Latest News Headlines
Commercial Credit News
|Taking information security management to another level with a new standard for market sectors|
|Tuesday, 16 August 2016|
With cyber threats on the rise putting businesses and industries at risk, it is more important than ever that organizations protect their information and that of their customers. It is no surprise, then, that ISO’s standard for information security, ISO/IEC 27001, has become so widely used. A new standard just published will take that a step further, helping to apply the requirements of this flagship standard to specific sectors.
Offering more tailored protection for specific sectors (e.g. finance, transportation and healthcare, and infrastructure projects such as smart cities) to ward off threats to their information has become a political, business and economic imperative, driving a need for sector-specific cyber standards. The recently published ISO/IEC 27009 will help standards developers do just that, providing the necessary advice and guidance on how to create standards that apply ISO/IEC 27001 to individual sectors.
ISO/IEC 27009, Information technology – Security techniques – Sector-specific application of ISO/IEC 27001 – Requirements, joins the ISO/IEC 27000 family of standards to help maximize the effectiveness of ISO/IEC 27001. It explains how to include requirements and controls additional to those in ISO/IEC 27001 that are applicable to specific sectors, enabling them to achieve consistency when developing standards in this family.
Prof. Edward Humphreys, Convenor of ISO/IEC SC 27/WG 1, the working group that developed the standard, said ISO/IEC 27001 is the international common language for information security management, so ISO/IEC 27009 will enhance this common language across the sector landscape and shape the development of standards for sector-specific information security and privacy.
“We have already developed several sector-specific standards, such as ISO/IEC 27011 for telecoms, ISO/IEC 27017 for cloud computing and ISO/IEC 27019 for the energy sector. These standards are examples of where controls, additional to those in ISO/IEC 27001, have been defined to meet the requirements of the specific sectors concerned. In developing these standards, it became clear that a harmonized structure and language, based on ISO/IEC 27001, and specific guidance would make the development of future sector-specific standards more effective, and avoid duplication.
“ISO/IEC 27009 will ensure that the development of new, and the revision of existing, sector-specific standards can all adopt an approach that is consistent with ISO/IEC 27001. Therefore, it will provide advice on how to add to, refine or interpret the requirements of ISO/IEC 27001 and how to add or modify the implementation guidance of ISO/IEC 27002 for sector-specific use.”
Forums International Ltd
Attendance at your first meeting is free of charge, and please quote reference 'CCR2016' to receive the special 10% discount off of your first annual subscription.
Find out more here.
The latest edition of CCR Magazine, the leading editorial publication in the UK credit industry, is out.
CCR is the premier magazine for consumer and credit professionals. It provides an independent voice to the industry, breaking major news stories and running in-depth features.
As a magazine, it works with and campaigns on behalf of the credit industry to promote its importance as a centre of potential profit and business development to the wider business world.
Providing information and analysis for thousands of senior credit professionals worldwide, every quarter.
GTS Media Ltd
81 Cambridge Road
Registered in England No: 05483197