ISO Updates Information Security Standard

The standard provides organizations with guidance on navigating information security risks.

The ISO/IEC 27005:2018 standard, Information technology – Security techniques – Information security risk management, has been revised recently, according to the International Organization for Standardization. The standard provides organizations with guidance on navigating information security risks.

ISO/IEC works complementary to ISO/IEC 27001:2013 to provide the requirements for an information security management system. The updated standard provides guidance for risk management to help meet requirements set out in ISO/IEC 27001.

“ISO/IEC 27005 provides the ‘why, what and how’ for organizations to be able to manage their information security risks effectively in compliance with ISO/IEC 27001,” said Edward Humphreys, Convener of the ISO/IEC working group that developed both ISO/IEC 27001 and ISO/IEC 27005. “It also helps to demonstrate to an organization’s customers or stakeholders that robust risk processes are in place, giving them confidence that they are good to do business with.”

The standard is a key tool in the ISO/IEC 27000 toolkit, according to Humphreys. ISO/IEC 27005 is one of more than a dozen standards in the cyber-risk standard series, including standards for protecting information in the Cloud, cybersecurity, and more.

comments powered by Disqus

OH&S Digital Edition

  • OHS Magazine Digital Edition - July August 2019

    July/August 2019

    Featuring:

    • CHEMICAL SAFETY TRAINING
      Getting It Right
    • PROTECTIVE APPAREL
      Navigating Standards to Match Your Hazards
    • CONSTRUCTION SAFETY
      Just Add Water
    • FACILITY SAFETY
      Creating Safe Facilities
    View This Issue