be careful of the Business Context with which the ISMS is being prepared, which would include defining business policy and objectives, estimating the scope of ISMS, deciding and collecting resources for conducting risk assessment and a definitive approach to Identification, Analyzing and Evaluating risks in a continuous mode.

Do

While implementing the ISMS the focus should always be to build a long run and faultless mechanism for managing risk. This would include evaluating options of going in for automated or manual systems. The ideal method is to strike a perfect balance between both the counts. BS7799 controls need to be addressed, as our ultimate objective is to acquire certification.

Deploy qualified and tested vendors to implement various products and solutions, which would be required. Preparation of the statement of applicability is also an important step where the management plays a important role.

Check

Here is where one has to get an external security audit team qualified to perform a third party security audit for BS7799. Certification companies like Det Norske Veritas can also help in finding qualified BS7799 consultants for companies interested in performing a pre assessment audit.

The audit team would check for appropriate controls and evidence of implementation.

For Example: If a company has prepared a policy for Contractual Agreements the company would have to submit the templates and documents where, third party contractors have signed documents for security.

Implementation would also include continuous monitoring of the ISMS from the perspective of satisfying business needs first and its practical validity in the organisation.

Act

After checking for flaws and vulnerabilities the company needs to improve ISMS by identifying key vulnerabilities and take appropriate corrective actions.

Preventive actions, for unseen but predictive incidents can be taken and polices to drive it into action can be framed in an appropriate time.

Communication and delivery of policies to IT users and IT team should be done with ease and determination. Cultural changes and differences, which arise should be tackled with justification and transparency. Management , partners and users should be trained on policies and procedures.

Creative techniques like designing

posters, which clearly states the rules such as PC usage and the best practice followed in Password Framing and Maintenance can go a long way in the success of the policies and procedures.

The 4 Step method of Certification

The Plan, Do, Check and Act framework is cyclic and has to be continuously done for long run and with the solid backing of the management.

We now come to Specifics of Certification Process

Step One

Desktop Review:

All documented polices and procedures need to be verified and checked for consistency and practicality. Corresponding templates and forms are presented to the Audit team.

One important check on documentation will be its validity and relevance to BS7799 controls.

The following documents needs to be presented

ISMS, Policies, IT- Environment Documentation, Risk Assessment Reports, Business Continuity Planning documentation, Statement of applicability.

Step Two

Technical Review

The definition and implementation of Security Architecture with its various products and networking components are checked for vulnerabilities and possible risk exposure.

The company would also need to submit a document stating the ‘permissible risk’ statement; this is the risk, which the company can afford to take.

Step Three

Internal Audit

The team of BS7799 implementers and BS7799 professionals can take up an initial Internal audit where non-conformances are picked up and recommendations are documented.

This step involves simulation of the real time third party audit and has to be taken seriously among the team and users of IT in the company.

Step Four

External Audit- Certification

Inviting the Certification Company is pre determined and the company gets ready to face the external auditors.

The company consultants and internal team would not be allowed to be part of the audit team.

They can assist and help auditors find relevant material.

The auditors check for documentation and objective evidence with the following intention.

• Are records Correct and Relevant?
• Are polices Known and Tested?
• Are policies Communicated?

• Are controls Implemented?
• Are Polices Followed up?
• Are preventive Actions taken?

The auditor then evaluates the quality of risk assessment and the level of security claimed by the company.

Conclusion

After the audit, the certification company recommends the said company for BS7799 Certification. This is certainly a victory for the IT team as they can be assured that its IT systems are world class and the possibility of a security incident happening is minimum.

To summarize the series ., BS7799 is a culture one has to build in the company, which would help one:

• Heighten security awareness within the organisation
• Identify critical assets via the Business Risk Assessment
• Provide a structure for continuous improvement
• Be a confidence factor internally as well as externally
• Enhance the knowledge and importance of security-related issues at the management level
• Ensure that "knowledge capital" will be "stored" in a business management system
• Enable future demands from clients, stockholders and partners to be met

Recommended Reading

• Information Security Management: An introduction (PD3000)
• Preparing for BS7799 Certification (PD3001)
• The Guide to BS7799 Risk Assessment and Risk Management (PD3002)
• Are you Ready for a BS7799 Audit? (PD3003)
• Guide to BS7799 Auditing (PD3004)
• Guide on selection of BS 7799 controls (PD3005)
• BS7799 : Part 1: 1999 Code of Practice for information security management
• BS7799 : Part 2: 1999 Specification for information security management systems
• EA Guidelines 7/03

BS7799 Interpretation Guide (Free Download): www.dnv.com

Det Norske Veritas (DNV) is an independent autonomous foundation with the objective of safeguarding life, property and the environment. Established in 1864, DNV provides an extensive range of technical services to the land, offshore and marine industries worldwide. The organization comprises of over 300 offices in 100 countries, with a total of 5,500 employees of 75 different nationalities.

DNV started their operations in Region India in 1972 and have established itself as a Leading Classification Society. DNV has been providing Classification, Certification, Consultancy and Verification Services for the Marine, Offshore and Land based process industries ever since both for Public and Private Sectors.

DNV is accredited in 21 countries for the Certification of Quality Management Systems and in 14 countries for Environmental Management System and is a leading Certification Body in India for both Quality & Environment Management System Certification having issued over 2500 certificates under ISO 9000 Standards and over 250 certificates under ISO 14000 Standards. DNV, in India, is also involved in Tick-IT, QS 9000, BS 7799, Risk Based Inspection (RBI), OHSMS, SA 8000 Systems Certification and CE Marking.

Key advisory services include Risk / Reliability Assessment and Loss Control Management Services. DNV is recognized by the Chief Controller of Explosives both as an Inspection Authority and Competent Person and DNV is also approved by Indian Boiler Regulations (IBR) as Competent Inspection Authority in 22 countries world-wide.

For comments and questions on this paper please write to: bmukund@yahoo.com

Source : http://www.computersecuritynow.com/7799part3.htm

The standard effectively comes in two parts

Overview

The standard effectively comes in two parts: ISO/IEC 27001:2005 is a standard specification for an Information Security Management Systems (ISMS). An ISMS is the means by which Senior Management monitor and control their security, minimising the residual business risk and ensuring that security continues to fulfil corporate, customer and legal requirements. It forms part of an organisation's internal control system.

Interested in obtaining certification quickly? Click the graphic to read our white paper on Fast Track certification

ISO/IEC 27002:2005 is a standard code of practice and can be regarded as a comprehensive catalogue of good security things to do.

A Technical Corrigendum was published by ISO on 1 July 2007 renaming ISO/IEC 17799:2005as ISO/IEC 27002:2005.

The Management Standard

ISO/IEC 27001:2005 instructs you how to apply ISO/IEC 27002 and how to build, operate, maintain and improve an ISMS.

The major components of an ISMS are summarised in Figure 1. The activities continually cycle around the PLAN-DO-CHECK-ACT cycle.

Figure 1 - The major steps towards ISMS compliance. Click here to see the detail.

PLAN

Scope

The first step is to define the scope of the ISMS. It could be the whole of your organisation. It could be a particular site. It could be just a particular service - Internet banking for example. The choice is yours.

ISMS Policy

Why is information security important to you? Is there a particular threat, or other worries that concern you? What do you want to achieve, for example in terms of confidentiality, integrity and availability? What do you believe is an acceptable level of risk? Are there any constraints, such as laws and regulations, or particular ways in which you wish to do things? Document your answers in a policy document. Note that it covers the whole of the ISMS, not just the security controls . It is therefore far more extensive than the "information security policy", referred to in the Code of Practice. It should be a relatively short document (1-3 pages) and signed off by the CEO. Security, as with all other internal controls flows down from the top of the organisation.

Risk assessment

Now you know what you are trying to protect and what is an acceptable level of risk, what is your actual risk? Choose a method that is appropriate to your organisation and the scope of your ISMS. What are the risks? Determine these by a consideration of the impacts that would occur if some threat exploits a weakness in your defences to compromise the security of an asset, and how likely is the impact to occur.

Evaluate the risks. If you plot the likelihood of the impact occurring against the magnitude of the impact you may consider that there are risks that of not of any great concern because: even if they would have a major impact they are extremely unlikely or even if they occurred all the time they would have an insignificant impact. The Institute of Chartered Accountants in England and Wales refers to the remaining risks as the applicable risks. These are the risks that you need to control. You will either have controls in place that reduce the risk to an acceptable level, or you will need to introduce them. Make sure that you have controls in place that will tell you if a non-applicable risk turns into an applicable risk.

Risk treatment plan

After completing your assessment of risk, ISO/IEC 27001 asks you to treat that risk. Are you just going to accept the risk and rely on your ability to promptly detect and respond to security incidents? (By the way, you will need such a procedure to comply with the standard.) Are you going to avoid the risk, transfer it to a third party (e.g. via insurance) or are you going to apply appropriate controls? This is your risk treatment plan. We have developed a methodology for doing this that does the risk assessment on the fly and avoids the usual gobbledegook associated with IT risk assessments - so easy, based on events and impacts expressed in business terms, senior business managers can do it.

Select control objectives and controls

ISO/IEC 27001:2005 presents a list of 133 candidate control objectives and controls, drawn one-to-one from ISO/IEC 27002. The list is not exhaustive and you are free to identify additional control objectives and controls as you please. Not all of those listed in ISO/IEC 27001:2005 may be relevant to your ISMS. In our methodology, selecting your controls also forms part of the risk treatment plan.

Statement of Applicability (SOA)

You are required to go through all 133 ISO/IEC 27001:2005 controls and justify which ones you have used and which you have not. You are required to relate the selection of the controls back to the risk assessment. In practice, you can also relate the selection of controls back to statements in your ISMS policy, the precedence for this being set by the Common Criteria (ISO/IEC 15408). This process acts as a safety net in case you inadvertently omitted something important in your risk assessment/risk treatment. In our approach to integrated management systems, we refer to this as an Alternative Ideas List.

DO

The DO part of the cycle requires you to operate the controls. You will need a procedure, as mentioned above, to ensure the prompt detection and response to incidents. You will also need to ensure that all staff are security aware, and are appropriately trained and are competent to carry out their respective security tasks. To ensure all of this is carried out you will need to manage the necessary resources.

CHECK

The purpose of the CHECK phase is to ensure that the controls are in place and are achieving their objectives. There are a variety of possible check activities, but only internal ISMS audit and management review are mandatory requirements

A new requirement, not included in BS 7799-2:2002, is the measurement of the effectiveness of your controls. Our paper on measuring the effectiveness of an internal control system explains how this can be done.

ACT

The outcomes of the CHECK activity are actions. There are three varieties:

• corrective action

• preventive action

• improvements.

Further information

There are particular requirements concerning documentation and records. These are very similar to those required by ISO 9001. Indeed there is a great deal of overlap making the creation of integrated management systems a real possibility.

---

The Code of Practice

ISO/IEC 27002:2005 defines 133 security controls structured under 11 major headings (see Figure 2) to enable readers to identify the particular safeguards that are appropriate to their particular business or specific area of responsibility. These security controls contain further detailed controls bringing the overall number somewhere in the region of 5000+ controls and elements of best practice.

The standard stresses the importance of risk management and makes it clear that you do not have to implement every single guideline; only those that are relevant. The scope of the standard covers all forms of information, including voice and graphics, and media such as mobile phones and fax machines. The new standard recognises new ways of doing business, such as e-commerce, the Internet, outsourcing, tele-working and mobile computing.

Figure 2 - Coverage of ISO/IEC 27002

---

Certification schemes

Certification schemes are being established in many parts of the world. It is therefore useful to reveal who the players are and what is going on. Have a look at Figure 3.

ISO/IEC 27006:2007 provides guidance to National Accreditation Bodies for the accreditation of Certification Bodies wishing to assess ISMSs, e.g. against ISO/IEC 27001:2005. The various National Accreditation Bodies around the world operate a "mutual recognition" process that allows certificates awarded in one country to be accepted by the Accreditation Body of another.

Figure 3: Relationship between scheme players

In order to be awarded a certificate, your ISMS will be audited by an ISMS assessor. The assessor cannot also be a consultant. There are very strict rules about this. The assessor will work for a Certification Body (such as BSI Assessment Services Limited and Det Norske Veritas).

The Certification Body will award you the certificate. The certificate will document the scope of your ISMS and other relevant details, such as the statement of applicability. Click here to see the official list of published scope statements from around the world. Only Certification Bodies that have been duly accredited by a National Accreditation Body can issue certificates.

The assessor will return periodically to check that your ISMS is working as intended.

Obtaining the Standards

In order to buy a copy of the standards, please contact BSI Customer Services by telephone at (+44) 20 8996 7555 or electronically from https://eshop.bsi-global.com/.

From : Gamma(ISO/IEC 27001:2005 and BS EN ISO 9001: 2000 registered company)

www.gammassl.co.uk

PDCA and Continuous Improvement Process

PDCA and Continuous Improvement Process Approach (BS7799:2-2002)















Plan
- Define Scope of ISMS
- Define ISMS Policy
- Define Systematic approach to risk assessment
- Identify and assess Risk
- Identify and evaluate risk treatment options
- Select controls for risk treatment
- Prepare Statement of Applicability
Do
- Formulate Risk Treatment Plan
- Implement Risk Treatment Plan
- Implement controls
- Implement training and awareness
- Manage Operations
- Manage Resources
- Implement detective and reactive controls for security incidents
Check
- Execute monitoring procedures and controls
- Undertake regular reviews of ISMS
- Review residual risk and acceptable risk
Act
- Implement the identified improvements in ISMS
- Continuous feedback and improvement
- Communication with interested parties
- Ensure improvements achieve intended results

Generic Requirements across PDCA
- Documentation Requirements
- Management Responsibility
- Management review of ISMS
- ISMS Improvement

Marc Stefaniu - MSc, MBA, CISSP
(416) 513 5699
marc.stefaniu@bmo.com

ISO 27001 PDCA Approach

ISO 27001 (formerly BS7799) describes an approach known as PDCA:

'Plan Do Check Act' is a broad stage by stage approach which covers a range of standards.

The Management System for ISO 17799

Introduction

The publication of the standard ISO 17799 provides an international basis for a common understanding of management of information security. ISO 17799 was developed as a standard containing codes of practice for information security management to ensure that appropriate action is taken to secure data storage and transfer - whether data is provided in paper or in electronic form. ISO 17799 "Code of Practice for Information Security Management" refers to ten control for these actions:
- Security Policy
- Security Organisation
- Asset Classification and Control
- Personnel Security
- Physical and Environmental Security
- Communications and Operations Management
- Access Control
- Systems Development and Maintenance
- Business Continuity Management
- Compliance. After the framework for managing information security is given this way a question arises about the management system which shall perform the management of information security. How does such a management system look like?

The Information Security Management System

Overview

The PCDA (Plan-Do-Check-Act) model used as basis for the revision of BS 7799-2 was not only selected to conform to other management standards such as ISO 9000 or ISO 14000. It even more emphasises a strict process thinking to use this model which has its root in quality management.
The phases or activities of the PDCA cycle are:
- PLAN: Establishing the ISMS
- DO: Operating the ISMS
- CHECK: Monitoring and reviewing the ISMS
- ACT: Improving the ISMS.

PLAN

The PLAN phase is concerned with establishing the ISMS. The first step is to determine the scope of the ISMS, i.e. responding to what shall be controlled by the ISMS. An ISMS policy has to be defined that includes objectives, legal or regulatory requirements, contractual obligations, strategic organisational and risk management context and risk assessment criteria. There has to be a systematic approach to risk management. The definition of such an approach can be assisted by the very famous standard AS/NZS 4360:1999 from Australia and New Zealand or a standard published in the UK: AIRMIC, ALARM, IRM:2000. Note: This standard is jointly developed by The Institute of Risk Management (IRM), The Association of Insurance and Risk Managers (AIRMIC) and ALARM The National Forum for Risk Management in the Public Sector. Risk Identification
This step identifies the assets becoming subject to risk assessment and threats to those assets. Further vulnerabilities that might be exploited by the threats and potential losses have to be identified. Risk Assessment
Risk assessment means to look at typically two parameters: probability of occurrence of risk and impact in case of occurrence of risk.
The FMEA (Failure Mode and effects Analysis) provides a third very interesting parameter: the probability of detection. This is the probability that the occurrence of a threat is detected by using detection actions before any major impact has happened. An example for detection actions are virus scans or intrusion detection. Action Identification and Assessment
There are several options of how to respond to a risk, including:
- taking actions
- accepting risks
- avoiding risks
- transferring risks to other parties. Controlling Risk Actions
ISO 17799 includes several controls without claiming these to be complete. These controls shall be selected and justified on basis of the results of risk assessment. Statement of Applicability
The Statement of Applicability documents the controls. Management Approval
Management has to approve the implementation of the ISMS. The responsibility of management is a key success factor for the ISMS (please cf. below).

DO

The DO phase implements the steps as planned in the previous phase. Activities as known from project management are employed to build the ISMS. These include:
- Management of implementation
- Resource Management
- Schedule Management
- Training Management

CHECK

In the CHECK phase the ISMS is monitored and reviewed. Monitoring
Monitoring the operation of the ISMS includes detecting errors in the results of processing, identifying security breaches, auditing performance, identifying actions taken to resolve a security breach, following up actions in case of security breaches. Review
Reviews ensure the effectiveness of the ISMS; they are conducted in a regular manner. Reviews include:
- Security Policy and Objectives
- Audits
- Observations
- Suggestions for Improvement
- Feedback. Residual risk
Residual and acceptable risk has to be reviewed regularly with regard to impact on organisation, technology, business objectives and processes, identified threats and external effects such as legal or regulatory environment and changes in social climate.

ACT

The ACT phase is the phase of improvement. In this phase improvements are implemented, corrective and preventive actions taken, results communicated with all interested parties and improvement actions monitored.

The Management Control System

The management control system comprises:
- Document Control
- Audit
- Review
- Responsibility of Management
- Corrective and Preventive Actions
- Continual Improvement

Document Control

Document Control of ISMS is the same as of quality management. Hence, all organisations having implemented a document control system conforming to ISO 9000: 2000 will meet the requirements of BS 7799-2 with regard to the procedures needed for document control. The single steps are:
- Approval of documents for adequacy prior to issue
- Review and update of documents as necessary and reapprove
- Identification of changes and current document revision status
- Availability of relevant versions of documents at points of use
- Legible and readily identifiable documents
- Identification and controlled distribution of external documents
- Controlled distribution of documents
- Prevention of unintended use of obsolete documents
- Suitable identification to obsolete documents if they are retained. BS 7799-2 lists documents to be included into the ISMS:
- Statements of security policy and control objectives
- Scope, procedures and controls of the ISMS
- Risk assessment report
- Risk treatment plan
- Procedures to ensure effective planning, operation and control of its IS processes
- Records (cf. below)
- Statement of Applicability Control of Records
Records have to be made and maintained as evidence of conformance to the standard and to demonstrate the effective operation of the ISMS. Again, the requirements are the same as for quality management. The procedure to control records has to be documented and comprises:
- Identification
- Storage
- Protection
- Retrieval
- Retention
- Disposition

The internal Audit

The internal audit plays a core role in the effort of maintaining information security and improvement. Audits shall ensure that all elements of the ISMS conform to the requirements of the standard and identified information security requirements, are effectively implemented and maintained and perform as expected. The results of audits are:
- Actual, detected concerns (cf. below: Corrective Actions)
- Potential concerns (cf. below: Preventive Actions)
- Opportunities for improvement (cf. below: continual improvement) Audit activities comprise:
- Definition of audit objectives
- Examine the documents
- Audit planning
- Auditing
- Audit results report
- Completion of audit plan
- Follow-up audits as needed
Organisations running a quality management system easily can combine the audit function of the ISMS with the one of quality management.

Management Review

Management has to conduct a management review of the ISMS; this again is known from quality management. The management review shall confirm the continuing suitability, adequacy and effectiveness of the ISMS. Review input includes audit and review results, corrective and preventive actions, recommendations for improvement and new technologies and procedures. The results of a review are corrections and improvements to the ISMS and provision of resources as needed.

Management Responsibility

A very important, though often neglected element of the management control system is management responsibility. It covers three items:
- Management commitment
- Resource management
- Training, awareness and competency. Management Commitment
Management commitment is like in other management systems a critical success factor. In particular, management has to care about:
- Establishing the information security policy
- Ensuring that information security objectives and plans are established
- Assigning roles and responsibilities
- Communication of importance of information security
- Providing sufficient resources for the ISMS (cf. below)
- Deciding about acceptable level of risk
- Conducting management reviews. Resource Management
Management is responsible to provide sufficient resources to:
- Establish, implement, operate and maintain the ISMS
- Ensure that ISMS procedures support the business requirements
- Ensure that legal/regulatory requirements and contractual obligations are addressed
- Ensure adequate security by applying implemented controls
- Carry our reviews and taking appropriate actions
- Improve effectiveness of ISMS Training, Awareness and competency
Management is responsible that all personal of the ISMS is sufficiently trained. In detail:
- Determining necessary competency
- Providing training
- Evaluating effectiveness of training
- Maintaining training records on experience, skills and qualifications.

Corrective and Preventive Actions

Internal audits and other internal and external source provide evidence about the effectiveness of the ISMS. Actions are initiated to eliminate any concern and prevent the re-occurrence of such concern. With regard to the management system there are two important types of actions: corrective actions and preventive actions. Corrective actions are actions taken after the occurrence of a risk or a concern to prevent re-occurrence in the future. Preventive actions are used to anticipate potential risks or concerns and to prevent any potential future damage before any occurrence is detected.

Continual Improvement of the ISMS

Both ISO 9000:2000 and BS 7799-2 list next to the just mentioned corrective and preventive actions the continual improvement. Whereas corrective and preventive actions focus on detected or potential concerns actions also can be taken to further improve a system in terms of effectiveness and efficiency that is free of any concern. The continual striving for improvement without being based on any problem or concern is very important for any successful management system. It is the step from a re-active to a pro-active management. The steps of continual improvement are:
- Identification of possible improvement area s
- Analysis and justification of needed action
- Determining availability of resources
- Deciding to implement improvements
- Implementing improvements
- Measuring impact on organisation
- Considering results at management review
- Continually looking for improvements.

Conclusion

BS 7799-2 provides an information security management system to realise information security as determined in ISO 17799. The neighbourhood to ISO 9000 is obvious and an important issue to efficiently setup the system. BS 7799-2 is a fundamental add-on to ISO 17799 as it allows to integrate information security actions in a management system. Such a management is the basis any success in information security. BS 7799-2 provides organisations with the opportunity register the ISMS and communicate the own commitment. ISO 17799 does not serve this.

By Andreas E. Fiedler

Published

© 2003 Northwest Controlling Corporation Ltd.
Internet: http://www.noweco.com/
Email: info@noweco.com.