ISO/IEC 27001 - How to measure the effectiveness of information security?

How can you tell that your ISO/IEC 27001 information security management system (ISMS) is making a difference?

You simply can’t be too careful when it comes to information security. Protecting personal records and commercially sensitive information is critical. But how can you tell that your ISO/IEC 27001 information security management system (ISMS) is making a difference? A new ISO/IEC International Standard can help you out.

The recently updated ISO/IEC 27004:2016, Information technology – Security techniques – Information security management – Monitoring, measurement, analysis and evaluation, provides guidance on how to assess the performance of ISO/IEC 27001. It explains how to develop and operate measurement processes, and how to assess and report the results of a set of information security metrics.

Prof. Edward Humphreys, Convenor of the working group that developed the standard (ISO/IEC JTC 1/SC 27), says: “Cyber-attacks are among the greatest risks an organization can face. This is why the much improved version of ISO/IEC 27004 provides essential and practical support to the many organizations that are implementing ISO/IEC 27001 to protect themselves from the growing diversity of security attacks that business is facing today.”

Security metrics can provide insights regarding the effectiveness of an ISMS and, as such, have taken centre stage. Whether you’re an engineer or consultant responsible for security and reporting to management or an executive who needs better information for decision making, security metrics have become an important vehicle for communicating the state of an organization’s cyber-risk posture.

In Prof. Humphreys’ own words: “Organizations need help to address the question of whether the organization’s investment in information security management is effective, fit for purpose to react, defend and respond to the continually changing cyber-risk environment. This is where ISO/IEC 27004 can provide numerous advantages.”

ISO/IEC 27004:2016 shows how to construct an information security measurement programme, how to select what to measure, and how to operate the necessary measurement processes. It includes extensive examples of different types of measures, and how the effectiveness of these measures can be assessed.

Among the many benefits to organizations of using ISO/IEC 27004 are: 

·   Increased accountability

·   Improved information security performance and ISMS processes

·   Evidence of meeting requirements of ISO/IEC 27001, as well as applicable laws, rules and regulations 

ISO/IEC 27004:2016 replaces the 2009 edition; it has been updated and extended to align with the revised version of ISO/IEC 27001 to provide organizations with greater added value and confidence.

ISO/IEC 27004:2016 was developed by joint technical committee ISO/IEC JTC 1, Information technology, subcommittee SC 27, IT security techniques, whose secretariat is held by DIN, the ISO member for Germany. It is available from your national ISO member or through the ISO Store.

Source: www.iso.org


Related News

DR. SUNG HWAN CHO OF KOREA TAKES NEW POSITION AS CHAIRMAN OF ISO COMMITTEE FROM JANUARY 2024
DR. SUNG HWAN CHO OF KOREA TAKES NEW POSITION AS CHAIRMAN OF ISO COMMITTEE FROM JANUARY 2024

554 Views

In January 2024, Dr Sung Hwan Cho of the Republic of Korea took up his new position as ISO President. In this welcome message, he shares his thoughts on how ISO can increase its outreach to respond to current global challenges and the focus of his tenure for the coming two years.
RESILIENCE THROUGH ALLIANCES: BUILDING CLIMATE ADAPTATION
RESILIENCE THROUGH ALLIANCES: BUILDING CLIMATE ADAPTATION

226 Views

By Diana Maria Quimbay Valencia, Country Director, Rainforest Alliance, LinkedIn The climate crisis sits at the very top of the global policy agenda today. From decarbonization to the reduction of plastic pollution and the protection of natural resources, the urgency of the task rings loud and clear. The time to act is now.
ANNOUNCEMENT OF COMPANY NAME CHANGE SINCE 05 APRIL 2017
ANNOUNCEMENT OF COMPANY NAME CHANGE SINCE 05 APRIL 2017

6164 Views

Tổ chức chứng nhận KMAR Việt Nam chính thức đổi tên công ty thành KMR Việt Nam kể từ ngày 05/04/2017
FSSC 22000 issues 15,000th certificate
FSSC 22000 issues 15,000th certificate

5290 Views

Last week, FSSC 22000 has achieved a new milestone
ISO 45001:2016 - Occupational health and safety
ISO 45001:2016 - Occupational health and safety

8303 Views

ISO 45001 is an International Standard that specifies requirements for an occupational health and safety (OH&S) management system, with guidance for its use, to enable an organization to proactively improve its OH&S performance in preventing injury and ill-health.
KMR HAPPY NEW YEAR  2021 AND ANNOUNCE  LUNAR NEW YEAR HOLIDAY
KMR HAPPY NEW YEAR 2021 AND ANNOUNCE LUNAR NEW YEAR HOLIDAY

1002 Views

KMR VN would like to announce schedule for 2021 Lunar New Year holiday
The Global Food Safety Conference 2017
The Global Food Safety Conference 2017

4096 Views

FSSC 22000 will attend the GFSI Global Food Safety Conference in Houston USA
KMR HAPPY NEW YEAR 2024 AND ANNOUNCE LUNAR NEW YEAR HOLIDAY
KMR HAPPY NEW YEAR 2024 AND ANNOUNCE LUNAR NEW YEAR HOLIDAY

508 Views

KMR VN would like to announce schedule for 2024 Lunar New Year holiday
What will be the benefits of using ISO 45001?
What will be the benefits of using ISO 45001?

6224 Views

An ISO 45001 based OH&S management system will enable an organization to improve its OH&S performance

Comment
  • Your review