FOREWORD
0 INTRODUCTION
0.1 WHAT IS INFORMATION SECURITY?
0.2 WHY INFORMATION SECURITY IS NEEDED?
0.3 HOW TO ESTABLISH SECURITY REQUIREMENTS
0.4 ASSESSING SECURITY RISKS
0.5 SELECTING CONTROLS
0.6 INFORMATION SECURITY STARTING POINT
0.7 CRITICAL SUCCESS FACTORS
0.8 DEVELOPING YOUR OWN GUIDELINES
1 SCOPE
2 TERMS AND DEFINITIONS
3 STRUCTURE OF THIS STANDARD
3.1 CLAUSES
3.2 MAIN SECURITY CATEGORIES
4 RISK ASSESSMENT AND TREATMENT
4.1 ASSESSING SECURITY RISKS
4.2 TREATING SECURITY RISKS
5 SECURITY POLICY
5.1 INFORMATION SECURITY POLICY
6 ORGANIZATION OF INFORMATION SECURITY
6.1 INTERNAL ORGANIZATION
6.2 EXTERNAL PARTIES
7 ASSET MANAGEMENT
7.1 RESPONSIBILITY FOR ASSETS
7.2 INFORMATION CLASSIFICATION
8 HUMAN RESOURCES SECURITY
8.1 PRIOR TO EMPLOYMENT
8.2 DURING EMPLOYMENT
8.3 TERMINATION OR CHANGE OF EMPLOYMENT
9 PHYSICAL AND ENVIRONMENTAL SECURITY
9.1 SECURE AREAS
9.2 EQUIPMENT SECURITY
10 COMMUNICATIONS AND OPERATIONS MANAGEMENT
10.1 OPERATIONAL PROCEDURES AND RESPONSIBILITIES
10.2 THIRD PARTY SERVICE DELIVERY MANAGEMENT
10.3 SYSTEM PLANNING AND ACCEPTANCE
10.4 PROTECTION AGAINST MALICIOUS AND MOBILE CODE
10.5 BACK-UP
10.6 NETWORK SECURITY MANAGEMENT
10.7 MEDIA HANDLING
10.8 EXCHANGE OF INFORMATION
10.9 ELECTRONIC COMMERCE SERVICES
10.10 MONITORING
11 ACCESS CONTROL
11.1 BUSINESS REQUIREMENT FOR ACCESS CONTROL
11.2 USER ACCESS MANAGEMENT
11.3 USER RESPONSIBILITIES
11.4 NETWORK ACCESS CONTROL
11.5 OPERATING SYSTEM ACCESS CONTROL
11.6 APPLICATION AND INFORMATION ACCESS CONTROL
11.7 MOBILE COMPUTING AND TELEWORKING
12 INFORMATION SYSTEMS ACQUISITION, DEVELOPMENT AND MAINTENANCE
12.1 SECURITY REQUIREMENTS OF INFORMATION SYSTEMS
12.2 CORRECT PROCESSING IN APPLICATIONS
12.3 CRYPTOGRAPHIC CONTROLS
12.4 SECURITY OF SYSTEM FILES
12.5 SECURITY IN DEVELOPMENT AND SUPPORT PROCESSES
12.6 TECHNICAL VULNERABILITY MANAGEMENT
13 INFORMATION SECURITY INCIDENT MANAGEMENT
13.1 REPORTING INFORMATION SECURITY EVENTS AND WEAKNESSES
13.2 MANAGEMENT OF INFORMATION SECURITY INCIDENTS AND
IMPROVEMENTS
14 BUSINESS CONTINUITY MANAGEMENT
14.1 INFORMATION SECURITY ASPECTS OF BUSINESS CONTINUITY
MANAGEMENT
15 COMPLIANCE
15.1 COMPLIANCE WITH LEGAL REQUIREMENTS
15.2 COMPLIANCE WITH SECURITY POLICIES AND STANDARDS, AND
TECHNICAL COMPLIANCE
15.3 INFORMATION SYSTEMS AUDIT CONSIDERATIONS
BIBLIOGRAPHY
INDEX