SIST EN ISO/IEC 27040:2017

Information technology - Security techniques - Storage security (ISO/IEC 27040:2015)

This International Standard provides detailed technical guidance on how organizations can define
an appropriate level of risk mitigation by employing a well-proven and consistent approach to the
planning, design, documentation, and implementation of data storage security. Storage security applies
to the protection (security) of information where it is stored and to the security of the information
being transferred across the communication links associated with storage. Storage security includes
the security of devices and media, the security of management activities related to the devices and
media, the security of applications and services, and security relevant to end-users during the lifetime
of devices and media and after end of use.
Storage security is relevant to anyone involved in owning, operating, or using data storage devices,
media, and networks. This includes senior managers, acquirers of storage product and service, and
other non-technical managers or users, in addition to managers and administrators who have specific
responsibilities for information security or storage security, storage operation, or who are responsible
for an organization’s overall security program and security policy development. It is also relevant to
anyone involved in the planning, design, and implementation of the architectural aspects of storage
network security.
This International Standard provides an overview of storage security concepts and related definitions.
It includes guidance on the threat, design, and control aspects associated with typical storage scenarios
and storage technology areas. In addition, it provides references to other International Standards and
technical reports that address existing practices and techniques that can be applied to storage security.

Informationstechnik - IT-Sicherheitsverfahren - Speichersicherheit (ISO/IEC 27040:2015)

Technologie de l'information - Techniques de sécurité - Sécurité de stockage (ISO/IEC 27040:2015)

L'ISO/IEC 27040:2015 donne des préconisations techniques détaillées concernant la manière dont les organismes peuvent définir un niveau approprié d'atténuation du risque grâce à l'emploi d'une approche reconnue et cohérente de la planification, la conception, la documentation et la mise en ?uvre de la sécurité de stockage des données. La sécurité du stockage s'applique à la protection (la sécurité) des informations là où elles sont stockées et à la sécurité des informations transférées au moyen des liaisons de communication associées au stockage. La sécurité du stockage comprend la sécurité des dispositifs et des supports, la sécurité des activités de management associées aux dispositifs et aux supports, la sécurité des applications et des services et la sécurité relative aux utilisateurs finaux pendant la durée de vie de leurs dispositifs et supports et après la fin de leur utilisation.
La sécurité du stockage concerne toute personne impliquée dans la possession, l'exploitation ou l'utilisation de dispositifs, supports et réseaux de stockage de données. Il s'agit des cadres supérieurs, des acheteurs de produits et services de stockage et d'autres gestionnaires ou utilisateurs non techniciens, outre les gestionnaires et administrateurs ayant des responsabilités spécifiques en matière de sécurité de l'information ou de sécurité du stockage, d'exploitation du stockage, ou responsables du programme général de sécurité et du développement des politiques de sécurité de l'organisme. Elle concerne également toute personne impliquée dans la planification, la conception et la mise en ?uvre des aspects architecturaux de la sécurité des réseaux de stockage.
L'ISO/IEC 27040:2015 propose une description générale des concepts de sécurité du stockage et des définitions associées. Elle comprend des préconisations concernant les aspects relatifs aux menaces, à la conception et au contrôle ainsi que des scénarios de stockage et des technologies de stockage typiques. Elle donne de plus des références à d'autres Normes internationales et rapports techniques qui traitent des pratiques et techniques existantes pouvant être appliquées à la sécurité du stockage.

Informacijska tehnologija - Varnostne tehnike - Varnostno shranjevanje (ISO/IEC 27040:2015)

Ta mednarodni standard podaja podrobne tehnične smernice, kako lahko organizacije določijo
ustrezno raven za zmanjšanje tveganja z uporabo dobro preizkušenih in doslednih pristopov k
načrtovanju, oblikovanju, dokumentiranju in izvajanju varnostnega shranjevanja podatkov. Varnostno shranjevanje velja za zaščito (varnost) informacij na mestu shranjevanja in za varnost informacij, ki se prenašajo prek komunikacijskih povezav, povezanih s shranjevanjem. Varnostno shranjevanje vključuje varnost naprav in medijev, varnost aktivnosti upravljanja, povezanih z napravami in mediji, varnost aplikacij in storitev ter varnost v zvezi s končnimi uporabniki v času življenjske dobe naprav in medijev ter po koncu uporabe.
Varnost shranjevanja je pomembna vsem, ki si lastijo, upravljajo ali uporabljajo naprave, medije in
omrežja za shranjevanje podatkov. To vključuje višje vodstvene delavce, odjemalce izdelkov in storitev za shranjevanje ter
druge netehnične upravitelje ali uporabnike poleg upraviteljev in skrbnikov s posebnimi odgovornostmi za upravljanje informacijske varnosti ali varnosti shranjevanja, delovanje shranjevanja ali oseb, ki so odgovorne za celoten varnostni program in razvoj varnostnega pravilnika v organizaciji. Prav tako je pomembna vsem, ki so vključeni v načrtovanje, oblikovanje in izvajanje arhitekturnih vidikov varnosti omrežja za shranjevanje.
Ta mednarodni standard podaja pregled nad koncepti varnosti shranjevanja in povezanih definicij. Vključuje smernice za vidike groženj, zasnove in nadzora, povezane z običajnimi scenariji shranjevanja in področji tehnologije shranjevanja. Poleg tega podaja sklice na druge mednarodne standarde in tehnična poročila, ki obravnavajo obstoječe prakse in tehnike, ki jih je mogoče uporabiti pri varnosti shranjevanja.

General Information

• Status: Published
• Publication Date: 13-Nov-2016
• ICS: 35.030 - IT Security
• Technical Committee: ITC - Information technology
• Current Stage: 6060 - National Implementation/Publication (Adopted Project)
• Start Date: 05-Sep-2016
• Due Date: 10-Nov-2016
• Completion Date: 14-Nov-2016
• Ref Project: EN ISO/IEC 27040:2016 - Information technology - Security techniques - Storage security (ISO/IEC 27040:2015)

Standards Content (Sample)

SLOVENSKI STANDARD
SIST EN ISO/IEC 27040:2017
01-januar-2017
Informacijska tehnologija - Varnostne tehnike - Varnostno shranjevanje (ISO/IEC
27040:2015)
Information technology - Security techniques - Storage security (ISO/IEC 27040:2015)
Informationstechnik - IT-Sicherheitsverfahren - Speichersicherheit (ISO/IEC 27040:2015)
Technologie de l'information - Techniques de sécurité - Sécurité de stockage (ISO/IEC
27040:2015)
Ta slovenski standard je istoveten z: EN ISO/IEC 27040:2016
ICS:
35.030 Informacijska varnost IT Security
SIST EN ISO/IEC 27040:2017 en,fr,de
2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.

---------------------- Page: 1 ----------------------

SIST EN ISO/IEC 27040:2017

---------------------- Page: 2 ----------------------

SIST EN ISO/IEC 27040:2017


EN ISO/IEC 27040
EUROPEAN STANDARD

NORME EUROPÉENNE

August 2016
EUROPÄISCHE NORM
ICS 35.040
English Version

Information technology - Security techniques - Storage
security (ISO/IEC 27040:2015)
Technologie de l'information - Techniques de sécurité - Informationstechnik - IT-Sicherheitsverfahren -
Sécurité de stockage (ISO/IEC 27040:2015) Speichersicherheit (ISO/IEC 27040:2015)
This European Standard was approved by CEN on 19 June 2016.

CEN and CENELEC members are bound to comply with the CEN/CENELEC Internal Regulations which stipulate the conditions
for giving this European Standard the status of a national standard without any alteration. Up-to-date lists and bibliographical
references concerning such national standards may be obtained on application to the CEN-CENELEC Management Centre or to
any CEN and CENELEC member.

This European Standard exists in three official versions (English, French, German). A version in any other language made by
translation under the responsibility of a CEN and CENELEC member into its own language and notified to the CEN-CENELEC
Management Centre has the same status as the official versions.

CEN and CENELEC members are the national standards bodies of Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic,
Denmark, Estonia, Finland, Former Yugoslav Republic of Macedonia, France, Germany, Greece, Hungary, Iceland, Ireland, Italy,
Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden,
Switzerland, Turkey and United Kingdom.





EUROPEAN COMMITTEE FOR STANDARDIZATION
COMITÉ EUROPÉEN DE NORMALISATIO N

EUROPÄISCHES KOMITEE FÜR NORMUN G

CEN-CENELEC Management Centre: Avenue Marnix 17, B-1000 Brussels
© 2016 CEN and CENELEC All rights of exploitation in any form and by any means Ref. No. EN ISO/IEC 27040:2016 E
reserved worldwide for CEN and CENELEC national
Members.

---------------------- Page: 3 ----------------------

SIST EN ISO/IEC 27040:2017
EN ISO/IEC 27040:2016 (E)
Contents Page
European foreword . 3

2

---------------------- Page: 4 ----------------------

SIST EN ISO/IEC 27040:2017
EN ISO/IEC 27040:2016 (E)
European foreword
The text of ISO/IEC 27040:2015 has been prepared by Technical Committee ISO/IEC JTC 1 “Information
technology” of the International Organization for Standardization (ISO) and the International
Electrotechnical Commission (IEC) and has been taken over as EN ISO/IEC 27040:2016.
This European Standard shall be given the status of a national standard, either by publication of an
identical text or by endorsement, at the latest by February 2017, and conflicting national standards
shall be withdrawn at the latest by February 2017.
Attention is drawn to the possibility that some of the elements of this document may be the subject of
patent rights. CEN [and/or CENELEC] shall not be held responsible for identifying any or all such patent
rights.
According to the CEN-CENELEC Internal Regulations, the national standards organizations of the
following countries are bound to implement this European Standard: Austria, Belgium, Bulgaria,
Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, Former Yugoslav Republic of Macedonia,
France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta,
Netherlands, Norway, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden, Switzerland,
Turkey and the United Kingdom.
Endorsement notice
The text of ISO/IEC 27040:2015 has been approved by CEN as EN ISO/IEC 27040:2016 without any
modification.


3

---------------------- Page: 5 ----------------------

SIST EN ISO/IEC 27040:2017

---------------------- Page: 6 ----------------------

SIST EN ISO/IEC 27040:2017
INTERNATIONAL ISO/IEC
STANDARD 27040
First edition
2015-01-15
Information technology — Security
techniques — Storage security
Technologie de l’information — Te
...