The series provides best practice recommendations on information security management—the management of information risks through information security controls—within the context of an overall Information security management system (ISMS), similar in design to management systems for quality assurance (the ISO 9000 series), environmental protection (the ISO 14000 series) and other management systems.[2][3]
The series is deliberately broad in scope, covering more than just privacy, confidentiality and IT/technical/cybersecurity issues. It is applicable to organizations of all shapes and sizes. All organizations are encouraged to assess their information risks, then treat them (typically using information security controls) according to their needs, using the guidance and suggestions where relevant. Given the dynamic nature of information risk and security, the ISMS concept incorporates continuous feedback and improvement activities to respond to changes in the threats, vulnerabilities or impacts of incidents.
The ISO/IEC standards are sold directly by ISO, mostly in English, French and Chinese. Sales outlets associated with various national standards bodies also sell directly translated versions in several languages.
Many people and organisations are involved in the development and maintenance of the ISO27K standards. The first standard in this series was ISO/IEC 17799:2000; this was a fast-tracking of the existing British standard BS 7799 part 1:1999. The initial release of BS 7799 was based, in part, on an information security policy manual developed by the Royal Dutch/Shell Group in the late 1980s and early 1990s. In 1993, what was then the Department of Trade and Industry (United Kingdom) convened a team to review existing practice in information security, with the goal of producing a standards document. In 1995, the BSI Group published the first version of BS 7799.[4] One of the principal authors of BS 7799 recalls that, at the beginning of 1993, "The DTI decided to quickly assemble a group of industry representatives from seven different sectors: Shell ([David Lacey] and Les Riley), BOC Group (Neil Twist), BT (Dennis Willets), Marks & Spencer (Steve Jones), Midland Bank (Richard Hackworth), Nationwide (John Bowles) and Unilever (Rolf Moulton)."[5] David Lacey credits the late Donn B. Parker as having the "original idea of establishing a set of information security controls", and with producing a document containing a "collection of around a hundred baseline controls" by the late 1980s for "the I-4 Information Security circle[6] which he conceived and founded.
The published ISO27K standards related to "information security, cybersecurity and privacy protection" are:
ISO/IEC 27000 — Information security management systems — Overview and vocabulary[7]
ISO/IEC 27001 — Information security, cybersecurity and privacy protection — Information security management systems — Requirements.[8] - specifies requirements for an information security management system in the same formalized, structured and succinct manner as other ISO standards specify other kinds of management systems.
ISO/IEC 27002 — Information security, cybersecurity and privacy protection — Information security controls - essentially a detailed catalog of information security controls that might be managed through the ISMS
ISO/IEC 27003 — Information security management system implementation guidance
ISO/IEC 27004 — Information security management — Monitoring, measurement, analysis and evaluation[9]
ISO/IEC 27035-1 — Information security incident management – Part 1: Principles of incident management
ISO/IEC 27035-2 — Information security incident management – Part 2: Guidelines to plan and prepare for incident response
ISO/IEC 27035-3 — Information security incident management – Part 3: Guidelines for ICT incident response operations
ISO/IEC 27035-4 — Information security incident management – Part 4: Coordination (under development)[16]
ISO/IEC 27036-1 — Information security for supplier relationships – Part 1: Overview and concepts
ISO/IEC 27036-2 — Information security for supplier relationships – Part 2: Requirements
ISO/IEC 27036-3 — Information security for supplier relationships – Part 3: Guidelines for information and communication technology supply chain security
ISO/IEC 27036-4 — Information security for supplier relationships – Part 4: Guidelines for security of cloud services
ISO/IEC 27037 — Guidelines for identification, collection, acquisition and preservation of digital evidence
ISO/IEC 27038 — Specification for Digital redaction on Digital Documents
ISO/IEC 27050-1 — Electronic discovery — Part 1: Overview and concepts
ISO/IEC 27050-2 — Electronic discovery — Part 2: Guidance for governance and management of electronic discovery
ISO/IEC 27050-3 — Electronic discovery — Part 3: Code of practice for electronic discovery
ISO/IEC 27050-4 — Electronic discovery — Part 4: Technical readiness
ISO/IEC TS 27110 — Information technology, cybersecurity and privacy protection — Cybersecurity framework development guidelines[18]
ISO/IEC 27557 — Information security, cybersecurity and privacy protection — Application of ISO 31000:2018 for organizational privacy risk management[19]
ISO/IEC 27701 — Information technology — Security Techniques — Information security management systems — Privacy Information Management System (PIMS).
ISO 27799 — Information security management in health using ISO/IEC 27002 (guides health industry organizations on how to protect personal health information using ISO/IEC 27002)
Further ISO27K standards are in preparation covering aspects such as digital forensics AI/ML security and IoT security, while the released ISO27K standards are routinely reviewed and if appropriate updated every five years or so.
^Jake Kouns, Daniel Minoli (2011). Information Technology Risk Management in Enterprise Environments : a Review of Industry Practices and a Practical Guide to Risk Management Teams. Somerset: Wiley.
