SIST ISO/IEC 27001:2013
(Main)Information technology -- Security techniques -- Information security management systems -- Requirements
Information technology -- Security techniques -- Information security management systems -- Requirements
ISO/IEC 27001:2013 specifies the requirements for establishing, implementing, maintaining and continually improving an information security management system within the context of the organization. It also includes requirements for the assessment and treatment of information security risks tailored to the needs of the organization. The requirements set out in ISO/IEC 27001:2013 are generic and are intended to be applicable to all organizations, regardless of type, size or nature.
Technologies de l'information -- Techniques de sécurité -- Systèmes de management de la sécurité de l'information -- Exigences
L'ISO/CEI 27001:2013 spécifie les exigences relatives à l'établissement, à la mise en œuvre, à la mise à jour et à l'amélioration continue d'un système de management de la sécurité de l'information dans le contexte d'une organisation. Elle comporte également des exigences sur l'appréciation et le traitement des risques de sécurité de l'information, adaptées aux besoins de l'organisation. Les exigences fixées dans l'ISO/CEI 27001:2013 sont génériques et prévues pour s'appliquer à toute organisation, quels que soient son type, sa taille et sa nature. Il n'est pas admis qu'une organisation s'affranchisse de l'une des exigences spécifiées aux Articles 4 à 10 lorsqu'elle revendique la conformité à l'ISO/CEI 27001:2013.
Informacijska tehnologija - Varnostne tehnike - Sistemi upravljanja informacijske varnosti - Zahteve
Ta mednarodni standard določa zahteve za vzpostavitev, izvajanje, vzdrževanje in nenehno izboljševanje sistema upravljanja informacijske varnosti v okviru organizacije. Ta mednarodni standard zajema tudi zahteve za ocenjevanje in obravnavanje tveganj informacijske varnosti, ki so prilagojene potrebam organizacije. Zahteve, postavljene v tem mednarodnem standardu, so generične in so namenjene uporabi v vseh organizacijah ne glede na vrsto, velikost ali naravo. Izključevanje katere koli zahteve, določene v točkah 4 do 10, ni sprejemljivo, kadar organizacija zagotavlja skladnost s tem mednarodnim standardom.
General Information
Relations
Standards Content (Sample)
SLOVENSKI STANDARD
01-november-2013
Informacijska tehnologija - Varnostne tehnike - Sistemi upravljanja informacijske
varnosti - Zahteve
Information technology -- Security techniques -- Information security management
systems -- Requirements
Technologies de l'information -- Techniques de sécurité -- Systèmes de management de
la sécurité de l'information -- Exigences
Ta slovenski standard je istoveten z: ISO/IEC 27001:2013
ICS:
35.040 Nabori znakov in kodiranje Character sets and
informacij information coding
2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.
INTERNATIONAL ISO/IEC
STANDARD 27001
Second edition
2013-10-01
Information technology — Security
techniques — Information security
management systems — Requirements
Technologies de l’information — Techniques de sécurité — Systèmes
de management de la sécurité de l’information — Exigences
Reference number
©
ISO/IEC 2013
© ISO/IEC 2013
All rights reserved. Unless otherwise specified, no part of this publication may be reproduced or utilized otherwise in any form
or by any means, electronic or mechanical, including photocopying, or posting on the internet or an intranet, without prior
written permission. Permission can be requested from either ISO at the address below or ISO’s member body in the country of
the requester.
ISO copyright office
Case postale 56 • CH-1211 Geneva 20
Tel. + 41 22 749 01 11
Fax + 41 22 749 09 47
E-mail copyright@iso.org
Web www.iso.org
Published in Switzerland
ii © ISO/IEC 2013 – All rights reserved
Contents Page
Foreword .iv
0 Introduction .v
1 Scope . 1
2 Normative references . 1
3 Terms and definitions . 1
4 Context of the organization . 1
4.1 Understanding the organization and its context . 1
4.2 Understanding the needs and expectations of interested parties . 1
4.3 Determining the scope of the information security management system . 1
4.4 Information security management system . 2
5 Leadership . 2
5.1 Leadership and commitment . 2
5.2 Policy . 2
5.3 Organizational roles, responsibilities and authorities. 3
6 Planning . 3
6.1 Actions to address risks and opportunities . 3
6.2 Information security objectives and planning to achieve them . 5
7 Support . 5
7.1 Resources . 5
7.2 Competence . 5
7.3 Awareness . 5
7.4 Communication . 6
7.5 Documented information . 6
8 Operation . 7
8.1 Operational planning and control . 7
8.2 Information security risk assessment. 7
8.3 Information security risk treatment . 7
9 Performance evaluation . 7
9.1 Monitoring, measurement, analysis and evaluation . 7
9.2 Internal audit . 8
9.3 Management review . 8
10 Improvement . 9
10.1 Nonconformity and corrective action . 9
10.2 Continual improvement . 9
Annex A (normative) Reference control objectives and controls .10
Bibliography .23
© ISO/IEC 2013 – All rights reserved iii
Foreword
ISO (the International Organization for Standardization) and IEC (the International Electrotechnical
Commission) form the specialized system for worldwide standardization. National bodies that are
members of ISO or IEC participate in the development of International Standards through technical
committees established by the respective organization to deal with particular fields of technical
activity. ISO and IEC technical committees collaborate in fields of mutual interest. Other international
organizations, governmental and non-governmental, in liaison with ISO and IEC, also take part in the
work. In the field of information technology, ISO and IEC have established a joint technical committee,
ISO/IEC JTC 1.
International Standards are drafted in accordance with the rules given in the ISO/IEC Directives, Part 2.
The main task of the joint technical committee is to prepare International Standards. Draft International
Standards adopted by the joint technical committee are circulated to national bodies for voting.
Publication as an International Standard requires approval by at least 75 % of the national bodies
casting a vote.
Attention is drawn to the possibility that some of the elements of this document may be the subject of
patent rights. ISO and IEC shall not be held responsible for identifying any or all such patent rights.
ISO/IEC 27001 was prepared by Joint Technical Committee ISO/IEC JTC 1, Information technology,
Subcommittee SC 27, IT Security techniques.
This second edition cancels and replaces the first edition (ISO/IEC 27001:2005), which has been
technically revised.
iv © ISO/IEC 2013 – All rights reserved
0 Introduction
0.1 General
This International Standard has been prepared to provide requirements for establishing, implementing,
maintaining and continually improving an information security management system. The adoption of an
information security management system is a strategic decision for an organization. The establishment
and implementation of an organization’s information security management system is influenced by the
organization’s needs and objectives, security requirements, the organizational processes used and the
size and structure of the organization. All of these influencing factors are expected to change over time.
The information security management system preserves the confidentiality, integrity and availability
of information by applying a risk management process and gives confidence to interested parties that
risks are adequately managed.
It is important that the information security management system is part of and integrated with the
organization’s processes and overall management structure and that information security is considered
in the design of processes, information systems, and controls. It is expected that an information security
management system implementation will be scaled in accordance with the needs of the organization.
This International Standard can be used by internal and external parties to assess the organization’s
ability to meet the organization’s own information security requirements.
The order in which requirements are presented in this International Standard does not reflect their
importance or imply the order in which they are to be implemented. The list items are enumerated for
reference purpose only.
ISO/IEC 27000 describes the overview and the vocabulary of information security management
systems, referencing the information security management system family of standards (including
[2] [3] [4]
ISO/IEC 27003 , ISO/IEC 27004 and ISO/IEC 27005 ), with related terms and definitions.
0.2 Compatibility with other management system standards
This International Standard applies the high-level structure, identical sub-clause titles, identical text,
common terms, and core definitions defined in Annex SL of ISO/IEC Directives, Part 1, Consolidated ISO
Supplement, and therefore maintains compatibility with other management system standards that have
adopted the Annex SL.
This common approach defined in the Annex SL will be useful for those organizations that choose to operate
a single management system that meets the requirements of two or more management system standards.
© ISO/IEC 2013 – All rights reserved v
INTERNATIONAL STANDARD ISO/IEC 27001:2013(E)
Information technology — Security techniques —
Information security management systems — Requirements
1 Scope
This International Standard specifies the requirements for establishing, implementing, maintaining
and continually improving an information security management system within the context of the
organization. This International Standard also includes requirements for the assessment and treatment
of information security risks tailored to the needs of the organization. The requirements set out in this
International Standard are generic and are intended to be applicable to all organizations, regardless
of type, size or nature. Excluding any of the requirements specified in Clauses 4 to 10 is not acceptable
when an organization claims conformity to this International Standard.
2 Normative references
The following documents, in whole or in part, are normatively referenced in this document and are
indispensable for its application. For dated references, only the edition cited applies. For undated
references, the latest edition of the referenced document (including any amendments) applies.
ISO/IEC 27000, Information technology — Security techniques — Information security management
syst
...
ISO/IEC
Information
technology
Security techniques
Information security
management systems
Requirements
Second edition
2013-10-01
Our vision Our process
To be the world’s leading provider of high qual- Our standards are developed by experts
ity, globally relevant International Standards all over the world who work on a volunteer
through its members and stakeholders. or part-time basis. We sell International
Standards to recover the costs of organizing
this process and making standards widely
Our mission
available.
ISO develops high quality voluntary
Please respect our licensing terms and
International Standards that facilitate interna-
copyright to ensure this system remains
tional exchange of goods and services, support
independent.
sustainable and equitable economic growth,
If you would like to contribute to the devel-
promote innovation and protect health, safety
opment of ISO standards, please contact the
and the environment.
ISO Member Body in your country:
www.iso.org/iso/home/about/iso_mem-
bers.htm
This document has been prepared by:
ISO/IEC JTC 1, Information technology, SC 27,
IT Security techniques. All rights reserved. Unless otherwise speci-
fied, no part of this publication may be repro-
Committee members:
duced or utilized otherwise in any form or
ABNT, AENOR, AFNOR, ANSI, ASI, ASRO, BIS,
by any means, electronic or mechanical,
BSI, BSJ, CODINORM, CYS, DGN, DIN, DS, DSM,
including photocopy, or posting on the inter-
DTR, ESMA, EVS, GOST R, IANOR, ILNAS,
net or intranet, without prior permission.
IMANOR, INDECOPI, INN, IRAM, ISRM, JISC,
Permission can be requested from either ISO
KATS, KAZMEMST, KEBS, MSB, NBN, NEN,
at the address below or ISO’s member body
NSAI, PKN, SA, SABS, SAC, SCC, SFS, SII, SIS,
in the country of the requester:
SIST, SLSI, SN, SNV, SNZ, SPRING SG, SUTN,
© ISO/IEC 2013, Published in Switzerland
TISI, UNI, UNIT, UNMZ, (ISC)2, CCETT, Cloud
security alliance, ECBS, Ecma International,
ISO copyright office
ENISA, EPC, ISACA, ISSEA, ITU, Mastercard,
Case postale 56 • CH-1211 Geneva 20
Mastercard - Europe
Tel. +41 22 749 01 11
Fax. +41 22 749 09 47
This list reflects contributing members at the
E-mail copyright@iso.org
time of publication.
Web www.iso.org
Cover photo credit: ISO/CS, 2013
© ISO/IEC 2013 – All rights reserved
Executive summary
• Organizations of all types and sizes col- continually improving an information
lect, process, store and transmit infor- security management system.
mation in many forms. This information • It can be used by internal and external
is valuable to an organization’s business parties to assess the ability of an orga-
and operations. nization to meet its own information
• In today’s interconnected and mobile security requirements.
world, information is processed us- • Effective information security assures
ing systems and networks that employ management and other stakeholders
state-of-the-art technology. It is vital to that the organization’s assets are safe,
protect this information against both thereby acting as a business enabler.
deliberate and accidental threats and • Other International Standards in the
vulnerabilities. ISO/IEC 27000 family give complemen-
• ISO/IEC 27001 helps organizations to tary advice or requirements on other
keep secure both their information as- aspects of the overall process of manag-
sets and those of their customers. ing information security.
• It provides requirements for establish-
ing, implementing, maintaining and
© ISO/IEC 2013 – All rights reserved
Contents Page
Our vision .2
Our mission .2
Our process .2
Executive summary .3
Foreword .6
0 Introduction .7
1 Scope .8
2 Normative references .8
3 Terms and definitions .8
4 Context of the organization .8
4.1 Understanding the organization and its context .8
4.2 Understanding the needs and expectations of interested parties .8
4.3 Determining the scope of the information security management system .8
4.4 Information security management system .9
5 Leadership .9
5.1 Leadership and commitment .9
5.2 Policy .9
5.3 Organizational roles, responsibilities and authorities.9
6 Planning .10
6.1 Actions to address risks and opportunities .10
6.2 Information security objectives and planning to achieve them .11
7 Support .11
7.1 Resources .11
7.2 Competence .11
7.3 Awareness .12
7.4 Communication .12
7.5 Documented information .12
8 Operation .13
8.1 Operational planning and control .13
8.2 Information security risk assessment.13
8.3 Information security risk treatment .13
9 Performance evaluation .13
9.1 Monitoring, measurement, analysis and evaluation .13
9.2 Internal audit .14
9.3 Management review .14
10 Improvement .14
10.1 Nonconformity and corrective action .14
10.2 Continual improvement .14
Annex A (normative) Reference control objectives and controls .15
Bibliography .30
© ISO/IEC 2013 – All rights reserved
Foreword
ISO (the International Organization for The main task of the joint technical committee
Standardization) and IEC (the International is to prepare International Standards. Draft
Electrotechnical Commission) form the special- International Standards adopted by the joint
ized system for worldwide standardization. technical committee are circulated to national
National bodies that are members of ISO or IEC bodies for voting. Publication as an International
participate in the development of International Standard requires approval by at least 75 % of
Standards through technical committees estab- the national bodies casting a vote.
lished by the respective organization to deal
Attention is drawn to the possibility that some
with particular fields of technical activity. ISO
of the elements of this document may be the
and IEC technical committees collaborate in
subject of patent rights. ISO and IEC shall not
fields of mutual interest. Other international
be held responsible for identifying any or all
organizations, governmental and non-govern-
such patent rights.
mental, in liaison with ISO and IEC, also take
part in the work. In the field of information
ISO/IEC 27001 was prepared by Joint Technical
technology, ISO and IEC have established a joint
Committee ISO/IEC JTC 1, Information technol-
technical committee, ISO/IEC JTC 1.
ogy, Subcommittee SC 27, IT Security techniques.
International Standards are drafted in
This second edition cancels and replaces the
accordance with the rules given in the
first edition (ISO/IEC 27001:2005), which has
ISO/IEC Directives, Part 2.
been technically revised.
© ISO/IEC 2013 – All rights reserved
Introduction
organization’s ability to meet the organization’s
0.1 General
own information security requirements.
This International Standard has been pre-
The order in which requirements are presented
pared to provide requirements for establishing,
in this International Standard does not reflect
implementing, maintaining and continually
their importance or imply the order in which
improving an information security management
they are to be implemented. The list items are
system. The adoption of an information security
enumerated for reference purpose only.
management system is a strategic decision for
an organization. The establishment and imple-
ISO/IEC 27000 describes the overview and the
mentation of an organization’s information
vocabulary of information security management
security management system is influenced
systems, referencing the information secu-
by the organization’s needs and objectives,
rity management system family of standards
security requirements, the organizational pro-
[2] [3]
(including ISO/IEC 27003 , ISO/IEC 27004
cesses used and the size and structure of the
[4]
and ISO/IEC 27005 ), with related terms and
organization. All of these influencing factors
definitions.
are expected to change over time.
The information security management system
preserves the confidentiality, integrity and
0.2 Compatibility with other
ava
...
INTERNATIONAL ISO/IEC
STANDARD 27001
Second edition
2013-10-01
Information technology — Security
techniques — Information security
management systems — Requirements
Technologies de l’information — Techniques de sécurité — Systèmes
de management de la sécurité de l’information — Exigences
Reference number
©
ISO/IEC 2013
© ISO/IEC 2013
All rights reserved. Unless otherwise specified, no part of this publication may be reproduced or utilized otherwise in any form
or by any means, electronic or mechanical, including photocopying, or posting on the internet or an intranet, without prior
written permission. Permission can be requested from either ISO at the address below or ISO’s member body in the country of
the requester.
ISO copyright office
Case postale 56 • CH-1211 Geneva 20
Tel. + 41 22 749 01 11
Fax + 41 22 749 09 47
E-mail copyright@iso.org
Web www.iso.org
Published in Switzerland
ii © ISO/IEC 2013 – All rights reserved
Contents Page
Foreword .iv
0 Introduction .v
1 Scope . 1
2 Normative references . 1
3 Terms and definitions . 1
4 Context of the organization . 1
4.1 Understanding the organization and its context . 1
4.2 Understanding the needs and expectations of interested parties . 1
4.3 Determining the scope of the information security management system . 1
4.4 Information security management system . 2
5 Leadership . 2
5.1 Leadership and commitment . 2
5.2 Policy . 2
5.3 Organizational roles, responsibilities and authorities. 3
6 Planning . 3
6.1 Actions to address risks and opportunities . 3
6.2 Information security objectives and planning to achieve them . 5
7 Support . 5
7.1 Resources . 5
7.2 Competence . 5
7.3 Awareness . 5
7.4 Communication . 6
7.5 Documented information . 6
8 Operation . 7
8.1 Operational planning and control . 7
8.2 Information security risk assessment. 7
8.3 Information security risk treatment . 7
9 Performance evaluation . 7
9.1 Monitoring, measurement, analysis and evaluation . 7
9.2 Internal audit . 8
9.3 Management review . 8
10 Improvement . 9
10.1 Nonconformity and corrective action . 9
10.2 Continual improvement . 9
Annex A (normative) Reference control objectives and controls .10
Bibliography .23
© ISO/IEC 2013 – All rights reserved iii
Foreword
ISO (the International Organization for Standardization) and IEC (the International Electrotechnical
Commission) form the specialized system for worldwide standardization. National bodies that are
members of ISO or IEC participate in the development of International Standards through technical
committees established by the respective organization to deal with particular fields of technical
activity. ISO and IEC technical committees collaborate in fields of mutual interest. Other international
organizations, governmental and non-governmental, in liaison with ISO and IEC, also take part in the
work. In the field of information technology, ISO and IEC have established a joint technical committee,
ISO/IEC JTC 1.
International Standards are drafted in accordance with the rules given in the ISO/IEC Directives, Part 2.
The main task of the joint technical committee is to prepare International Standards. Draft International
Standards adopted by the joint technical committee are circulated to national bodies for voting.
Publication as an International Standard requires approval by at least 75 % of the national bodies
casting a vote.
Attention is drawn to the possibility that some of the elements of this document may be the subject of
patent rights. ISO and IEC shall not be held responsible for identifying any or all such patent rights.
ISO/IEC 27001 was prepared by Joint Technical Committee ISO/IEC JTC 1, Information technology,
Subcommittee SC 27, IT Security techniques.
This second edition cancels and replaces the first edition (ISO/IEC 27001:2005), which has been
technically revised.
iv © ISO/IEC 2013 – All rights reserved
0 Introduction
0.1 General
This International Standard has been prepared to provide requirements for establishing, implementing,
maintaining and continually improving an information security management system. The adoption of an
information security management system is a strategic decision for an organization. The establishment
and implementation of an organization’s information security management system is influenced by the
organization’s needs and objectives, security requirements, the organizational processes used and the
size and structure of the organization. All of these influencing factors are expected to change over time.
The information security management system preserves the confidentiality, integrity and availability
of information by applying a risk management process and gives confidence to interested parties that
risks are adequately managed.
It is important that the information security management system is part of and integrated with the
organization’s processes and overall management structure and that information security is considered
in the design of processes, information systems, and controls. It is expected that an information security
management system implementation will be scaled in accordance with the needs of the organization.
This International Standard can be used by internal and external parties to assess the organization’s
ability to meet the organization’s own information security requirements.
The order in which requirements are presented in this International Standard does not reflect their
importance or imply the order in which they are to be implemented. The list items are enumerated for
reference purpose only.
ISO/IEC 27000 describes the overview and the vocabulary of information security management
systems, referencing the information security management system family of standards (including
[2] [3] [4]
ISO/IEC 27003 , ISO/IEC 27004 and ISO/IEC 27005 ), with related terms and definitions.
0.2 Compatibility with other management system standards
This International Standard applies the high-level structure, identical sub-clause titles, identical text,
common terms, and core definitions defined in Annex SL of ISO/IEC Directives, Part 1, Consolidated ISO
Supplement, and therefore maintains compatibility with other management system standards that have
adopted the Annex SL.
This common approach defined in the Annex SL will be useful for those organizations that choose to operate
a single management system that meets the requirements of two or more management system standards.
© ISO/IEC 2013 – All rights reserved v
INTERNATIONAL STANDARD ISO/IEC 27001:2013(E)
Information technology — Security techniques —
Information security management systems — Requirements
1 Scope
This International Standard specifies the requirements for establishing, implementing, maintaining
and continually improving an information security management system within the context of the
organization. This International Standard also includes requirements for the assessment and treatment
of information security risks tailored to the needs of the organization. The requirements set out in this
International Standard are generic and are intended to be applicable to all organizations, regardless
of type, size or nature. Excluding any of the requirements specified in Clauses 4 to 10 is not acceptable
when an organization claims conformity to this International Standard.
2 Normative references
The following documents, in whole or in part, are normatively referenced in this document and are
indispensable for its application. For dated references, only the edition cited applies. For undated
references, the latest edition of the referenced document (including any amendments) applies.
ISO/IEC 27000, Information technology — Security techniques — Information security management
systems — Overview and vocabulary
3 Terms and definitions
For the purposes of this document, the terms and definitions given in ISO/IEC 27000 apply.
4 Context of the organization
4.1 Understanding the organization and its context
The organization shall determine external and internal issues that are relevant to its purpose and that
affect its ability to achieve the intended outcome(s) of its information security management system.
NOTE Determining these issues refers to establishing the external and internal context of the organization
[5]
considered in Clause 5.3 of ISO 31000:2009 .
4.2 Understanding the needs and expectations of interested parties
The organization shall determine:
a) interested parties that are relevant to the information security management system; and
b) the requirements of these interested parties relevant to information security.
NOTE The requirements of interested parties may include legal and regulatory requirements and
contractual obligations.
4.3 Determining the scope of the information security management system
The organ
...
INTERNATIONAL ISO/IEC
STANDARD 27001
Redline version
compares second edition
to first edition
Information technology — Security
techniques — Information security
management systems — Requirements
Technologies de l’information — Techniques de sécurité — Systèmes
de management de la sécurité de l’information — Exigences
Reference number
ISO/IEC 27001:redline:2014(E)
©
ISO/IEC 2014
ISO/IEC 27001:redline:2014(E)
IMPORTANT — PLEASE NOTE
This is a mark-up copy and uses the following colour coding:
Text example 1 — indicates added text (in green)
Text example 2 — indicates removed text (in red)
— indicates added graphic figure
— indicates removed graphic figure
1.x . — Heading numbers containg modifications are highlighted in yellow in
the Table of Contents
DISCLAIMER
This Redline version provides you with a quick and easy way to compare the main changes
between this edition of the standard and its previous edition. It doesn’t capture all single
changes such as punctuation but highlights the modifications providing customers with
the most valuable information. Therefore it is important to note that this Redline version is
not the official ISO standard and that the users must consult with the clean version of the
standard, which is the official standard, for implementation purposes.
© ISO 2014
All rights reserved. Unless otherwise specified, no part of this publication may be reproduced or utilized otherwise in any form
or by any means, electronic or mechanical, including photocopying, or posting on the internet or an intranet, without prior
written permission. Permission can be requested from either ISO at the address below or ISO’s member body in the country of
the requester.
ISO copyright office
Case postale 56 • CH-1211 Geneva 20
Tel. + 41 22 749 01 11
Fax + 41 22 749 09 47
E-mail copyright@iso.org
Web www.iso.org
Published in Switzerland
ii © ISO 2014 – All rights reserved
ISO/IEC 27001:redline:2014(E)
Contents Page
Foreword .v
0 Introduction .vi
0.1 General .vi
0.2 Process approach .vi
0.3 Compatibility with other management systems . vii
1 Scope . 1
1.1 General . 1
1.2 Application . 1
2 Normative references . 1
3 Terms and definitions . 2
3 4 Terms and definitions Context of the organization . 2
4.1 Understanding the organization and its context . 2
4.2 Understanding the needs and expectations of interested parties . 2
4.3 Determining the scope of the information security management system . 2
4.4 Information security management system . 3
5 Leadership . 4
5.1 Leadership and commitment . 4
5.2 Policy . 5
5.3 Organizational roles, responsibilities and authorities. 5
4 6 Information security management system Planning . 5
4.1 General requirements . 5
4.2 6.1 Establishing and managing the ISMS Actions to address risks and opportunities . 6
4.3 6.2 Documentation requirements Information security objectives and planning to
achieve them .10
5 7 Management responsibility Support .12
5.1 7.1 Management commitment Resources .12
5.2 7.2 Resource management Competence .12
7.3 Awareness .13
7.4 Communication .13
7.5 Documented information .13
8 Operation .14
8.1 Operational planning and control .14
8.2 Information security risk assessment.15
8.3 Information security risk treatment .15
6 9 Internal ISMS audits Performance evaluation .15
9.1 Monitoring, measurement, analysis and evaluation .15
9.2 Internal audit .16
9.3 Management review .16
7 Management review of the ISMS .17
7.1 General .17
7.2 Review input .17
7.3 Review output .17
8 10 ISMS improvement Improvement .18
8.1 Continual improvement .18
8.2 10.1 . Corrective Nonconformity and
corrective action .18
8.3 10.2 .Preventive
action Continual improvement .18
Annex A (normative) Control Reference control objectives and controls .20
ISO/IEC 27001:redline:2014(E)
Annex B (informative) OECD principles and this International Standard .39
Annex C (informative) Correspondence between ISO 9001:2000, ISO 14001:2004 and this
International Standard .40
Bibliography .42
Standards publications .43
Other publications .44
iv © ISO 2014 – All rights reserved
ISO/IEC 27001:redline:2014(E)
Foreword
ISO (the International Organization for Standardization) and IEC (the International Electrotechnical
Commission) form the specialized system for worldwide standardization. National bodies that are
members of ISO or IEC participate in the development of International Standards through technical
committees established by the respective organization to deal with particular fields of technical
activity. ISO and IEC technical committees collaborate in fields of mutual interest. Other international
organizations, governmental and non-governmental, in liaison with ISO and IEC, also take part in the
work. In the field of information technology, ISO and IEC have established a joint technical committee,
ISO/IEC JTC 1.
International Standards are drafted in accordance with the rules given in the ISO/IEC Directives, Part 2.
The main task of the joint technical committee is to prepare International Standards. Draft International
Standards adopted by the joint technical committee are circulated to national bodies for voting.
Publication as an International Standard requires approval by at least 75 % of the national bodies
casting a vote.
Attention is drawn to the possibility that some of the elements of this document may be the subject of
patent rights. ISO and IEC shall not be held responsible for identifying any or all such patent rights.
ISO/IEC 27001 was prepared by Joint Technical Committee ISO/IEC JTC 1, Information technology,
Subcommittee SC 27, IT Security techniques.
This second edition cancels and replaces the first edition (ISO/IEC 27001:2005), which has been
technically revised.
ISO/IEC 27001:redline:2014(E)
0 Introduction
0.1 General
This International Standard has been prepared to provide a model for establishing, implementing, operating,
monitoring, reviewing, maintaining and improving an Information Security Management System (ISMS).
The adoption of an ISMS should be a strategic decision for an organization. The design and implementation
of an organization’s ISMS is influenced by their needs and objectives, security requirements, the processes
employed and the size and structure of the organization. These and their supporting systems are expected
to change over time. It is expected that an ISMS implementation will be scaled in accordance with the
needs of the organization, e.g. a simple situation requires a simple ISMS solution.
T
...
NORME ISO/CEI
INTERNATIONALE 27001
Deuxième édition
2013-10-01
Technologies de l’information —
Techniques de sécurité — Systèmes
de management de la sécurité de
l’information — Exigences
Information technology — Security techniques — Information
security management systems — Requirements
Numéro de référence
ISO/CEI 27001:2013(F)
©
ISO/CEI 2013
ISO/CEI 27001:2013(F)
DOCUMENT PROTÉGÉ PAR COPYRIGHT
© ISO/CEI 2013
Droits de reproduction réservés. Sauf indication contraire, aucune partie de cette publication ne peut être reproduite ni utilisée
sous quelque forme que ce soit et par aucun procédé, électronique ou mécanique, y compris la photocopie, l’affichage sur
l’internet ou sur un Intranet, sans autorisation écrite préalable. Les demandes d’autorisation peuvent être adressées à l’ISO à
l’adresse ci-après ou au comité membre de l’ISO dans le pays du demandeur.
ISO copyright office
Case postale 56 • CH-1211 Geneva 20
Tel. + 41 22 749 01 11
Fax + 41 22 749 09 47
E-mail copyright@iso.org
Web www.iso.org
Version française parue en 2013
Publié en Suisse
ii © ISO/CEI 2013 – Tous droits réservés
ISO/CEI 27001:2013(F)
Sommaire Page
Avant-propos .iv
0 Introduction .v
1 Domaine d’application . 1
2 Références normatives . 1
3 Termes et définitions . 1
4 Contexte de l’organisation . 1
4.1 Compréhension de l’organisation et de son contexte. 1
4.2 Compréhension des besoins et des attentes des parties intéressées . 1
4.3 Détermination du domaine d’application du système de management de la sécurité
de l’information . 2
4.4 Système de management de la sécurité de l’information . 2
5 Leadership . 2
5.1 Leadership et engagement. 2
5.2 Politique . 2
5.3 Rôles, responsabilités et autorités au sein de l’organisation . 3
6 Planification . 3
6.1 Actions liées aux risques et opportunités . 3
6.2 Objectifs de sécurité de l’information et plans pour les atteindre . 5
7 Support . 5
7.1 Ressources . 5
7.2 Compétence . 6
7.3 Sensibilisation . 6
7.4 Communication . 6
7.5 Informations documentées . 6
8 Fonctionnement . 7
8.1 Planification et contrôle opérationnels . 7
8.2 Appréciation des risques de sécurité de l’information . 8
8.3 Traitement des risques de sécurité de l’information . 8
9 Évaluation des performances . 8
9.1 Surveillance, mesures, analyse et évaluation . 8
9.2 Audit interne . 8
9.3 Revue de direction . 9
10 Amélioration . 9
10.1 Non-conformité et actions correctives . 9
10.2 Amélioration continue .10
Annexe A (normative) Objectifs et mesures de référence .11
Bibliographie
...........................................................................................................................................................................................................................23
© ISO/CEI 2013 – Tous droits réservés iii
ISO/CEI 27001:2013(F)
Avant-propos
L’ISO (Organisation internationale de normalisation) et la CEI (Commission électrotechnique
internationale) forment le système spécialisé de la normalisation mondiale. Les organismes nationaux
membres de l’ISO ou de la CEI participent au développement de Normes internationales par l’intermédiaire
des comités techniques créés par l’organisation concernée afin de s’occuper des domaines particuliers
de l’activité technique. Les comités techniques de l’ISO et de la CEI collaborent dans des domaines
d’intérêt commun. D’autres organisations internationales, gouvernementales et non gouvernementales,
en liaison avec l’ISO et la CEI participent également aux travaux. Dans le domaine des technologies de
l’information, l’ISO et la CEI ont créé un comité technique mixte, l’ISO/CEI JTC 1.
Les Normes internationales sont rédigées conformément aux règles données dans les Directives
ISO/CEI, Partie 2.
La tâche principale du comité technique mixte est d’élaborer les Normes internationales. Les projets de
Normes internationales adoptés par le comité technique mixte sont soumis aux organismes nationaux
pour vote. Leur publication comme Normes internationales requiert l’approbation de 75 % au moins des
organismes nationaux votants.
L’attention est appelée sur le fait que certains des éléments du présent document peuvent faire l’objet
de droits de propriété intellectuelle ou de droits analogues. L’ISO et la CEI ne sauraient être tenues pour
responsables de ne pas avoir identifié de tels droits de propriété et averti de leur existence.
L’ISO/CEI 27001 a été élaborée par le comité technique mixte ISO/CEI JTC 1, Technologies de l’information,
sous-comité SC 27, Techniques de sécurité des technologies de l’information.
Cette deuxième édition annule et remplace la première édition (ISO/CEI 27001:2005), qui a fait l’objet
d’une révision technique.
iv © ISO/CEI 2013 – Tous droits réservés
ISO/CEI 27001:2013(F)
0 Introduction
0.1 Généralités
La présente Norme internationale a été élaborée pour fournir des exigences en vue de l’établissement,
de la mise en œuvre, de la tenue à jour et de l’amélioration continue d’un système de management de
la sécurité de l’information. L’adoption d’un système de management de la sécurité de l’information
relève d’une décision stratégique de l’organisation. L’établissement et la mise en œuvre d’un système
de management de la sécurité de l’information d’une organisation tiennent compte des besoins et des
objectifs de l’organisation, des exigences de sécurité, des processus organisationnels mis en œuvre, ainsi
que de la taille et de la structure de l’organisation. Tous ces facteurs d’influence sont appelés à évoluer
dans le temps.
Le système de management de la sécurité de l’information préserve la confidentialité, l’intégrité et la
disponibilité de l’information en appliquant un processus de gestion des risques et donne aux parties
intéressées l’assurance que les risques sont gérés de manière adéquate.
Il est important que le système de management de la sécurité de l’information fasse partie intégrante
des processus et de la structure de management d’ensemble de l’organisation et que la sécurité de
l’information soit prise en compte dans la conception des processus, des systèmes d’information et des
mesures. Il est prévu qu’un système de management de la sécurité de l’information évolue conformément
aux besoins de l’organisation.
La présente Norme internationale peut être utilisée par les parties internes et externes pour évaluer la
capacité de l’organisation à répondre à ses propres exigences en matière de sécurité de l’information.
L’ordre dans lequel les exigences sont présentées dans la présente Norme internationale ne reflète pas
leur importance, ni l’ordre dans lequel elles doivent être mises en œuvre. Les éléments des listes sont
énumérés uniquement à des fins de référence.
L’ISO/CEI 27000 décrit une vue d’ensemble et le vocabulaire des systèmes de management de la sécurité
de l’information, en se référant à la famille des normes du système de management de la sécurité de
[2] [3] [4]
l’information (incluant l’ISO/CEI 27003, l’ISO/CEI 27004 et l’ISO/CEI 27005 ) avec les termes et les
définitions qui s’y rapportent.
0.2 Compatibilité avec d’autres systèmes de management
La présente Norme internationale applique la structure de haut niveau, les titres de paragraphe
identiques, le texte, les termes communs et les définitions fondamentales définies dans l’Annexe SL des
Directives ISO/CEI, Partie 1, Supplément ISO consolidé, et, par conséquent, est compatible avec les autres
normes de systèmes de management qui se conforment à l’Annexe SL.
Cette approche commune définie dans l’Annexe SL sera utile aux organisations qui choisissent de mettre
en œuvre un système de management unique pour répondre aux exigences de deux ou plusieurs normes
de systèmes de management.
© ISO/CEI 2013 – Tous droits réservés v
NORME INTERNATIONALE ISO/CEI 27001:2013(F)
Technologies de l’information — Techniques de
sécurité — Systèmes de management de la sécurité de
l’information — Exigences
1 Domaine d’application
La présente Norme internationale spécifie les exigences relatives à l’établissement, à la mise en œuvre,
à la mise à jour et à l’amélioration continue d’un système de management de la sécurité de l’information
dans le contexte d’une organisation. La présente Norme internationale comporte également des
exigences sur l’appréciation et le traitement des risques de sécurité de l’information, adaptées aux
besoins de l’organisation. Les exigences fixées dans la présente Norme internationale sont génériques et
prévues pour s’appliquer à toute organisation, quels que soient son type, sa taille et sa nature. Il n’est pas
admis qu’une organisation s’affranchisse de l’une des exigences spécifiées aux Articles 4 à 10 lorsqu’elle
revendique la conformité à la présente Norme internationale.
2 Références normatives
Les documents suivants, en tout ou partie, sont référencés de manière normative dans le présent
document et sont indispensables à son application. Pour les références datées, seule l’édition citée
s’applique. Pour les références non datées, la dernière édition du document de référence s’applique (y
compris les éventuels amendements).
ISO/CEI 27000, Technologies de l’information — Techniques de sécurité — Systèmes de management de la
sécurité de l’information — Vue d’ensemble et vocabulaire
3 Termes et définitions
Pour
...
ةيلودلا ةيسايقلا ةفصاوملا
ةينقتورهكلا ةيلودلا ةنجللا /وزـــيأ
ةيمسرلا ةمجرتلا
Official translation
Traditionofficials
تابلطتملا – تامولعملا نمأ ةرادإ مظننملأا تاينقت - تامولعملا ايجولونكت
Information technology — Security techniques — Information security management
systems — Requirements (E)
Technologies de l’information — Techniques de sécurité — Systèmes
de management de la sécurité de l’information — Exigences (F)
يف ةمئاقلا رظنا( ةمجرتلا ةقد تدمتعأ يتلاISO يف ءاضعأ تائيه01نع ةبانلإاب ةيمسر ةيبرع ةمجرتك ارسيوس ،فينج يف ISO ةيزكرملا ةناملأا يف تعبط
.)ii ةحفص
ىعجرملا مقرلا
ISO\IEC 27001:2013 (A)
ةيمسرلا ةمجرتلا
©ISO 2013
)ع( 0102/00110 يس يإ يأ/وزيأ
)هيونت( ةيلوئسم ءلاخإ
اذنه ةنعابط ننكمي هنإف Adobe ـل صيخرتلا ةسايس بجومبو ،ةجمدُم طوطخ ىلع )PDF( فلملا اذه يوتحي دق
متي يذلا بوساحلا يف ةلَّمحُمو ةصخرُمهيف ةجمدُملا طوطخلا نكت مل ام هليدعت متي َّلاأ ىلع ،هيلععلاطلاا وأ فلملا
ينف ،Adobe ـل صيخرتلا ةسايسب للاخلإا مدع ةيلوئسم - فلملا اذه ليزنت دنع - فارطلأا لمحتت و.ليدعتلا هيف
.لاجملا اذه لايح ةينوناق ةيلوئسم يأ لمحتت لاوزيلألةماعلا ةيراتركسلا نأنيح
Adobe.ـلا مظنل ةدحتملا ةكرشلل ةلجسم ةيراجت ةملاع Adobe ـلا دعت
ةنماعلا تانمولعملا ننم فنلملا اذنه ءانشنإ ينف ةمدختنسملا مماربلانب ةنصاخلا لينصافتلا نيمج ينلع لوصحلا نكمي
نونكي نأ ينعوُر نيح ،)PDF( ءانشنإ يف ةلخادلا تاريغتملا تن سُح دقف ةعابطلا لجلأو ، )PDF(فلمب ةقلعتملا
، فنلملا اذنهب لنلعتت ةلكنشم يأ شودنح ةنلاح ينفو ، ينيقتلل ةنيلودلا ةنمظنملا ءاضعلأ امئلام فلملا اذه مادختسا
.هاندأ لجسملا ناونعلا ىلع ةماعلا ةيراتركسلا غلابإ ىجرُي
ةفصاوملا تدمتعا يتلا ةيبرعلا سييقتلا تاهج
ندرلأا
ةيندرلأا سيياقملاو تافصاوملا ةسسؤم
تاراملإا
سيياقملاو تافصاوملل تاراملإا ةئيه
رئازجلا
سييقتلل يرئازجلا دهعملا
ةيدوعسلا
سيياقملاو تافصاوملل ةيدوعسلا ةئيهلا
قارعلا
ةيعونلا ةرطيسلاو سييقتلل يزكرملا زاهجلا
تيوكلا
ةعانصلل ةماعلا ةئيهلا
نادوسلا
سيياقملاو تافصاوملل ةينادوسلا ةئيهلا
نميلا
ةدوجلا طبضو سيياقملاو تافصاوملل ةينميلا ةئيهلا
سنوت
ةيعانصلا ةيكلملاو تافصاوملل ينطولا دهعملا
ايروس
ةيروسلا ةيبرعلا سيياقملاو تافصاوملا ةئيه
ايبيل
ةيسايقلا ريياعملاو تافصاوملل ينطولا زكرملا
رصم
ةدوجلاو تافصاوملل ةماعلا ةيرصملا ةئيهلا
رشنلاو عبطلا قوقح ةيامح ةقيثو
©0102وزيأ
ةليسو يأب وأ لكش يأب همادختسا وأ رادصلإا اذه نم ءزج يأ جاتنإ ةداعإ زوجي لا ،كلذ فلاخ دري كل امو .ةظوفحم قوقحلا يمج
دحا وأ هاندأ ناونعلا ىلع ييقتلل ةيلودلا ةمظنملا نم امإ يطخ نذإ نود ةقيقدلا ملافلأاو خسنلا كلذ يف امب ةيكيناكيم وأ ةينورتكلا
.ةبلاطلا ةهجلا ةلود يف ييقتلل ةيلودلا ةمظنملا يف ءاضعلأا تائيهلا
ييقتلل ةيلودلا ةمظنملا ةيكلم قوقح بتكم
01 فينج -Ch-1211- 65 :يديربلا زمرلا
1120000221000 :فتاه
1120000221220 : كاف
copyright@iso.org :ينورتكلا ديرب
www.iso.org :ينورتكللاا قوملا
0100يف ةيبرعلاةخسنلا رشن مت
ارسيوس يف رشنلا مت
)ع( 0102/00110يس يإ يأ / وزيأ
تايوتحملا
iv .ديهمت
v . ةمدقم 1
0 . لاجملا 0
0 . ةيليمكتلا جارملا 0
0 . فيراعتلاو تاحلطصملا 2
0 . ةأشنملا ةئيب 2
0 . اهتئيب ىف ةأشنملا مهف 0/2
0 . ةينعملا فارطلأا تاعقوتو تاجايتحا مهف 0/2
0 . تامولعملا نمأ ةرادإ ماظن لاجم ديدحت 2/2
0 . تامولعملا نمأ ةرادإ ماظن 2/2
0 . ةدايقلا 6
0 . مازتللااو ةدايقلا 0/6
0 . تاسايسلا 0/6
0 . ةيميظنتلا تاطلسلاو تايلوؤسملاو راودلأا 2/6
2 . طيطختلا 5
2 . رفلاو رطاخملا فادهتسا تاءارجلإا 0/5
2 . تامولعملا نمأ رطاخم ريدقت 0/5
6 . معدلا 0
6 . دراوملا 0/0
6 . ةءافكلا 0/0
6 . ةيعوتلا 2/0
6 . تلااصتلاا 2/0
5 . ةقثوملا تامولعملا 6/0
0 . ليغشتلا 8
0 . ةباقرلاو ليغشتلل طيطختلا 0/8
0 . تامولعملا نمأ رطاخم ريدقت 0/8
0 . تامولعملا نمأ رطاخم ةجلاعم 2/8
0 . ءادلأا مييقت 2
0 . مييقتلاو ليلحتلاو سايقلاو دصرلا 0/2
8 . يلخادلا ليقدتلا 0/2
8 . ةرادلإا ةعجارم 2/2
2 . نيسحتلا 01
2 . ةيحيحصتلا تاءارجلإاو ةقباطملا مدع 0/01
2 . رمتسملا نيسحتلا 0/01
01 . ةيعجرملا طباوضلاو طبضلا فادهأ )يداشرتسا( أ لفرم
00 . رداصملا
iii
ISO 2013 © ةظوفحم قوقحلا عيمج
)ع( 0102/00110 يس يإ يأ/وزيأ
ديهمت
ابلاغو،)وزيلأا يف ءاضعلأا تاهجلا( ةينطولا ييقتلا تاهجل يملاع داحتا يه ) ييقتلل ةيلودلا ةمظنملا( وزيلأا
دق عوضومب مامتها اهل وضعلا ةهجلا تناك اذإو،وزيلأل ةينفلا ناجللا للاخ نم ةيلودلا تافصاوملا دادعإ متيام
تامظنملا كلذك لمعلا يف كراشيو.ةنجللا كلت يف لّثمم هل نوكي نأ يف لحلا وضعلا اذهل نإف ،ةينف ةنجل هل تل كُش
ةيلودلا ةنجللا م اقيثو انواعت وزيلأا نواعتتو.وزيلأا م لصاوت اهل يتلا ،ةيموكحلا ريغو اهنم ةيموكحلا ةيلودلا
.ينقت ورهكلا لاجملا يف ييقتلا مهت يتلا روملأا يمج يف )ك د ـه( ةينقتورهكلا
.يناثلا ءزجلا - ك د ـه/وزيلأا تاهيجوت يف ةدراولا حئاولل اقفو ةيلودلا تافصاوملا غاصتو
تائيهلا ىلع ةيلودلا تافصاوملا يراشم يزوت متيو .ةيلودلا تافصاوملا دادعا وه ةينفلا ناجلل ةيسيئرلا ةمهملا
ةينطولا تائيهلا نم لقلأا ىلع %06 ةقفاوم ةيلود تافصاومك يراشملا هذه رادصا بلطتيو.تيوصتلل ةينطولا
.تيوصتلا اهل لحي يتلا
لنمحتت ننلو .عارنتخلاا ةءارنب قونقحل ةعنضاخ ةنقيثولا هذه رصانع ضعب نوكت نأ ةيلامتحا ىلإ هابتنلاا تفل دونو
.اهعيمج وأ قوقحلا هذه نم ّيأ ديدحت ةيلوؤسم (ISO) ييقتلل ةيلودلا ةمظنملا
ISO / IEC ةكرتشملا ةينفلا ةنجللا ةطساوب 00110 ةينقت ورهكلا ةيلودلا ةنجللا /وزـــيلأا ةفصاوم دادعإ مت دقو
.نملأا تاينقت ، SC 27ةيعرفلا ةنجللا ،تامولعملا ايجولونكت ،JTC 1
.ةينفلا ةيحانلا نم اهحيقنت مت يح (ISO / IEC 27001: 2005) ىلولأا ةعبطلا ،ةيناثلا ةعبطلا هذه ىغلت
)ع( 0102/00110يس يإ يأ / وزيأ
ةمدقم 2
ماع 1/2
نيسحتلاو تامولعملا نيمأت ةرادإ ةموظنم ةنايصو ذيفنتو ضو تابلطتم مدقتل ةيلودلا ةفصاوملا هذه تدعأ
هئانب ىف ماظنلا اذهرثأتي ،ةأشنملل ايجيتارتسا ارارق تامولعملا نمأ ةرادإ ةموظنم ىنبت رارق دعيو .اهل رمتسملا
ةمدختسملا ةيميظنتلا تايلمعلابو نملأا تابلطتمبو اهفادهأو ةأشنملا تاجايتحاب ليبطتلا ضوم هعضو ىفو
.نمزلا م ريغتت نأ قوتب يتلا تارثؤملا يهو .ةأشنملا لكيهو مجحب كلذكو
ةرادلإ ةيلمع ليبطت للاخ نم تامولعملا ةحاتإو قاستاو ةيرس ىلع ظافحلاب تامولعملا نيمأت ةرادإ ةموظنم موقت
.ةبسانملا بيلاسلأاب ملاعت رطاخملا نأ ىف ةقثلا ةينعملا فارطلأا ءاطعإ للاخ نمو رطاخملا
ةرادلإا لكيه مو اهعم ةلماكتمو ةأشنملا تايلمع نم ءزج تامولعملا نيمأت ةرادإ ةموظنم نوكت نأ مهملا نم
نأ قوتملا نمو .طباوضلاو تامولعملا مظنو تايلمعلا ميمصت دنع رابتعلاا ىف تامولعملا نيمأت ذخؤي نأو لكك
ةأشنملا تاجايتحا م هذيفنت ىف تامولعملا نيمأت ماظن بسانتي
ليقحتل ةأشنملا ةردق مييقتل ،ةيجراخلاو ةيلخادلا تاهجلا لبق نم ةقباطملا مييقتل ةفصاوملا هذه مادختسا نكمي
.تامولعملا نمأب صتخي اميف اهتابلطتم
اهعضو بيترت يضتقي لاو ،تابلطتملا هذه ةيمهأ ةيلودلا ةفصاوملا ىف تابلطتملا هذه ضرع بيترت كعي لاو
.ةيعجرملا ضارغلأ طقف ةمئاقلا رصانع ميقرت يتأيو .ذيفنتلا ضوم
ةلئاع كلذ ىف اهعجرمو ،تامولعملا نمأ ةرادإ مظن تادرفمو ةماع ةرظن ISO / IEC 27000 ةفصاوملا مدقت
ISO و ]ISO / IEC 27004 [3] ،ISO / IEC 27003 [2] مضت يتلا( تامولعملا نمأ ةرادإ ماظن تافصاوم
.ةلصلا تاذ فيراعتلاو تاحلطصملا م ،)]/ IEC 27005 [4]
ىرخلأا ةرادلإا مظن تافصاوم عم قفاوتلا 0/2
،ةلثامم اصوصنو ،ةيعرفلا دونبلا نيوانعو ،يلامجلإايقوفلا راطلإا / لكيهلا ةيلودلا ةفصاوملا هذه مدختست /لبطت
ISO / تاهيجوت نم لولأا ءزجلا نم SL لحلملا ىف ةفرعملا ةيساسلأا فيراعتلاو ،ةعئاشلا تاحلطصملاو
ىرخأ ةرادلإا مظن تافصاوم م لفاوتلا ىلع ظفاحت مث نمو ، مجملا ISO لحلم ،لولأا ءزجلا ىف ،IEC
SL. لحلملا تدمتعا يتلا ريياعملا
ينفي ةرادإنل دنحاو مانظن ليغنشت رانتخت يتلا تائشنملا كلتل اديفم SL لحلملا يف ددحملا كرتشملا مهنلا اذه نوكي
.ةرادلإا مظن تافصاوم نم رثكأ وأ نينثا تابلطتمب
v
ISO 2013 © ةظوفحم قوقحلا عيمج
)ع( 0102/00110يس يإ يأ / وزيأ
تابلطتملا – تامولعملا نمأ ةرادإ مظن -نملأا تاينقت - تامولعملا ايجولونكت
لاجملا -1
يف تامولعملا نمأ ةرادإ ماظنل رمتسملا نيسحتلاو ةنايصلاو ذيفنتلاو ءاشنلإا تابلطتم ةيلودلا ةفصاوملا هذه ددحت
.ةأشنملا تاجايتحلا اقفو تامولعملا نمأ رطاخم ةجلاعمو ريدقت تابلطتم اضيأ ةفصاوملا هذه مضتو .ةأشنملا ةئيب
ىلع ةقبطنم نوكت نأ اهب دصقيو ةيلوأو ةماع تابلطتم ةيلودلا ةفصاوملا هذه يف اهيلع وصنملا تابلطتملا
ةددحملا طورشلا نم يأ داعبتسا لوبقملا نم يل .ةعيبطلا وأ مجحلا وأ عونلا نع رظنلا ضغب ،تامظنملا يمج
.ةيلودلا ةفصاوملا هذه م اهقباطت ةأشنملا يعدت امدنع ،رشاعلا ىلإ بارلا نم دونبلا يف
ةيليمكتلا عجارملا -0
خسنلا ليبطت مزلي ةخرؤملا جارملل ةبسنلاب . ةفصاوملا هذه ليبطتل ةيساسا ةيلاتلا ةيعجرملا لئاثولا ربتعت
انمضتم( ةيعجرملا ةقيثولا نم رادصإ رخآ ليبطت مزلي هنإف ةخرؤملا ريع جارملل ةبسنلاب اما طقف هاندأ ةدراولا
.)تلايدعت ىا
ماعلا راطلإا – تامولعملا نمأ مظن ةرادإ - نملأا تاينقت - تامولعملا ايجولونكتو ، ISO / IEC 27000
تادرفملاو
فيراعتلاو تاحلطصملا -3
ISO / IEC 27000 يف ةدراولا فيراعتلاو تاحلطصملا لبطت ،ةقيثولا هذه ضارغلأ
ةأشنملا ةئيب -4
اهتئيب ىف ةأشنملا مهف 1/4
مئاتنلا ليقحت ىلع اهتردق ىلع رثؤت يتلاو اهضارغأب ةلصلا تاذ ةيلخادلاو ةيجراخلا اياضقلا ديدحت ةأشنملا ىلع بجي
.اهب ةصاخلا تامولعملا نمأ ةرادإ ماظن نم ةوجرملا
-6 دنبلا ىف دراولا ربتعملا وحنلا ىلع ةأشنملل يلخادلاو يجراخلا نيطيحملا ءانب ىلإ جري اياضقلا هذه ديدحت ةظوحلم
ISO 31000:2009 [5] ةفصاوملا نم 2
ةينعملا فارطلأا تاعقوتو تاجايتحا مهف 0/4
:يلي ام ديدحت ةأشنملا ىلع بجي
،تامولعملا نمأ ةرادإ ماظنب ةلصلا تاذ ةينعملا فارطلأا )أ
.تامولعملا نمأب ةلصلا تاذ ةمتهملا فارطلأا هذه تابلطتم )ب
.ةيدقاعت تامازتلاو ةيميظنتو ةينوناق تابلطتم ةينعملا فارطلأا تابلطتم نمضتت دق ةظوحلم
تامولعملا نمأ ةرادإ ماظن لاجم ديدحت 3/4
.هلاجم ديدحتل تامولعملا نمأ ةرادإ ماظن قابطنا ىدمو دودح نييعت ةأشنملا ىلع بجي
ISO 2013 © ةظوفحم قوقحلا عيمج
)ع( 0102/00110 يس يإ يأ/وزيأ
:يلي ام رابتعلاا ىف ذخأت نأ ةأشنملا ىلع نيعتي ،لاجملا اذه ديدحت دنع
.0/2 ىف اهيلإ راشملا ةيلخادلاو ةيجراخلا اياضقلا )أ
.0/2 ىف اهيلإ راشملا تابلطتملا )ب
.ىرخأ تامظنم لبق نم اهذيفنت متي يتلا كلتو ،ةأشنملا اهب موقت يتلا ةطشنلأا نيب ةيدامتعلااو يقلاتلا لطانم )ج
.ةقثوم تامولعمك احاتم قاطنلا نوكي نأ بجي
تامولعملا نمأ ةرادإ ماظن 4/4
ةفصاوملا هذه تابلطتمل اقفو ،رارمتساب هنيسحتو تامولعملا نمأ ةرادإ ماظن ةنايصو ذيفنتو ءاشنإ ةأشنملا ىلع بجي
.ةيلودلا
ةدايقلا -5
مازتللااو ةدايقلا 1/5
-: للاخ نم كلذو تامولعملا نيمأت ةرادإ ماظنب للعتي اميف مازتللااو ةدايقلا ايلعلا ةرادلإا ىدبت نأ بجي
يجيتارتسلاا هجوتلا م ةقفاوتم اهنأ نمو تعضو دق تامولعملا نمأ فادهأو تاسايس نأ نم لقحتلا )أ
.ةأشنملل
.ةأشنملا تايلمع يف تامولعملا نمأ ةرادإ ماظن تابلطتم ممد / لماكت نم لقحتلا )ب
.تامولعملا نمأ ةرادإ ماظنل ةمزلالا دراوملا ريفوت / ةحاتا نم لقحتلا )ت
.تامولعملا نمأ ةرادإ ماظن تابلطتمل اهتقباطم ةيمهأو تامولعملا نملأ ةلاعفلا ةرادلإا ةيمهأ رشن )ش
.ةوجرملا مئاتنلا لقحي تامولعملا نمأ ةرادإ ماظن نأ نم لقحتلا )ج
.تامولعملا نمأ ةرادإ ماظن ةيلاعف يف ماهسإل اخشلأا معدو هيجوت )ح
.رمتسملا نيسحتلا زيزعت )خ
.هتيلوؤسم ةقطنمل بسانملا وحنلا ىلع لك ،ةدايقلاءادبإب ةلصلا تاذ ىرخلأا ةرادلإا راودأ معد )د
تاسايسلا 0/5
:نأ اهنأش نم تامولعملا نملأ ةسايس ضو ايلعلا ةرادلإا ىلع بجي
؛ةأشنملا ضارغلأ ةبسانم نوكت)أ
؛تامولعملا نمأ فادهأ ضول اراطإ مدقت وأ )0-5 رظنا( تامولعملا نمأ فادهأ لمشت )ب
،تامولعملا نمأب للعتي اميف اهقيبطت بجاولا تابلطتملاب ءافولاب امازتلا نمضتت)ج
.تامولعملا نمأ ةرادإ ماظنل رمتسملا نيسحتلاب امازتلا نمضتت)د
:تامولعملا نمأ ةسايس نوكت نأ بجيو
؛ةقثوم تامولعمك ةحاتم )ه
،ةأشنملا للاخ ةروشنم )و
.ءاضتقلاا بسح ، ةينعملا فارطلأل ةحاتم )ز
ةيميظنتلا تاطلسلاو تايلوؤسملاو راودلأا 3/5
نمأب ةلصلا تاذ راودلأاب مايقلل ةبولطملا تاطلسلاو تايلوؤسملا نأ نم دكأتلا ايلعلا ةرادلإا ىلع بجي
.اهغلابإو اهصيصخت مت دق تامولعملا
)ع( 0102/00110يس يإ يأ / وزيأ
:لجأ نم
...
SLOVENSKI SIST ISO/IEC 27001
STANDARD
november 2013
Informacijska tehnologija – Varnostne tehnike – Sistemi upravljanja
informacijske varnosti – Zahteve (vključen popravek SIST ISO/IEC
27001:2013/AC101:2014)
Information technology – Security techniques – Information security management
systems – Requirements
Technologies de l'information – Techniques de sécurité – Systèmes de
management de la sécurité de l'information – Exigences
Referenčna oznaka
ICS 35.040 SIST ISO/IEC 27001:2013 (sl)
Nadaljevanje na straneh 2 do 27
© 2014-01. Slovenski inštitut za standardizacijo. Razmnoževanje ali kopiranje celote ali delov tega standarda ni dovoljeno.
SIST ISO/IEC 27001 : 2013
NACIONALNI UVOD
Standard SIST ISO/IEC 27001 (sl), Informacijska tehnologija – Varnostne tehnike – Sistemi
upravljanja informacijske varnosti – Zahteve, 2013, ima status slovenskega standarda in je istoveten
mednarodnemu standardu ISO/IEC 27001 (en), Information technology – Security techniques –
Information security management systems – Requirements, druga izdaja, 2013-10-01.
Ta standard preklicuje in nadomešča standard SIST ISO/IEC 27001:2010.
NACIONALNI PREDGOVOR
Mednarodni standard ISO/IEC 27001:2013 je pripravil pododbor združenega tehničnega odbora
Mednarodne organizacije za standardizacijo in Mednarodne elektrotehniške komisije ISO/IEC JTC
1/SC 27 Varnostne tehnike v informacijski tehnologiji.
Slovenski standard SIST ISO/IEC 27001:2013 je prevod mednarodnega standarda ISO/IEC
27001:2013. Slovenski standard SIST ISO/IEC 27001:2013 je pripravil tehnični odbor SIST/TC ITC
Informacijska tehnologija. V primeru spora glede besedila slovenskega prevoda je odločilen izvirni
mednarodni standard v angleškem jeziku.
Odločitev za izdajo tega standarda je dne 25. oktobra 2013 sprejel SIST/TC ITC Informacijska
tehnologija.
ZVEZA S STANDARDI
SIST ISO/IEC 27000 Informacijska tehnologija – Varnostne tehnike – Sistemi upravljanja
informacijske varnosti – Pregled in izrazoslovje
OSNOVA ZA IZDAJO STANDARDA
– privzem standarda ISO/IEC 27001:2013
PREDHODNA IZDAJA
– ISO/IEC 27001:2010, Informacijska tehnologija – Varnostne tehnike – Sistemi upravljanja
informacijske varnosti – Zahteve
OPOMBI
– Povsod, kjer se v besedilu standarda uporablja izraz “mednarodni standard”, v SIST ISO/IEC
27001:2013 to pomeni “slovenski standard”.
– Nacionalni uvod in nacionalni predgovor nista sestavni del standarda.
SIST ISO/IEC 27001 : 2013
VSEBINA Stran
Predgovor .4
0 Uvod .5
0.1 Splošno.5
0.2 Združljivost z drugimi standardi za sisteme upravljanja.5
1 Področje uporabe .6
2 Zveza s standardi .6
3 Izrazi in definicije .6
4 Okvir organizacije .6
4.1 Razumevanje organizacije in njenega okvira.6
4.2 Razumevanje potreb in pričakovanj zainteresiranih strank.6
4.3 Določitev obsega sistema upravljanja informacijske varnosti .6
4.4 Sistem upravljanja informacijske varnosti .7
5 Voditeljstvo .7
5.1 Voditeljstvo in zavezanost .7
5.2 Politika .7
5.3 Organizacijske vloge, odgovornosti in pooblastila .7
6 Načrtovanje .8
6.1 Ukrepi za obravnavanje tveganj in priložnosti.8
6.2 Cilji informacijske varnosti in načrtovanje njihovega doseganja .9
7 Podpora . 10
7.1 Viri. 10
7.2 Kompetentnost . 10
7.3 Ozaveščenost. 10
7.4 Sporočanje . 10
7.5 Dokumentirane informacije. 10
8 Delovanje. 11
8.1 Načrtovanje in obvladovanje delovanja. 11
8.2 Ocenjevanje tveganj informacijske varnosti . 11
8.3 Obravnavanje tveganj informacijske varnosti. 12
9 Vrednotenje . 12
9.1 Spremljanje, merjenje, analiziranje in vrednotenje. 12
9.2 Notranja presoja . 12
9.3 Vodstveni pregled. 13
10 Izboljševanje. 13
10.1 Neskladnosti in popravni ukrepi . 13
10.2 Nenehno izboljševanje . 14
Dodatek A (normativni): Cilji kontrol in kontrole . 15
Literatura. 27
SIST ISO/IEC 27001 : 2013
Predgovor
ISO (Mednarodna organizacija za standardizacijo) in IEC (Mednarodna elektrotehniška komisija)
tvorita specializiran sistem za svetovno standardizacijo. Nacionalni organi, ki so člani ISO ali IEC,
sodelujejo pri pripravi mednarodnih standardov prek tehničnih odborov, ki jih za obravnavanje
določenih strokovnih področij ustanovi ustrezna organizacija. Tehnični odbori ISO in IEC sodelujejo na
področjih skupnega interesa. Pri delu sodelujejo tudi druge mednarodne, vladne in nevladne
organizacije, povezane z ISO in IEC. Na področju informacijske tehnologije sta ISO in IEC vzpostavila
združeni tehnični odbor ISO/IEC JTC 1.
Mednarodni standardi so pripravljeni v skladu s pravili, podanimi v 2. delu Direktiv ISO/IEC.
Glavna naloga tehničnih odborov je priprava mednarodnih standardov. Osnutki mednarodnih
standardov, ki jih sprejmejo tehnični odbori, se pošljejo vsem članom v glasovanje. Za objavo
mednarodnega standarda je treba pridobiti soglasje najmanj 75 odstotkov članov, ki se udeležijo
glasovanja.
Opozoriti je treba na možnost, da je lahko nekaj elementov tega mednarodnega standarda predmet
patentnih pravic. ISO in IEC ne prevzemata odgovornosti za prepoznavanje katerih koli ali vseh takih
patentnih pravic.
ISO/IEC 27001 je pripravil združeni tehnični odbor JTC ISO/IEC 1 Informacijska tehnologija, pododbor
SC 27 Varnostne tehnike IT.
Druga izdaja preklicuje in nadomešča prvo izdajo (ISO/IEC 27001:2005), ki je tehnično revidirana.
SIST ISO/IEC 27001 : 2013
0 Uvod
0.1 Splošno
Ta mednarodni standard je bil pripravljen, da zagotovi zahteve za vzpostavitev, izvajanje, vzdrževanje
in nenehno izboljševanje sistema upravljanja informacijske varnosti. Privzem sistema upravljanja
informacijske varnosti je strateška odločitev za organizacijo. Na vzpostavitev in izvedbo sistema
upravljanja informacijske varnosti organizacije vplivajo potrebe in cilji organizacije, varnostne zahteve,
uporabljeni organizacijski procesi ter velikost in struktura organizacije. Vsi ti dejavniki, ki vplivajo na
sistem, se bodo po pričakovanjih s časom spreminjali.
Sistem upravljanja informacijske varnosti ohranja zaupnost, celovitost in razpoložljivost informacij z
uporabo procesa za obvladovanje tveganj ter zainteresiranim strankam vzbuja zaupanje, da se
tveganja ustrezno obvladujejo.
Pomembno je, da je sistem upravljanja informacijske varnosti del procesov organizacije in splošne
strukture vodenja in je integriran z njimi ter da je informacijska varnost sprejeta pri zasnovi procesov,
informacijskih sistemov in kontrol. Pričakuje se, da bo izvajanje sistema upravljanja informacijske
varnosti skladno s potrebami organizacije.
Ta mednarodni standard lahko uporabljajo notranje ali zunanje stranke za ocenjevanje sposobnosti
organizacije izpolnjevati lastne zahteve informacijske varnosti.
Vrstni red predstavitve zahtev v tem mednarodnem standardu ne odraža njihovega pomena ali
nakazuje vrstnega reda, v katerem naj bi se izvedle. Elementi na seznamu so oštevilčeni zgolj za
namene sklicevanja.
Standard ISO/IEC 27000 podaja pregled in izrazje sistemov upravljanja informacijske varnosti, pri
čemer se sklicuje na skupino standardov za sisteme upravljanja informacijske varnosti (vključno s
[2] [3] [4]
standardi ISO/IEC 27003 , ISO/IEC 27004 in ISO/IEC 27005 ) s povezanimi izrazi in definicijami.
0.2 Združljivost z drugimi standardi za sisteme upravljanja
Ta mednarodni standard uporablja strukturo visoke ravni, enake naslove podtočk, enako besedilo,
splošne izraze in temeljne definicije iz dodatka SL k Direktivam ISO/IEC, 1. del, konsolidirana priloga
ISO, zato ohranja združljivost z drugimi standardi za sisteme upravljanja, ki so sprejeli dodatek SL.
Ta splošni pristop iz dodatka SL bo koristil tistim organizacijam, ki so izbrale vzpostavitev enotnega
sistema upravljanja, ki izpolnjuje zahteve iz dveh ali več standardov za sisteme upravljanja.
SIST ISO/IEC 27001 : 2013
Informacijska tehnologija – Varnostne tehnike – Sistemi upravljanja
informacijske varnosti – Zahteve
1 Področje uporabe
Ta mednarodni standard določa zahteve za vzpostavitev, izvajanje, vzdrževanje in nenehno
izboljševanje sistema upravljanja informacijske varnosti v okviru organizacije. Zajema tudi zahteve za
ocenjevanje in obravnavanje tveganj informacijske varnosti, ki so prilagojene potrebam organizacije.
Zahteve, postavljene v tem mednarodnem standardu, so generične in so namenjene uporabi v vseh
organizacijah ne glede na vrsto, velikost ali naravo. Izključevanje katere koli zahteve, določene v
točkah 4 do 10, ni sprejemljivo, kadar organizacija zagotavlja skladnost s tem mednarodnim
standardom.
2 Zveza s standardi
Ta dokument se v celoti ali v delih normativno sklicuje na naslednje dokumente, ki so nepogrešljivi pri
njegovi uporabi. Pri datiranih sklicevanjih se uporablja zgolj navedena izdaja. Pri nedatiranih sklicevanjih
se uporablja zadnja izdaja navedenega dokumenta (vključno z dopolnili).
ISO/IEC 27000 Informacijska tehnologija – Varnostne tehnike – Sistemi upravljanja
informacijske varnosti – Pregled in izrazoslovje
3 Izrazi in definicije
V tem dokumentu so uporabljeni izrazi in definicije, ki so podani v standardu ISO/IEC 27000.
4 Okvir organizacije
4.1 Razumevanje organizacije in njenega okvira
Organizacija mora določiti zunanja in notranja vprašanja, ki so pomembna za njen namen ter vplivajo
na njeno sposobnost doseganja pričakovanega(-ih) rezultata(-ov) njenega sistema upravljanja
informacijske varnosti.
OPOMBA: Določanje teh vprašanj se nanaša na opredelitev zunanjega in notranjega okvira organizacije iz točke 5.3
[5]
standarda ISO 31000:2009 .
4.2 Razumevanje potreb in pričakovanj zainteresiranih strank
Organizacija mora določiti:
a) zainteresirane stranke, ki so pomembne za sistem upravljanja informacijske varnosti, in
b) zahteve teh zainteresiranih strank, ki so pomembne za informacijsko varnost.
OPOMBA: Zahteve zainteresiranih strank lahko vključujejo zahteve zakonodaje in predpisov ter pogodbene obveznosti.
4.3 Določitev obsega sistema upravljanja informacijske varnosti
Organizacija mora določiti meje in uporabnost sistema upravljanja informacijske varnosti za
opredelitev njegovega obsega.
Organizacija pri določanju tega obsega upošteva:
a) zunanja in notranja vprašanja iz točke 4.1,
b) zahteve iz točke 4.2 ter
c) povezave in odvisnosti med aktivnostmi, ki jih izvaja organizacija, in aktivnostmi, k
...
SLOVENSKI SIST ISO/IEC 27001
STANDARD
november 2013
Informacijska tehnologija – Varnostne tehnike – Sistemi upravljanja
informacijske varnosti – Zahteve
Information technology – Security techniques – Information security management
systems – Requirements
Technologies de l'information – Techniques de sécurité – Systèmes de
management de la sécurité de l'information – Exigences
Referenčna oznaka
ICS 35.040 SIST ISO/IEC 27001:2013 (sl)
Nadaljevanje na straneh 2 do 27
© 2014-01. Slovenski inštitut za standardizacijo. Razmnoževanje ali kopiranje celote ali delov tega standarda ni dovoljeno.
SIST ISO/IEC 27001 : 2013
NACIONALNI UVOD
Standard SIST ISO/IEC 27001 (sl), Informacijska tehnologija – Varnostne tehnike – Sistemi
upravljanja informacijske varnosti – Zahteve, 2013, ima status slovenskega standarda in je istoveten
mednarodnemu standardu ISO/IEC 27001 (en), Information technology – Security techniques –
Information security management systems – Requirements, druga izdaja, 2013-10-01.
Ta standard preklicuje in nadomešča standard SIST ISO/IEC 27001:2010.
NACIONALNI PREDGOVOR
Mednarodni standard ISO/IEC 27001:2013 je pripravil pododbor združenega tehničnega odbora
Mednarodne organizacije za standardizacijo in Mednarodne elektrotehniške komisije ISO/IEC JTC
1/SC 27 Varnostne tehnike v informacijski tehnologiji.
Slovenski standard SIST ISO/IEC 27001:2013 je prevod mednarodnega standarda ISO/IEC
27001:2013. Slovenski standard SIST ISO/IEC 27001:2013 je pripravil tehnični odbor SIST/TC ITC
Informacijska tehnologija. V primeru spora glede besedila slovenskega prevoda je odločilen izvirni
mednarodni standard v angleškem jeziku.
Odločitev za izdajo tega standarda je dne 25. oktobra 2013 sprejel SIST/TC ITC Informacijska
tehnologija.
ZVEZA S STANDARDI
SIST ISO/IEC 27000 Informacijska tehnologija – Varnostne tehnike – Sistemi upravljanja
informacijske varnosti – Pregled in izrazoslovje
OSNOVA ZA IZDAJO STANDARDA
– privzem standarda ISO/IEC 27001:2013
PREDHODNA IZDAJA
– ISO/IEC 27001:2010, Informacijska tehnologija – Varnostne tehnike – Sistemi upravljanja
informacijske varnosti – Zahteve
OPOMBI
– Povsod, kjer se v besedilu standarda uporablja izraz “mednarodni standard”, v SIST ISO/IEC
27001:2013 to pomeni “slovenski standard”.
– Nacionalni uvod in nacionalni predgovor nista sestavni del standarda.
SIST ISO/IEC 27001 : 2013
VSEBINA Stran
Predgovor .4
0 Uvod .5
0.1 Splošno.5
0.2 Združljivost z drugimi standardi za sisteme upravljanja.5
1 Področje uporabe .6
2 Zveza s standardi .6
3 Izrazi in definicije .6
4 Okvir organizacije .6
4.1 Razumevanje organizacije in njenega okvira.6
4.2 Razumevanje potreb in pričakovanj zainteresiranih strank.6
4.3 Določitev obsega sistema upravljanja informacijske varnosti .6
4.4 Sistem upravljanja informacijske varnosti .7
5 Voditeljstvo .7
5.1 Voditeljstvo in zavezanost .7
5.2 Politika .7
5.3 Organizacijske vloge, odgovornosti in pooblastila .7
6 Načrtovanje .8
6.1 Ukrepi za obravnavanje tveganj in priložnosti.8
6.2 Cilji informacijske varnosti in načrtovanje njihovega doseganja .9
7 Podpora . 10
7.1 Viri. 10
7.2 Kompetentnost . 10
7.3 Ozaveščenost. 10
7.4 Sporočanje . 10
7.5 Dokumentirane informacije. 10
8 Delovanje. 11
8.1 Načrtovanje in obvladovanje delovanja. 11
8.2 Ocenjevanje tveganj informacijske varnosti . 11
8.3 Obravnavanje tveganj informacijske varnosti. 12
9 Vrednotenje . 12
9.1 Spremljanje, merjenje, analiziranje in vrednotenje. 12
9.2 Notranja presoja . 12
9.3 Vodstveni pregled. 13
10 Izboljševanje. 13
10.1 Neskladnosti in popravni ukrepi . 13
10.2 Nenehno izboljševanje . 14
Dodatek A (normativni): Cilji kontrol in kontrole . 15
Literatura. 27
SIST ISO/IEC 27001 : 2013
Predgovor
ISO (Mednarodna organizacija za standardizacijo) in IEC (Mednarodna elektrotehniška komisija)
tvorita specializiran sistem za svetovno standardizacijo. Nacionalni organi, ki so člani ISO ali IEC,
sodelujejo pri pripravi mednarodnih standardov prek tehničnih odborov, ki jih za obravnavanje
določenih strokovnih področij ustanovi ustrezna organizacija. Tehnični odbori ISO in IEC sodelujejo na
področjih skupnega interesa. Pri delu sodelujejo tudi druge mednarodne, vladne in nevladne
organizacije, povezane z ISO in IEC. Na področju informacijske tehnologije sta ISO in IEC vzpostavila
združeni tehnični odbor ISO/IEC JTC 1.
Mednarodni standardi so pripravljeni v skladu s pravili, podanimi v 2. delu Direktiv ISO/IEC.
Glavna naloga tehničnih odborov je priprava mednarodnih standardov. Osnutki mednarodnih
standardov, ki jih sprejmejo tehnični odbori, se pošljejo vsem članom v glasovanje. Za objavo
mednarodnega standarda je treba pridobiti soglasje najmanj 75 odstotkov članov, ki se udeležijo
glasovanja.
Opozoriti je treba na možnost, da je lahko nekaj elementov tega mednarodnega standarda predmet
patentnih pravic. ISO in IEC ne prevzemata odgovornosti za prepoznavanje katerih koli ali vseh takih
patentnih pravic.
ISO/IEC 27001 je pripravil združeni tehnični odbor JTC ISO/IEC 1 Informacijska tehnologija, pododbor
SC 27 Varnostne tehnike IT.
Druga izdaja preklicuje in nadomešča prvo izdajo (ISO/IEC 27001:2005), ki je tehnično revidirana.
SIST ISO/IEC 27001 : 2013
0 Uvod
0.1 Splošno
Ta mednarodni standard je bil pripravljen, da zagotovi zahteve za vzpostavitev, izvajanje, vzdrževanje
in nenehno izboljševanje sistema upravljanja informacijske varnosti. Privzem sistema upravljanja
informacijske varnosti je strateška odločitev za organizacijo. Na vzpostavitev in izvedbo sistema
upravljanja informacijske varnosti organizacije vplivajo potrebe in cilji organizacije, varnostne zahteve,
uporabljeni organizacijski procesi ter velikost in struktura organizacije. Vsi ti dejavniki, ki vplivajo na
sistem, se bodo po pričakovanjih s časom spreminjali.
Sistem upravljanja informacijske varnosti ohranja zaupnost, celovitost in razpoložljivost informacij z
uporabo procesa za obvladovanje tveganj ter zainteresiranim strankam vzbuja zaupanje, da se
tveganja ustrezno obvladujejo.
Pomembno je, da je sistem upravljanja informacijske varnosti del procesov organizacije in splošne
strukture vodenja in je integriran z njimi ter da je informacijska varnost sprejeta pri zasnovi procesov,
informacijskih sistemov in kontrol. Pričakuje se, da bo izvajanje sistema upravljanja informacijske
varnosti skladno s potrebami organizacije.
Ta mednarodni standard lahko uporabljajo notranje ali zunanje stranke za ocenjevanje sposobnosti
organizacije izpolnjevati lastne zahteve informacijske varnosti.
Vrstni red predstavitve zahtev v tem mednarodnem standardu ne odraža njihovega pomena ali
nakazuje vrstnega reda, v katerem naj bi se izvedle. Elementi na seznamu so oštevilčeni zgolj za
namene sklicevanja.
Standard ISO/IEC 27000 podaja pregled in izrazje sistemov upravljanja informacijske varnosti, pri
čemer se sklicuje na skupino standardov za sisteme upravljanja informacijske varnosti (vključno s
[2] [3] [4]
standardi ISO/IEC 27003 , ISO/IEC 27004 in ISO/IEC 27005 ) s povezanimi izrazi in definicijami.
0.2 Združljivost z drugimi standardi za sisteme upravljanja
Ta mednarodni standard uporablja strukturo visoke ravni, enake naslove podtočk, enako besedilo,
splošne izraze in temeljne definicije iz dodatka SL k Direktivam ISO/IEC, 1. del, konsolidirana priloga
ISO, zato ohranja združljivost z drugimi standardi za sisteme upravljanja, ki so sprejeli dodatek SL.
Ta splošni pristop iz dodatka SL bo koristil tistim organizacijam, ki so izbrale vzpostavitev enotnega
sistema upravljanja, ki izpolnjuje zahteve iz dveh ali več standardov za sisteme upravljanja.
SIST ISO/IEC 27001 : 2013
Informacijska tehnologija – Varnostne tehnike – Sistemi upravljanja
informacijske varnosti – Zahteve
1 Področje uporabe
Ta mednarodni standard določa zahteve za vzpostavitev, izvajanje, vzdrževanje in nenehno
izboljševanje sistema upravljanja informacijske varnosti v okviru organizacije. Zajema tudi zahteve za
ocenjevanje in obravnavanje tveganj informacijske varnosti, ki so prilagojene potrebam organizacije.
Zahteve, postavljene v tem mednarodnem standardu, so generične in so namenjene uporabi v vseh
organizacijah ne glede na vrsto, velikost ali naravo. Izključevanje katere koli zahteve, določene v
točkah 4 do 10, ni sprejemljivo, kadar organizacija zagotavlja skladnost s tem mednarodnim
standardom.
2 Zveza s standardi
Ta dokument se v celoti ali v delih normativno sklicuje na naslednje dokumente, ki so nepogrešljivi pri
njegovi uporabi. Pri datiranih sklicevanjih se uporablja zgolj navedena izdaja. Pri nedatiranih sklicevanjih
se uporablja zadnja izdaja navedenega dokumenta (vključno z dopolnili).
ISO/IEC 27000 Informacijska tehnologija – Varnostne tehnike – Sistemi upravljanja
informacijske varnosti – Pregled in izrazoslovje
3 Izrazi in definicije
V tem dokumentu so uporabljeni izrazi in definicije, ki so podani v standardu ISO/IEC 27000.
4 Okvir organizacije
4.1 Razumevanje organizacije in njenega okvira
Organizacija mora določiti zunanja in notranja vprašanja, ki so pomembna za njen namen ter vplivajo
na njeno sposobnost doseganja pričakovanega(-ih) rezultata(-ov) njenega sistema upravljanja
informacijske varnosti.
OPOMBA: Določanje teh vprašanj se nanaša na opredelitev zunanjega in notranjega okvira organizacije iz točke 5.3
[5]
standarda ISO 31000:2009 .
4.2 Razumevanje potreb in pričakovanj zainteresiranih strank
Organizacija mora določiti:
a) zainteresirane stranke, ki so pomembne za sistem upravljanja informacijske varnosti, in
b) zahteve teh zainteresiranih strank, ki so pomembne za informacijsko varnost.
OPOMBA: Zahteve zainteresiranih strank lahko vključujejo zahteve zakonodaje in predpisov ter pogodbene obveznosti.
4.3 Določitev obsega sistema upravljanja informacijske varnosti
Organizacija mora določiti meje in uporabnost sistema upravljanja informacijske varnosti za
opredelitev njegovega obsega.
Organizacija pri določanju tega obsega upošteva:
a) zunanja in notranja vprašanja iz točke 4.1,
b) zahteve iz točke 4.2 ter
c) povezave in odvisnosti med aktivnostmi, ki jih izvaja organizacija, in aktivnostmi, ki jih izvajajo
druge organizacije.
-------------
...
Questions, Comments and Discussion
Ask us and Technical Secretary will try to provide an answer. You can facilitate discussion about the standard in here.