ISO Updates Information Security Standard
The standard provides organizations with guidance on navigating information security risks.
The ISO/IEC 27005:2018 standard, Information technology – Security techniques – Information security risk management, has been revised recently, according to the International Organization for Standardization. The standard provides organizations with guidance on navigating information security risks.
ISO/IEC works complementary to ISO/IEC 27001:2013 to provide the requirements for an information security management system. The updated standard provides guidance for risk management to help meet requirements set out in ISO/IEC 27001.
“ISO/IEC 27005 provides the ‘why, what and how’ for organizations to be able to manage their information security risks effectively in compliance with ISO/IEC 27001,” said Edward Humphreys, Convener of the ISO/IEC working group that developed both ISO/IEC 27001 and ISO/IEC 27005. “It also helps to demonstrate to an organization’s customers or stakeholders that robust risk processes are in place, giving them confidence that they are good to do business with.”
The standard is a key tool in the ISO/IEC 27000 toolkit, according to Humphreys. ISO/IEC 27005 is one of more than a dozen standards in the cyber-risk standard series, including standards for protecting information in the Cloud, cybersecurity, and more.