ISO/IEC JTC 1/SC 27 Information Technology -- Security .

4Concept and principles4.1 Overview of drivers and development of projects within different SC27 WGsThe drivers behind the start of projects within an SC27 WG are either business driven ortechnology driven. And in some cases they are driven by both business and technology.Currently this description is limited to WG1 and WG4 in order to explain the structure but theprinciple of connecting the different standards shall be applicable to all WGs within SC27.WG1 standards are mostly driven by business, but the standards of other WGs, such as WG4, aremainly driven by technology. The link especially between WG1 and WG4 can be seen in inISO/IEC 27002 and in the Annex A of ISO/IEC 27001 as duplication of the control objectives andcontrols in ISO/IEC 27002. The coordination development of projects is done by separateroadmaps (SD3).Fig 1 Showing drivers for different types of standards in this case belonging to WG1 and WG4In figure 1 the example is showing the following:a) WG1 standards/projects are management system drivenb) WG4 standards/projects are technology drivenc) The interface between them is in first instance ISO/IEC 27001- Annex and ISO/IEC 27002 andsecondly ISO/IEC 27000 containing overall concepts and definitions etc.4.2Inter relationship within SC27 WGsInter-relationship of ISMS ISO/IEC27001 to other standards is wide and complex.For an ISL concept to work the existing relationships should be made clear and those that arenot that evident should ideally be made much clearer through an ISL approach. Today this isthe intention of ISO/IEC 27000 which covers existing/published standards. But for a user, this

link is not that evident. And for ongoing projects, SD3 roadmaps are used, but these areseparated for the WG. The current situation including links to standards outside SC27 is shownin Fig 2 and the titles and WG are listed in Annex A.Fig 2 Links to other standards from ISO/EC 27001 (ISMS)

5Control connection and development of ISO/IEC 27002 and Annex A in ISO/IEC 270015.1 Current connections and objectives as per ISO/IEC 27002:2013 and ISO/IEC 27001:2013The ISO/IEC 27002 includes controls and the ISO/IEC27001-Annex A as well. The current linkagecan be seen in Annex A in this document. Many controls are not connected outside WG1 but thereare many that are connected to other projects/Standards. And even if a full investigation has notbeen made the connections are evident. This overlap and future development of controls could behandled in several ways but the objectives should be to improve usability for the users, increasequality and reduce workload for the experts.5.2 Suggested process of changing controls of ISO/IEC27001The suggested process for future development of controls which is the fundamental aspect of ISLis to cover the three principles below:a) All controls in Annex A in ISO/IEC 27001 are developed by WG1 including the guideline textin ISO/IEC 27002b) For any control if there is a corresponding project or standard in any SC27 WG, includingWG1, this standard should connect to the control by stating this clearly preferably byrepeating the objective and the underlying control or controls in the body of the standard.c) Any project that is started in any WG that wants to add controls to Annex A has to formulateobjectives and controls and provides those to WG1 for suggested update of Annex A.Subsequently a brief guidance text has also to be produced by that project forISO/IEC27002. WG1 decides whether to include the control or not.The requirements and guidance in this SD is based upon the above principlesAs an example of how development can be done as alternative c) above:Clause 16 of ISO/IEC 27002:2013 (as well as the ref in Annex a) is about Information SecurityIncident Management. In contains one objective and seven controls. The guidance in ISO/IEC27002 is one page. ISO/IEC 270035 on incident management is a multipart standard withguidance on at least 60 pages on the same subject (currently under revision). There issubsequently a risk that the guidance and the controls in ISO/IEC 27002 are not fully aligned withISO/IEC27035 or vice versa.Within the ISL concept, Clause 16 should be based upon ISO/IEC 27035 and WG4 should beresponsible for providing the controls and the guidance to ISO/IEC27002 (as well as the Annex Ain ISO/IEC 27001.) WG1 being the “owner” of ISO/IEC 27002 should decide the forms for thecontribution and time schedule etc. for revisions etc. The form could include both a given page slot(this might well still be one page) as well as the structure and format for the clause.5.3 Guidance on ISL establishmentShort-term the development of ISL may be done by setting the internal procedures within SC 27and developing a roadmap to determine the release date for the new version of ISO/IEC 27002(and Annex A in ISO/IEC 27001) based upon current projects and released standards etc. Oncedecided, the marketing of ISL may start at a given time. The short-term phase ends when the firstrevised version of ISO/IEC 27002 according to ISL is published.Long-term development should be driven by that ISO/IEC 27002 (and Annex A in ISO/IEC 27001)are revised based upon other SC27 standards revisions and new projects arising.

6Roles and responsibilities during ISL lifecycle6.1Approval of ISL SWG-T is responsible for the process up to approval of this document6.2First adaptation and update next version of ISO/IEC 27002 according to ISL WG1 is responsible for identifying projects that should be linked to objectives and/orcontrols Any SC27 WG that wants controls to be included in ISO/IEC 27002 and then also Annex Ain ISO/IEC 27001 shall notify WG1 Each WG is responsible to provide text for each identified objective and/or control andguidance text. WG1 is responsible for deciding upon inclusion and then including and adjusting textsreceived from other WG:s WG1 is responsible for updating Annex A in ISO/IEC 27001.6.3Continuous updating ISO/IEC 27002 WG1 is responsible for monitoring the need to update/change ISO/IEC 27002 and Annex Ain ISO/IEC 27001 Each WG that wants to add/change objectives and/or controls in ISO/IEC 27002 will submitthese changes to WG1 WG1 is responsible for the decision process for updating ISO/IEC 270026.4ISL external communication The responsibilities for external communication of ISL will be determined at a later date anddescribed in a later version of this document

7ISL requirements and guidance7.1 Requirement of ISL structureThe relationship between ISO/IEC 27001 Annex A controls and connected standards shall beupdated in the same process and documented in a single source.7.1.1 Guidance for procedure for SWG-T on ISL structureThe ISL connections should be handled and governed by SWG-T in a format that enables crossconnection, such as an Excel sheet or DB solution where:a) All ongoing projects are listed with linkage to Annex Ab) All published standards/TRs are linkedThe actual registration of the documented information in the ISL should be done by the WGs.The ISL DB should present at least two types of output:c) An ISL report that shows the linkage of published standards etc. to be used externallyd) An internal ISL report that shows the linkage of published standards and ongoing projectsetc. to be used within SC27SWG-T ISL editing meeting should be held to assure accuracy of the reports.(Ed note: SDx Annex A is a draft of linkage of projects to WG1 and WG4 as of 2014)7.2 Requirement of ISL structure communicationThe ISL structure shall be communicated to the users of SC27 published documents7.2.1 Guidance for procedure for ISL structure communicationThe ISL report should be prepared so that it has a ready format to be updated when so decidedand made available on ISO web as well as any other source.The format and the report should have a name such as ISO SC27 Information Security Library andversion.The report should contain a description on how to use the report, how it is updated etc.

8SD requirement of control linkage for ISO/IEC 27001 Annex A and ISO/IEC 270028.1Requirement for control connection of ISO/IEC 27002 and Annex A in ISO/IEC 27001a) All controls in Annex A in ISO/IEC 27001 shall be approved by WG1 including the guidelinetext in ISO/IEC 27002b) For a control for which a corresponding standard exists, this standard shall correspond tothe control byi.Referencing the controlii.Stating the control objective which shall be identical to the control objective in thecorresponding standardiii.The controls linked to the objective shall be identical to controls found in thecorresponding standardiv.The guidance text shall be short in ISO/IEC 27002 and based upon the text in thecorresponding standardc) Any project that is started in any WG that wants to add controls to Annex A and ISO/IEC27002 shall formulate objectives and controls provide these to WG1 for a suggested updateof Annex A and ISO/IEC 27002. Subsequently a brief guidance text should also to beproduced by that project for ISO/IEC27002. WG1 will make a decision whether to includethe control and when.8.2Roadmap for adapting ISL to ISO/IEC 27001 Annex A and ISO/IEC 27002a) Based on Annex B decide which standard the control reference should be made based onexisting version of 27001 Annex 1. Then consider the below bulletsi.The objective can stay as is and just the ref to the corresponding SC27 standardii.The objective has to be rephrased to be aligned with the corresponding standardiii.The corresponding standard has no clear reference to the objective and has to berevised in the next revisioniv.The control can stay as is and just reference the corresponding SC27 standardv.The control has to be rephrased to be aligned with the corresponding standardvi.The corresponding standard has no clear reference to the control and has to berevised in the next revisionb) Additional controlsi.Review of standards published after the last version of ISO/IEC 27002ii.Decide objectives and controls that should be added to ISO/IEC 27002 and ISO/IEC27001 Annex Aiii.Form the objective and controliv.Determine if the corresponding standard needs to be revisedc) Futurei.This should follow as 7.1 c).

Annex A Standards and WG:sStandardTitleCommentISO/IEC27000— Information technology - Security Techniques - Information securitymanagement systems — Overview and vocabularyWG1ISO/IEC27001— Information technology - Security Techniques - Information securitymanagement systems — Requirements.WG1ISO/IEC27002— Information technology - Security Techniques - Code of practice forinformation security managementWG1ISO/IEC27003— Information technology - Security Techniques - Information securitymanagement system implementation guidanceWG1ISO/IEC27004— Information technology - Security Techniques - Information securitymanagement — MeasurementWG1ISO/IEC27005— Information technology - Security Techniques - Information securityrisk managementWG1ISO/IEC27006— Requirements for bodies providing audit and certification ofinformation security management systemsWG1ISO/IEC27007— Information technology - Security Techniques - Guidelines forinformation security management systems auditing (focused on themanagement system)WG1ISO/IECTR 27008— Guidance for auditors on ISMS controls (focused on the informationsecurity controls)WG1ISO/IEC27009- Information technology — Security techniques — Sector-specificapplication of ISO/IEC 27001 — RequirementsWG1ISO/IEC27010— Information technology — Security techniques — Information securitymanagement for inter-sector and inter-organizational communicationsWG1ISO/IEC27011— Information technology - Security Techniques - Information securitymanagement guidelines for telecommunications organizations based onISO/IEC 27002WG1ISO/IEC27013— Information technology - Security Techniques - Guideline on theintegrated implementation of ISO/IEC 27001 and ISO/IEC 20000-1WG1ISO/IEC27014— Information technology - Security Techniques - Information securitygovernanceWG1ISO/IECTR 27015IT Security — Security techniques — Information security management –Organizational economicsWG1ISO/IECTR 27016— IT Security — Security techniques — Information securitymanagement – Organizational economicsWG1ISO/IEC— Information security management for cloud systemsWG1

27017ISO/IEC27018— Data protection for cloud systemsWG1ISO/IEC27019— Information security management guidelines based on ISO/IEC 27002for process control systems specific to the energy utility industryWG1ISO/IEC27031— Information technology - Security Techniques - Guidelines forinformation and communication technology readiness for businesscontinuityWG4ISO/IEC27032— Information technology - Security Techniques - Guideline forcybersecurityWG4ISO/IEC27033— Information technology - Security Techniques - Network securityWG4ISO/IEC27034— Information technology - Security Techniques - Application securityWG4ISO/IEC27035— Information technology - Security Techniques - Information securityincident managementWG4ISO/IEC27036— Information technology - Security Techniques - Information securityfor supplier relationships -WG4ISO/IEC27037— Information technology - Security Techniques - Guidelines foridentification, collection, acquisition and preservation of digital evidenceWG4ISO/IEC27038— Specification for redaction of digital documentsWG4ISO/IEC27039— Intrusion detection and protection systemsWG4ISO/IEC27040— Guideline on storage securityWG4ISO/IEC27041— Assurance for digital evidence investigation methodsWG4ISO/IEC27042— Analysis and interpretation of digital evidenceWG4ISO/IEC27043— Digital evidence investigation principles and processesWG4ISO/IEC27044- Information technology — Security techniques — Guidelines forsecurity information and event management (SIEM)WG4ISO/IEC27050- Information technology -- Security techniques -- Electronic discoveryWG4ISO 27799— Information security management in health using ISO/IEC 27002Not SC27

Annex B: ISO/IEC 27001 ANNEX A control ref. to WG and standards/projectsFirst Drafted table 2014-09-12Last to columns is for notes during editing development of the annexRef toISO/IEC27001:2013ControlA.5.1.1Policies forinformationsecurityA.5.1.2Review of the policiesfor informationsecurityA.6.1.1Information securityroles andresponsibilitiesA.6.1.2Segregation of dutiesA.6.1.3Contact withauthoritiesA.6.1.4Contact with specialinterest groupsA.6.1.5A.6.2.1Information securityin projectmanagementMobile device ms and conditionsof y measure descriptionRefWGA set of policies for information securityshall be defined, approved bymanagement, published andcommunicated to employees and relevantexternal parties.The policies for information security shallbe reviewed at planned intervals or ifsignificant changes occur to ensure theircontinuing suitability, adequacy andeffectiveness.All information security responsibilitiesshall be defined and allocated.27001 5.2WG1Nonespecific27001:5.3WG1WG1Conflicting duties and areas ofresponsibility shall be segregated to reduceopportunities for unauthorized orunintentional modification or misuse of theorganization’s assets.Appropriate contacts with relevantauthorities shall be ate contacts with special interestgroups or other specialist security forumsand professional associations shall bemaintained.Information security shall be addressed inproject management, regardless of thetype of the project.A policy and supporting security measuresshall be adopted to manage the risksintroduced by using mobile devices.NonespecificWG1A policy and supporting security measuresshall be implemented to protectinformation accessed, processed or storedat teleworking sites.Background verification checks on allcandidates for employment shall be carriedout in accordance with relevant laws,regulations and ethics and shall beproportional to the business requirements,the classification of the information to beaccessed and the perceived risks.The contractual agreements withemployees and contractors shall state theirand the organization’s responsibilities forinformation security.Management shall require all employeesand contractors to apply informationsecurity in accordance with the establishedpolicies and procedures of pecificNonespecificNonespecificCommentCovers IS policy No relevanceto controldevelopmentjustalignmentCover rolesetc.Might be moreref (Contentcheck?)WG1WG1WG1WG1ViewNo relevanceto controldevelopmentjustalignment

8.1.3A.8.1.4Information securityawareness, educationand trainingAll employees of the organization and,where relevant, contractors shall receiveappropriate awareness education andtraining and regular updates inorganizational policies and procedures,asrelevant for their job function.Disciplinary processThere shall be a formal and communicateddisciplinary process in place to take actionagainst employees who have committed aninformation security breach.Termination or change Information security responsibilities andof employmentduties that remain valid after terminationresponsibilitiesor change of employment shall be defined,communicated to the employee orcontractor and enforced.Inventory of assetsAssets associated with information andinformation processing facilities shall beidentified and an inventory of these assetsshall be drawn up and maintained.Ownership of assetsAssets maintained in the inventory shall beownedAcceptable use ofRules for the acceptable use of informationassetsand of assets associated with informationand information processing facilities shallbe identified, documented andimplemented.Return of assetsAll employees and external party usersshall return all of the organizational assetsin their possession upon termination oftheir employment, contract or agreement.A.8.2.1Classification ofinformationA.8.2.2Labelling ofinformationA.8.2.3Handling of assetsA.8.3.1Management ofremovable mediaA.8.3.2Disposal of mediaA.8.3.3Physical mediatransferA.9.1.1Access control policyInformation shall be classified in terms oflegal requirements, value, criticality andsensitivity to unauthorised disclosure ormodification.An appropriate set of procedures forinformation labelling shall be developedand implemented in accordance with theinformation classification scheme adoptedby the organization.Procedures for handling assets shall bedeveloped and implementedin accordance with the informationclassification scheme adopted by theorganization.Procedures shall be implemented for themanagement of removable media inaccordance with the classification schemeadopted by the organization.Media shall be disposed of securely whenno longer required, usingformal procedures.Coverscompetenceand awareness27001: 40Media containing information shall be?protected against unauthorizeda

Aug 02, 2016 · 5 Control connection and development of ISO/IEC 27002 and Annex A in ISO/IEC 27001 9 5.1 Current connections and objectives as per ISO/IEC 27002:2013 and ISO/IEC 27001:2013 9 5.2 Suggested process of changing controls of ISO/IEC27001 9 5.3 Guidance on ISL establishment 9 6 Roles and respon