Standards ISO 2700x - Towards the governance of the security of information systems

Since the early 2000s, the ISO 27000 family of standards (information systems security) has been growing steadily. It seeks to answer the questions that CISOs (information systems security managers) may ask themselves:

• how to audit IS security : ISO 27001  ;

• how to build an ISMS (Information Security Management System) : ISO 27003  ;

• how to manage risk : ISO 27005  ;

• how to manage business continuity following a disaster : ISO 27031  ;

• how to manage security incidents : ISO 27035 .

From the point of view of Sylvain Laborde, ISO 27001 auditor, a project to implement security management is a cross-functional project; while the IT department is, in fact, involved, several other departments may also be impacted. The project concerns the entire hierarchy of the organization. The success of the project depends essentially on the involvement of all the people concerned in the company, from top management downwards.

A project to implement information systems security follows the logic of the Deming wheel. The PLAN phase, which involves setting objectives, is made up of four main stages: definition of scope and policy, risk assessment, risk treatment, selection of security measures. A DO phase, comprising the following steps: planning risk treatment, generating meaningful indicators, training and raising staff awareness, day-to-day management of the ISMS, incident detection and response. The ISO 2700x suite of standards calls for the implementation of control measures: this is the CHECK phase (based on audits, controls and reviews). If deviations from objectives are detected, the ACT phase will enable corrective, preventive and improvement actions to be taken.

The implementation of a safety management system guarantees the adoption of best practices and increased reliability, while certification by an independent body ensures the confidence of the company's stakeholders (customers, suppliers, shareholders, banks, authorities, etc.). The ISO 27000 series is currently being finalized, and enjoys unanimous international support. This standard is beginning to interest more and more French entrepreneurs, not only because of its normative nature, but also because it is complementary to another standard...