In IT GRC, several standardizations are required to fulfill the compliance to underline organizations’ commitment in deliver excellent business practices. Several standards such as ISO 31000, ISO 22301, and ISO 27001 are necessary to implement GRC in an integrated manner.
ISO 27001 is the international standard focused on information security. The standard focuses on the requirements for implementing and maintaining an effective ISMS to strengthen organizations’ ability to protect themselves against cyberattacks and prevent unwanted access to sensitive and confidential information. ISO 27002, on the other hand, is a supplementary standard focusing on information security controls that organizations might choose to implement. ISO 27002 provides hundreds of potential controls and control mechanisms that are designed to be implemented with guidance provided within ISO 27001.
With the increasing number of cyber threats and potential risks faced by organization, implementing robust information security system becomes a priority to create standardized guidelines and ensure secure business environment for their customers. Therefore, ISO 27002 can be used to support organizations in achieving this. ISO 27002 is an information security reference designed to assist companies in selecting, implementing, and maintaining an Information Security Management System (ISMS). ISO 27002 is used as a more specific guide to the ISO 27001 framework for selecting appropriate security controls in the implementation of an effective ISMS.
Multimatics is fully understood the need of developing robust information ssecurity systems against hyper-competitive era and therefore, offer specialized training and certification program such as ISO 27001 Foundation and ISO 27001 Practitioner to support your team in enhancing skill and capability in network defender and ISMS improvement.
If so, what are the differences between ISO 27001 and ISO 27002?
-
Purpose
ISO 27001 specifies the requirements for improving an ISMS. ISO 27002 provides guidelines and best practices for implementing IS controls based on ISO 27001
-
Scope
ISO 27001 focuses on the overall management framework for information security within an organizations, while ISO 27002 focuses on specific security controls and practices that can be implemented to address information security risks
-
Structure
ISO 27001 follows a high-level structure outlined in Annex SL, while ISO 27002 organized into various categories, each addressing specific areas of information security
By getting certified in ISO 27001 , organizations ensure their customers’ trust by providing a safe and standarized digital environment to fulfill their needs. While the implementation of ISO 27002 support the implementation of ISO 27001 Annex A.
ISO 27002 is essential for:
- implement ISMS based on ISO/IEC 27001
- implement information security controls based on internationally recognized best practices
- develop organization-specific ISMS guidelines
What are The Attributes of ISO 27002?
- Control type: preventive, detective, corrective
- Information security properties: confidentiality, integrity, availability
- Cybersecurity concepts: identify, detect, protect, respond, recover
- Operational capabilities: including application security, asset management, continuity, governance, human resource security, etc
- Security domains: defense, governance and ecosystem, protection and resilience
Implementing the ISO/IEC 27002 certification's guiding principles is a crucial step in guaranteeing information security in organization to underline the significance of organizations having qualified specialists on their safety teams, as well as getting certified in ISO 27001 and providing better support for the process of implementing good practices connected to the norm.
If you’re interested in learn more about developing robust information security system, read also how to provenet cyber attacks in your organizations with ISO 27001
Reference:
Fenz, S., Plieschnegger, S., & Hobel, H. (2016). Mapping information security standard ISO 27002 to an ontological structure. Information & Computer Security, 24(5), 452-473.
Kurniawan, E., & Riadi, I. (2018). Security level analysis of academic information systems based on standard ISO 27002: 2003 using SSE-CMM. arXiv preprint arXiv:1802.03613.
Monev, V. (2020, September). Organisational information security maturity assessment based on ISO 27001 and ISO 27002. In 2020 International Conference on Information Technologies (InfoTech) (pp. 1-5). IEEE.
Standard, A. (2015). ISO/IEC27002. In Informationtechnology-security techniques-code of practice for information security controls,(AS ISO/IEC 27002: 2015).
