Readiness Consulting
GRC Certification ISMS - ISO 27000 series
GRC Certification ITSMS - ITIL / ISO 20000
GRC Certification BCMS - BS 25999
IT Security Training
HISP GRC Certification
GRC Certification Controls Framework Development
GRC Certification Governance, Risk and Compliance (GRC)
IT Security Training
HISP GRC Certification
Independent Assessment
GRC Certification Compliance/Readiness Assessment
GRC Certification Integrated Assessment
GRC Certification Maturity Assessment
GRC Certification Management System Maintenance
GRC Certification Data Security Audit
GRC Certification Shared Assessment Audit
GRC Certification Internal Audit
GRC Certification Mock Audit
IT Security Training
HISP GRC Certification
Consumer Success Stories
GRC Certification

IT Security Training
HISP GRC Certification
GRC Certification eFortresses and Avalution Announce Ground Breaking Alliance
GRC Certification Governance, Risk and Compliance (GRC) consulting practice launched
GRC Certification Download Enterprise IT GRC Podcast
GRC Certification Download Business Continuity Brochure
GRC Certification The Confusion over BCMS Standards
IT Security Training
HISP GRC Certification
GRC Certification
Readiness Consulting - ISMS - ISO 27000 series
GRC Certification

What is the ISO 27000 series?

The ISO/IEC 27000-series (also known as the 'ISMS Family of Standards' or 'ISO27k' for short) comprises information security standards published jointly by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC).

The series provides best practice recommendations on information security management, risks and controls within the context of an overall Information Security Management System (ISMS), similar in design to management systems for quality assurance (the ISO 9000 series) and environmental protection (the ISO 14000 series).

The series is deliberately broad in scope, covering more than just privacy, confidentiality and IT or technical security issues. It is applicable to organizations of all shapes and sizes. All organizations are encouraged to assess their information security risks, and then implement appropriate information security controls according to their needs, using the guidance and suggestions where relevant. Given the dynamic nature of information security, the ISMS concept incorporates continuous feedback and improvement activities, summarized by Deming's "plan-do-check-act" approach, that seek to address changes in the threats, vulnerabilities or impacts of information security incidents.

The standards are the product of ISO/IEC JTC1 (Joint Technical Committee 1) SC27 (Sub Committee 27), an international body that meets in person twice a year.

At present, six of the standards in the series are publicly available while several more are under development.

Published standards

ISO/IEC 27000 - Information security management systems - Overview and vocabulary
ISO 27001 - Information security management systems - Requirements
ISO/IEC 27002 - Code of practice for information security management
ISO/IEC 27003 - Information security management system implementation guidance
ISO/IEC 27004 - Information security management - Measurement
ISO/IEC 27005 - Information security risk management
ISO/IEC 27006 - Requirements for bodies providing audit and certification of information security management systems
ISO/IEC 27011 - Information security management guidelines for telecommunications organizations based on ISO/IEC 27002

In preparation

ISO/IEC 27007 - Guidelines for information security management systems auditing
ISO/IEC 27008 - a guideline for Information Security Management auditing
ISO/IEC 27013 - a guideline on the integrated implementation of ISO/IEC 20000-1 and ISO 27001
ISO/IEC 27014 - an information security governance framework
ISO/IEC 27015 - information security management guidelines for the finance and insurance sectors
ISO/IEC 27031 - a guideline for ICT readiness for business continuity
ISO/IEC 27032 - a guideline for cybersecurity
ISO/IEC 27033 - IT network security, a multi-part standard based on ISO/IEC 18028:2006
ISO/IEC 27034 - a guideline for application security

Why adopt the ISO 27000 series?

ISO/IEC 27002, which is a "Code of practice" that can be used to build a comprehensive and robust information security program, however ISO 27001:2005 is a certifiable standard, intended to provide the foundation for third-party audit, and is "harmonized" with other management standards such as ISO 9001 (quality management) and ISO 14001 (environmental management). In other words, an Information Security Management System (ISMS) developed for ISO 27001 certification can be integrated with existing management systems, within the organization.

Unlike other existing security-related certifications such as SAS 70 and WebTrust, ISO 27001:2005 certification is much more comprehensive, and specifically focused on Information security management.

ISO 27001 certification enables organizations to clearly demonstrate that their IS programs are not only effective, but also regularly reviewed and updated based on the plan-do-check-act (PDCA) process model, covering performance, effectiveness monitoring and review, and continual improvement.

Some of the benefits of pursuing certification to ISO 27001:2005 include:

Certification allows organizations to mitigate the risk of IS breaches
Certification allows organizations to mitigate the impact of Information security breaches when they do occur
In the event of a security breach, certification should reduce the penalty imposed by regulators, since the organization's security and record-handling procedures will be seen as following internationally accepted best practices
Certification allows organizations to demonstrate due diligence and due care to shareholders, customers and business partners, through strategic thinking
Certification allows organizations to demonstrate proactive compliance to legal, regulatory and contractual requirements, as opposed to taking a reactive approach
Certification provides independent third-party validation of an organization's ISMS
ISO 27001 is the most comprehensive Information security management certification that is internationally accepted
ISO/IEC 27033 - IT network security, a multi-part standard based on ISO/IEC 18028:2006
ISO/IEC 27034 - a guideline for application security

Certification programs such as SAS 70 and WebTrust cannot provide all the benefits listed above, due to their limited scope.

Source: Wikipedia

How can eFortresses assist?

ISO/IEC 27002:2005 Compliance

eFortresses assists organizations desiring ISO/IEC 27002 compliance by providing value added services, including:

Gap Analysis / Compliance Roadmap
Security Program Development
Security Policy Development
IT Risk Assessments
Attack & Penetration Testing
Network Security Architecture
Computer Forensics

ISO 27001:2005 Certification

eFortresses offers 6-week to 6-month consulting service for organizations seeking ISO 27001 certification, including:

Risk Management Framework development using ISO 27005
Risk Assessment & Treatment process using ISO 27005
Asset Register development
Asset Classification & Control
Compliance/Readiness Assessment / Remediation Plan / Certification Roadmap
Early Selection of Accredited Certification Body
Scoping Exercise including Scope Document, Statement of Applicability development
Regulatory Compliance Controls Mapping
Integration of ISMS with COBIT, COSO, ITIL/ISO 20000 etc
Mock ISMS Audit to simulate Internal and/or External audit process
Internal ISMS Audit; Desktop review of Documentation, Control Objectives and Control Evidence
Information Security Forum/Committee development
Preventative and Corrective Action Plan development
Facilitation of ISMS Pre-Assessment, Stage I and Stage II Audit
ISMS Maintenance including Corrective Actions, Continuous Improvement, Metrics, Surveillance Audit

For more information, please contact us by filling out this form

Name *  
Title *  
Email *  
Telephone *  
Job Title *  
Company *  
Address *  
City *  
State/Province *  
Postal/Zip *  
Country *  

Security image:

Verification (Type what you see (case-sensitive)):
Comments *  
GRC Certification

GRC Certification
GRC Certification
IT Security Training
GRC Certification HISP GRC Certification
Bookmark and Share