New Standard on Information Security Management Systems Published

Published: Tuesday, November 8, 2005 - 22:00

A new international standard aims to combat information security flaws and prevent threats to ensure business continuity, minimize damage and maximize return on investments. The new standard, ISO/IEC 27001:2005 was jointly published by the International Organization for Standardization and the International Electrotechnical Commission. It integrates the process-based approach of management system standards in a framework for companies to use in protecting information security. It complements the recently revised ISO/IEC 17799:2005, which describes and lists individual security controls that may be applied as part of the security management system described by ISO/IEC 27001.

“The publication of ISO/IEC 27001:2005 is a big event in the world of information security and the standard has been eagerly awaited,” says Ted Humphreys, convenor of the working group responsible for managing the standard’s development. “It is a standard that all security-conscious organizations should look to implement.”

The new standard is designed to be applicable to a wide range of commercial and industrial sectors. It specifies a general framework for a business to establish, implement, review and monitor, and manage and maintain an effective Information Security Management System.

For more information, visit www.ansi.org or www.iso.org.

About The Author

Quality Digest

For 40 years Quality Digest has been the go-to source for all things quality. Our newsletter, Quality Digest, shares expert commentary and relevant industry resources to assist our readers in their quest for continuous improvement. Our website includes every column and article from the newsletter since May 2009 as well as back issues of Quality Digest magazine to August 1995. We are committed to promoting a view wherein quality is not a niche, but an integral part of every phase of manufacturing and services.