Information Security Management System

ISO 27001:2013

Brief :

An International Standard that specifies the requirements for establishing implementing, operating, monitoring, reviewing, maintaining and improving a documented Information Security Management System within the context of the organization’s overall business risks. It specifies requirements for the implementation of security controls customized to the needs of individual organizations or parts thereof.

It is designed to ensure the selection of adequate and proportionate security controls that protect information assets and give confidence to interested parties.

  • Security Policy: addresses management support, commitment & direction in accomplishing information security goal.
  • Asset management: addresses the way assets are grouped, handled and stored.
  • Human Resources Security: addresses an organization’s ability to mitigate risk inherent in human interactions, including staffing, training, security responsibilities.
  • Physical & Environmental Security: addresses risk inherent to organizational premises and the ability of physical infrastructure to protect the assets.
  • Communications & Operations Management: addresses an organization’s ability to ensure correct and secure operation of its assets, including configuration, changes, administration
  • Access Control: addresses an organization’s ability to control access to assets based on business and security requirements
  • Information Security Incident Management: addresses an organization’s ability to record, investigate and take corrective measures
  • Business Continuity Management: addresses an organization’s ability to counteract interruptions to normal operations, due to disasters
  • Compliance: addresses an organization’s ability to remain in compliance with regulatory, statutory, contractual, and security requirements

Applicability :

It can be applicable to all organization that is having information like software companies, commercial enterprises, government agencies, non-profit organizations