ISO 27001: Information Security Management Systems

Today, more than ever, information and its management and security are management issues in their own right. As Jérôme Denis puts it , information technology and its security involve a paradox which consists in an unprecedented development of efficiency, but also of the technical fragility of organizations. Communication technologies and information systems are both an opportunity to increase the circulation of information within a company as a source of competitive advantage, but they can also make it vulnerable to certain threats. Management practices must now evolve to incorporate into corporate governance a concern for securing corporate information, which constitutes an (intangible) asset in its own right. . The latter are a management challenge, as they imply risks and a regime of permanent fragility for the company, which can impact on the quality of goods and services supplied (particularly in terms of delivery times and the reliability of information provided). In an interconnected world, information and related processes, systems and networks are critical organizational assets. Organizations and their information systems and networks face security threats from multiple sources, including computer-assisted fraud, espionage, sabotage, vandalism, fire and flood. Damage to information systems and networks by malware, hacking and saturation attacks is becoming more common, more ambitious and increasingly sophisticated.

Faced with this situation, the ISO/IEC 27001 :2013 "Safety techniques – Systèmes de gestion de la sécurité de l'information" is designed to meet this management challenge by considering information security as a cross-functional project. While the objective of the standard is to move towards certification, its aim is to enrich practices and establish active management of information systems security. This iterative process is designed to integrate the organization's various stakeholders, both from a hierarchical perspective (Top Down-Bottom Up) and from a cross-functional point of view, in line with the organization's processes.

The standard ISO/IEC 27001 :2013 is based on the ISO 27000 series of standards. This standard describes the...