ISO/IEC 17799:2000
(Main)Information technology — Code of practice for information security management
Information technology — Code of practice for information security management
Technologies de l'information — Code de pratique pour la gestion de sécurité d'information
Informacijska tehnologija - Kodeks upravljanja varovanja informacij
General Information
Relations
Buy Standard
Standards Content (Sample)
INTERNATIONAL ISO/IEC
STANDARD 17799
First edition
2000-12-01
Information technology — Code of practice
for information security management
Technologies de l'information — Code de pratique pour la gestion de
sécurité d'information
Reference number
ISO/IEC 17799:2000(E)
©
ISO/IEC 2000
---------------------- Page: 1 ----------------------
ISO/IEC 17799:2000(E)
PDF disclaimer
This PDF file may contain embedded typefaces. In accordance with Adobe's licensing policy, this file may be printed or viewed but shall not
be edited unless the typefaces which are embedded are licensed to and installed on the computer performing the editing. In downloading this
file, parties accept therein the responsibility of not infringing Adobe's licensing policy. The ISO Central Secretariat accepts no liability in this
area.
Adobe is a trademark of Adobe Systems Incorporated.
Details of the software products used to create this PDF file can be found in the General Info relative to the file; the PDF-creation parameters
were optimized for printing. Every care has been taken to ensure that the file is suitable for use by ISO member bodies. In the unlikely event
that a problem relating to it is found, please inform the Central Secretariat at the address given below.
© ISO/IEC 2000
All rights reserved. Unless otherwise specified, no part of this publication may be reproduced or utilized in any form or by any means, electronic
or mechanical, including photocopying and microfilm, without permission in writing from either ISO at the address below or ISO's member body
in the country of the requester.
ISO copyright office
Case postale 56 � CH-1211 Geneva 20
Tel. + 41 22 749 01 11
Fax + 41 22 749 09 47
E-mail copyright@iso.ch
Web www.iso.ch
Printed in Switzerland
ii © ISO/IEC 2000 – All rights reserved
---------------------- Page: 2 ----------------------
ISO/IEC 17799:2000(E)
Contents
FOREWORD.VII
INTRODUCTION. VIII
WHAT IS INFORMATION SECURITY?.VIII
WHY INFORMATION SECURITY IS NEEDED.VIII
HOW TO ESTABLISH SECURITY REQUIREMENTS. IX
ASSESSING SECURITY RISKS . IX
SELECTING CONTROLS.X
INFORMATION SECURITY STARTING POINT .X
CRITICAL SUCCESS FACT ORS.X
DEVELOPING YOUR OWN GUIDELINES. XI
1 SCOPE.1
2 TERMS AND DEFINITIONS.1
3 SECURITY POLICY.1
3.1 INFORMATION SECURITY POLICY.1
3.1.1 Information security policy document .1
3.1.2 Review and evaluation.2
4 ORGANIZATIONAL SECURITY.2
4.1 INFORMATION SECURITY INFRASTRUCTURE .2
4.1.1 Management information security forum.3
4.1.2 Information security co-ordination.3
4.1.3 Allocation of information security responsibilities.3
4.1.4 Authorization process for information processing facilities.4
4.1.5 Specialist information security advice.4
4.1.6 Co-operation between organizations.5
4.1.7 Independent review of information security .5
4.2 SECURITY OF THIRD PARTY ACCESS .5
4.2.1 Identification of risks from third party access .5
4.2.2 Security requirements in third party contracts.6
4.3 OUTSOURCING.7
4.3.1 Security requirements in outsourcing contracts.7
5 ASSET CLASSIFICATION AND CONTROL.8
5.1 ACCOUNTABILITY FOR ASSETS.8
5.1.1 Inventory of assets.8
5.2 INFORMATION CLASSIFICATION.9
5.2.1 Classification guidelines.9
5.2.2 Information labelling and handling.9
6 PERSONNEL SECURITY .10
6.1 SECURITY IN JOB DEFINITION AND RESOURCING. 10
6.1.1 Including security in job responsibilities.10
6.1.2 Personnel screening and policy.10
6.1.3 Confidentiality agreements.11
6.1.4 Terms and conditions of employment .11
6.2 USER TRAINING. 11
6.2.1 Information security education and training.11
6.3 RESPONDING TO SECURITY INCIDENTS AND MALFUNCTIONS. 12
6.3.1 Reporting security incidents.12
6.3.2 Reporting security weaknesses .12
6.3.3 Reporting software malfunctions.12
6.3.4 Learning from incidents.13
© ISO/IEC 2000 – All rights reserved iii
---------------------- Page: 3 ----------------------
ISO/IEC 17799:2000(E)
6.3.5 Disciplinary process.13
7 PHYSICAL AND ENVIRONMENTAL SECURITY .13
7.1 SECURE AREAS. 13
7.1.1 Physical security perimeter.13
7.1.2 Physical entry controls.14
7.1.3 Securing offices, rooms and facilities.14
7.1.4 Working in secure areas.15
7.1.5 Isolated delivery and loading areas.15
7.2 EQUIPMENT SECURITY. 16
7.2.1 Equipment siting and protection.16
7.2.2 Power supplies.17
7.2.3 Cabling security.17
7.2.4 Equipment maintenance.17
7.2.5 Security of equipment off-premises .18
7.2.6 Secure disposal or re-use of equipment .18
7.3 GENERAL CONTROLS. 18
7.3.1 Clear desk and clear screen policy.19
7.3.2 Removal of property .19
8 COMMUNICATIONS AND OPERATIONS MANAGEMENT .19
8.1 OPERATIONAL PROCEDURES AND RESPONSIBILITIES. 19
8.1.1 Documented operating procedures.19
8.1.2 Operational change control.20
8.1.3 Incident management procedures .20
8.1.4 Segregation of duties.21
8.1.5 Separation of development and operational facilities.22
8.1.6 External facilities management.22
8.2 SYSTEM PLANNING AND ACCEPTANCE. 23
8.2.1 Capacity planning.23
8.2.2 System acceptance.23
8.3 PROTECTION AGAINST MALICIOUS SOFTWARE. 24
8.3.1 Controls against malicious software .24
8.4 HOUSEKEEPING. 25
8.4.1 Information back -up.25
8.4.2 Operator logs.25
8.4.3 Fault logging.25
8.5 NETWORK MANAGEMENT . 26
8.5.1 Network controls.26
8.6 MEDIA HANDLING AND SECURITY. 26
8.6.1 Management of removable computer media.26
8.6.2 Disposal of media.27
8.6.3 Information handling procedures.27
8.6.4 Security of system documentation.28
8.7 EXCHANGES OF INFORMAT ION AND SOFTWARE. 28
8.7.1 Information and software exchange agreements.28
8.7.2 Security of media in transit.29
8.7.3 Electronic commerce security.29
8.7.4 Security of electronic mail.30
8.7.5 Security of electronic office systems .31
8.7.6 Publicly available systems.31
8.7.7 Other forms of information exchange.32
9 ACCESS CONTROL.33
9.1 BUSINESS REQUIREMENT FOR ACCESS CONTROL. 33
9.1.1 Access control policy.33
9.2 USER ACCESS MANAGEMENT . 34
9.2.1 User registration.34
9.2.2 Privilege management.34
9.2.3 User password management .35
iv © ISO/IEC 2000 – All rights reserved
---------------------- Page: 4 ----------------------
ISO/IEC 17799:2000(E)
9.2.4 Review of user access rights.35
9.3 USER RESPONSIBILITIES. 36
9.3.1 Password use .36
9.3.2 Unattended user equipment.36
9.4 NETWORK ACCESS CONTROL. 37
9.4.1 Policy on use of network services.37
9.4.2 Enforced path.37
9.4.3 User authentication for external connections.38
9.4.4 Node authentication.38
9.4.5 Remote diagnostic port protection.38
9.4.6 Segregation in networks.39
9.4.7 Network connection control.39
9.4.8 Network routing control.39
9.4.9 Security of network services.40
9.5 OPERATING SYSTEM ACCE SS CONTROL . 40
9.5.1 Automatic terminal identification.40
9.5.2 Terminal log-on procedures.40
9.5.3 User identification and authentication.41
9.5.4 Password management system.41
9.5.5 Use of system utilities.42
9.5.6 Duress alarm to safeguard users.42
9.5.7 Terminal time-out.42
9.5.8 Limitation of connection time.42
9.6 APPLICATION ACCESS CONTROL. 43
9.6.1 Information access restriction.43
9.6.2 Sensitive system isolation.43
9.7 MONITORING SYSTEM ACCESS AND USE. 44
9.7.1 Event logging .44
9.7.2 Monitoring system use.44
9.7.3 Clock synchronization.45
9.8 MOBILE COMPUTING AND TELEWORKING. 46
9.8.1 Mobile computing.46
9.8.2 Teleworking.46
10 SYSTEMS DEVELOPMENT AND MAINTENANCE.47
10.1 SECURITY REQUIREMENTS OF SYSTEMS. 47
10.1.1 Security requirements analysis and specification.48
10.2 SECURITY IN APPLICATION SYSTEMS. 48
10.2.1 Input data validation.48
10.2.2 Control of internal processing.49
10.2.3 Message authentication.49
10.2.4 Output data validation.50
10.3 CRYPTOGRAPHIC CONTROLS. 50
10.3.1 Policy on the use of cryptographic controls.50
10.3.2 Encryption .50
10.3.3 Digital signatures.51
10.3.4 Non-repudiation services.51
10.3.5 Key management.52
10.4 SECURITY OF SYSTEM FILES. 53
10.4.1 Control of operational software.53
10.4.2 Protection of system test data .53
10.4.3 Access control to program source library.54
10.5 SECURITY IN DEVELOPMENT AND SUPPORT PROCE SSES. 54
10.5.1 Change control procedures.54
10.5.2 Technical review of operating system changes.55
10.5.3 Restrictions on changes to software packages.55
10.5.4 Covert channels and Trojan code .56
10.5.5 Outsourced software development.56
11 BUSINESS CONTINUITY MANAGEMENT .56
© ISO/IEC 2000 – All rights reserved v
---------------------- Page: 5 ----------------------
ISO/IEC 17799:2000(E)
11.1 ASPECTS OF BUSINESS CONTINUITY MANAGEMENT. 56
11.1.1 Business continuity management process.57
11.1.2 Business continuity and impact analysis.57
11.1.3 Writing and implementing continuity plans.57
11.1.4 Business continuity planning framework .58
11.1.5 Testing, maintaining and re-assessing business continuity plans.59
12 COMPLIANCE .60
12.1 COMPLIANCE WITH LEGAL REQUIREMENTS. 60
12.1.1 Identification of applicable legislation.60
12.1.2 Intellectual property rights (IPR).60
12.1.3 Safeguarding of organizational records.61
12.1.4 Data protection and privacy of personal information.62
12.1.5 Prevention of misuse of information processing facilities.62
12.1.6 Regulation of cryptographic controls.62
12.1.7 Collection of evidence.63
12.2 REVIEWS OF SECURITY P OLICY AND TECHNICAL COMPLIANCE . 63
12.2.1 Compliance with security policy.63
12.2.2 Technical compliance checking.64
12.3 SYSTEM AUDIT CONSIDERATIONS. 64
12.3.1 System audit controls.64
12.3.2 Protection of system audit tools.65
vi © ISO/IEC 2000 – All rights reserved
---------------------- Page: 6 ----------------------
ISO/IEC 17799:2000(E)
Foreword
ISO (the International Organization for Standardization) and IEC (the International Electrotechnical Commission)
form the specialized system for worldwide standardization. National bodies that are members of ISO or IEC
participate in the development of International Standards through technical committees established by the
respective organization to deal with particular fields of technical activity. ISO and IEC technical committees
collaborate in fields of mutual interest. Other international organizations, governmental and non-governmental, in
liaison with ISO and IEC, also take part in the work.
International Standards are drafted in accordance with the rules given in the ISO/IEC Directives, Part 3.
In the field of information technology, ISO and IEC have established a joint technical committee, ISO/IEC JTC 1.
Draft International Standards adopted by the joint technical committee are circulated to national bodies for voting.
Publication as an International Standard requires approval by at least 75 % of the national bodies casting a vote.
Attention is drawn to the possibility that some of the elements of this International Standard may be the subject of
patent rights. ISO and IEC shall not be held responsible for identifying any or all such patent rights.
International Standard ISO/IEC 17799 was prepared by the British Standards Institution (as BS 7799) and was
adopted, under a special “fast-track procedure”, by Joint Technical Committee ISO/IEC JTC 1, Information
technology, in parallel with its approval by national bodies of ISO and IEC.
© ISO/IEC 2000 – All rights reserved vii
---------------------- Page: 7 ----------------------
ISO/IEC 17799:2000(E)
Introduction
What is information security?
Information is an asset which, like other important business assets, has value to an
organization and consequently needs to be suitably protected. Information security protects
information from a wide range of threats in order to ensure busines
...
SLOVENSKI SIST ISO/IEC 17799:2003
STANDARD
september 2003
Informacijska tehnologija - Kodeks upravljanja varovanja informacij
Information technology - Code of practice for information security management
ICS 35.040 Referenčna številka
SIST ISO/IEC 17799:2003(en)
© Standard je založil in izdal Slovenski inštitut za standardizacijo. Razmnoževanje ali kopiranje celote ali delov tega dokumenta ni dovoljeno
---------------------- Page: 1 ----------------------
INTERNATIONAL ISO/IEC
STANDARD 17799
First edition
2000-12-01
Information technology — Code of practice
for information security management
Technologies de l'information — Code de pratique pour la gestion de
sécurité d'information
Reference number
ISO/IEC 17799:2000(E)
©
ISO/IEC 2000
---------------------- Page: 2 ----------------------
ISO/IEC 17799:2000(E)
PDF disclaimer
This PDF file may contain embedded typefaces. In accordance with Adobe's licensing policy, this file may be printed or viewed but shall not
be edited unless the typefaces which are embedded are licensed to and installed on the computer performing the editing. In downloading this
file, parties accept therein the responsibility of not infringing Adobe's licensing policy. The ISO Central Secretariat accepts no liability in this
area.
Adobe is a trademark of Adobe Systems Incorporated.
Details of the software products used to create this PDF file can be found in the General Info relative to the file; the PDF-creation parameters
were optimized for printing. Every care has been taken to ensure that the file is suitable for use by ISO member bodies. In the unlikely event
that a problem relating to it is found, please inform the Central Secretariat at the address given below.
© ISO/IEC 2000
All rights reserved. Unless otherwise specified, no part of this publication may be reproduced or utilized in any form or by any means, electronic
or mechanical, including photocopying and microfilm, without permission in writing from either ISO at the address below or ISO's member body
in the country of the requester.
ISO copyright office
Case postale 56 � CH-1211 Geneva 20
Tel. + 41 22 749 01 11
Fax + 41 22 749 09 47
E-mail copyright@iso.ch
Web www.iso.ch
Printed in Switzerland
ii © ISO/IEC 2000 – All rights reserved
---------------------- Page: 3 ----------------------
ISO/IEC 17799:2000(E)
Contents
FOREWORD.VII
INTRODUCTION. VIII
WHAT IS INFORMATION SECURITY?.VIII
WHY INFORMATION SECURITY IS NEEDED.VIII
HOW TO ESTABLISH SECURITY REQUIREMENTS. IX
ASSESSING SECURITY RISKS . IX
SELECTING CONTROLS.X
INFORMATION SECURITY STARTING POINT .X
CRITICAL SUCCESS FACT ORS.X
DEVELOPING YOUR OWN GUIDELINES. XI
1 SCOPE.1
2 TERMS AND DEFINITIONS.1
3 SECURITY POLICY.1
3.1 INFORMATION SECURITY POLICY.1
3.1.1 Information security policy document .1
3.1.2 Review and evaluation.2
4 ORGANIZATIONAL SECURITY.2
4.1 INFORMATION SECURITY INFRASTRUCTURE .2
4.1.1 Management information security forum.3
4.1.2 Information security co-ordination.3
4.1.3 Allocation of information security responsibilities.3
4.1.4 Authorization process for information processing facilities.4
4.1.5 Specialist information security advice.4
4.1.6 Co-operation between organizations.5
4.1.7 Independent review of information security .5
4.2 SECURITY OF THIRD PARTY ACCESS .5
4.2.1 Identification of risks from third party access .5
4.2.2 Security requirements in third party contracts.6
4.3 OUTSOURCING.7
4.3.1 Security requirements in outsourcing contracts.7
5 ASSET CLASSIFICATION AND CONTROL.8
5.1 ACCOUNTABILITY FOR ASSETS.8
5.1.1 Inventory of assets.8
5.2 INFORMATION CLASSIFICATION.9
5.2.1 Classification guidelines.9
5.2.2 Information labelling and handling.9
6 PERSONNEL SECURITY .10
6.1 SECURITY IN JOB DEFINITION AND RESOURCING. 10
6.1.1 Including security in job responsibilities.10
6.1.2 Personnel screening and policy.10
6.1.3 Confidentiality agreements.11
6.1.4 Terms and conditions of employment .11
6.2 USER TRAINING. 11
6.2.1 Information security education and training.11
6.3 RESPONDING TO SECURITY INCIDENTS AND MALFUNCTIONS. 12
6.3.1 Reporting security incidents.12
6.3.2 Reporting security weaknesses .12
6.3.3 Reporting software malfunctions.12
6.3.4 Learning from incidents.13
© ISO/IEC 2000 – All rights reserved iii
---------------------- Page: 4 ----------------------
ISO/IEC 17799:2000(E)
6.3.5 Disciplinary process.13
7 PHYSICAL AND ENVIRONMENTAL SECURITY .13
7.1 SECURE AREAS. 13
7.1.1 Physical security perimeter.13
7.1.2 Physical entry controls.14
7.1.3 Securing offices, rooms and facilities.14
7.1.4 Working in secure areas.15
7.1.5 Isolated delivery and loading areas.15
7.2 EQUIPMENT SECURITY. 16
7.2.1 Equipment siting and protection.16
7.2.2 Power supplies.17
7.2.3 Cabling security.17
7.2.4 Equipment maintenance.17
7.2.5 Security of equipment off-premises .18
7.2.6 Secure disposal or re-use of equipment .18
7.3 GENERAL CONTROLS. 18
7.3.1 Clear desk and clear screen policy.19
7.3.2 Removal of property .19
8 COMMUNICATIONS AND OPERATIONS MANAGEMENT .19
8.1 OPERATIONAL PROCEDURES AND RESPONSIBILITIES. 19
8.1.1 Documented operating procedures.19
8.1.2 Operational change control.20
8.1.3 Incident management procedures .20
8.1.4 Segregation of duties.21
8.1.5 Separation of development and operational facilities.22
8.1.6 External facilities management.22
8.2 SYSTEM PLANNING AND ACCEPTANCE. 23
8.2.1 Capacity planning.23
8.2.2 System acceptance.23
8.3 PROTECTION AGAINST MALICIOUS SOFTWARE. 24
8.3.1 Controls against malicious software .24
8.4 HOUSEKEEPING. 25
8.4.1 Information back -up.25
8.4.2 Operator logs.25
8.4.3 Fault logging.25
8.5 NETWORK MANAGEMENT . 26
8.5.1 Network controls.26
8.6 MEDIA HANDLING AND SECURITY. 26
8.6.1 Management of removable computer media.26
8.6.2 Disposal of media.27
8.6.3 Information handling procedures.27
8.6.4 Security of system documentation.28
8.7 EXCHANGES OF INFORMAT ION AND SOFTWARE. 28
8.7.1 Information and software exchange agreements.28
8.7.2 Security of media in transit.29
8.7.3 Electronic commerce security.29
8.7.4 Security of electronic mail.30
8.7.5 Security of electronic office systems .31
8.7.6 Publicly available systems.31
8.7.7 Other forms of information exchange.32
9 ACCESS CONTROL.33
9.1 BUSINESS REQUIREMENT FOR ACCESS CONTROL. 33
9.1.1 Access control policy.33
9.2 USER ACCESS MANAGEMENT . 34
9.2.1 User registration.34
9.2.2 Privilege management.34
9.2.3 User password management .35
iv © ISO/IEC 2000 – All rights reserved
---------------------- Page: 5 ----------------------
ISO/IEC 17799:2000(E)
9.2.4 Review of user access rights.35
9.3 USER RESPONSIBILITIES. 36
9.3.1 Password use .36
9.3.2 Unattended user equipment.36
9.4 NETWORK ACCESS CONTROL. 37
9.4.1 Policy on use of network services.37
9.4.2 Enforced path.37
9.4.3 User authentication for external connections.38
9.4.4 Node authentication.38
9.4.5 Remote diagnostic port protection.38
9.4.6 Segregation in networks.39
9.4.7 Network connection control.39
9.4.8 Network routing control.39
9.4.9 Security of network services.40
9.5 OPERATING SYSTEM ACCE SS CONTROL . 40
9.5.1 Automatic terminal identification.40
9.5.2 Terminal log-on procedures.40
9.5.3 User identification and authentication.41
9.5.4 Password management system.41
9.5.5 Use of system utilities.42
9.5.6 Duress alarm to safeguard users.42
9.5.7 Terminal time-out.42
9.5.8 Limitation of connection time.42
9.6 APPLICATION ACCESS CONTROL. 43
9.6.1 Information access restriction.43
9.6.2 Sensitive system isolation.43
9.7 MONITORING SYSTEM ACCESS AND USE. 44
9.7.1 Event logging .44
9.7.2 Monitoring system use.44
9.7.3 Clock synchronization.45
9.8 MOBILE COMPUTING AND TELEWORKING. 46
9.8.1 Mobile computing.46
9.8.2 Teleworking.46
10 SYSTEMS DEVELOPMENT AND MAINTENANCE.47
10.1 SECURITY REQUIREMENTS OF SYSTEMS. 47
10.1.1 Security requirements analysis and specification.48
10.2 SECURITY IN APPLICATION SYSTEMS. 48
10.2.1 Input data validation.48
10.2.2 Control of internal processing.49
10.2.3 Message authentication.49
10.2.4 Output data validation.50
10.3 CRYPTOGRAPHIC CONTROLS. 50
10.3.1 Policy on the use of cryptographic controls.50
10.3.2 Encryption .50
10.3.3 Digital signatures.51
10.3.4 Non-repudiation services.51
10.3.5 Key management.52
10.4 SECURITY OF SYSTEM FILES. 53
10.4.1 Control of operational software.53
10.4.2 Protection of system test data .53
10.4.3 Access control to program source library.54
10.5 SECURITY IN DEVELOPMENT AND SUPPORT PROCE SSES. 54
10.5.1 Change control procedures.54
10.5.2 Technical review of operating system changes.55
10.5.3 Restrictions on changes to software packages.55
10.5.4 Covert channels and Trojan code .56
10.5.5 Outsourced software development.56
11 BUSINESS CONTINUITY MANAGEMENT .56
© ISO/IEC 2000 – All rights reserved v
---------------------- Page: 6 ----------------------
ISO/IEC 17799:2000(E)
11.1 ASPECTS OF BUSINESS CONTINUITY MANAGEMENT. 56
11.1.1 Business continuity management process.57
11.1.2 Business continuity and impact analysis.57
11.1.3 Writing and implementing continuity plans.57
11.1.4 Business continuity planning framework .58
11.1.5 Testing, maintaining and re-assessing business continuity plans.59
12 COMPLIANCE .60
12.1 COMPLIANCE WITH LEGAL REQUIREMENTS. 60
12.1.1 Identification of applicable legislation.60
12.1.2 Intellectual property rights (IPR).60
12.1.3 Safeguarding of organizational records.61
12.1.4 Data protection and privacy of personal information.62
12.1.5 Prevention of misuse of information processing facilities.62
12.1.6 Regulation of cryptographic controls.62
12.1.7 Collection of evidence.63
12.2 REVIEWS OF SECURITY P OLICY AND TECHNICAL COMPLIANCE . 63
12.2.1 Compliance with security policy.63
12.2.2 Technical compliance checking.64
12.3 SYSTEM AUDIT CONSIDERATIONS. 64
12.3.1 System audit controls.64
12.3.2 Protection of system audit tools.65
vi © ISO/IEC 2000 – All rights reserved
---------------------- Page: 7 ----------------------
ISO/IEC 17799:2000(E)
Foreword
ISO (the International Organization for Standardization) and IEC (the International Electrotechnical Commission)
form the specialized system for worldwide standardization. National bodies that are members of ISO or IEC
participate in the development of International Standards through technical committees established by the
respective organization to deal with particular fields of technical activity. ISO and IEC technical committees
collaborate in fields of mutual interest. Other international organizations, governmental and non-governmental, in
liaison with ISO and IEC, also take part in the work.
International Standards are drafted in accordance with the rules given in the ISO/IEC Directives, Part 3.
In the field of information technology, ISO and IEC have established a joint technical committee, ISO/IEC JTC 1.
Draft International Standards adopted by the joint technical committee are circulated to national bodies for voting.
Publication as an International Standard requires approval by at least 75 % of the national bodies casting a vote.
Attention is drawn to the possibility that some of the elements of this International Standard may be the subject of
patent rights. ISO and IEC shall not be held responsible for identifying any or all such patent rights.
International Standard ISO/IEC 17799 was prepared by the British Standards Institution (as BS 7799) and was
adopted, under a special “fast-track procedure”, by Joint Technical Committee ISO/IEC JTC 1, Information
techno
...
Questions, Comments and Discussion
Ask us and Technical Secretary will try to provide an answer. You can facilitate discussion about the standard in here.