Section 2 introduces you to the International Organization of Standardization, short for ISO, and provides an explanation of management systems and a definition of an ISMS. It also provides you with a summary of the development of ISO 27000 family of standards and elaborates on each of them. In addition, the advantages that organizations can obtain by implementing an ISMS based on ISO 27001 are also discussed. And lastly, we will also give a short explanation. On legal and regulatory conformity throughout the world in this section. So let's start with what is ISO. So ISO stands for the International Organization for Standardization. And it really consists about well, it's an international organization of national standards bodies, and it consists out of uh whole 160 countries So 160 countries contribute to the ISO organization. The final results of ISO works are published as international standards. And since the beginning, which was 1947, ISO has published over 24,000 standards. So I usually say if you can think about something, there will probably be a standard available for that. Now ISO applies a couple of principles when uh developing international standards. So firstly there needs to be a need in the market So ISO response to that need in the market. So that either comes from something that they see themselves or from formal requests. from industry sectors or stakeholders that can also be consumer groups. Typically the request for a standard is communicated to national members within a country that then contact the international standardization. organization. ISO standards are always based on global expert opinion. So ISO standards are developed By various technical committees. And those technical committees consist out of experts from all over the world. And these experts really negotiate all the aspects of the standard. including what is the scope, what are the key definitions, what is the content that needs to be added. ISO standards are developed through a multi-stakeholder process. So the technical committees, they consist out of global experts, but they consist out of experts from relevant industries but they also include consumer associations, academia, NGOs and governments. So it's really a multi-stakeholder process. And lastly, which also explains why it sometimes can take up to a couple of years before an ISO standard is published or renewed, ISO standards are based on consensus So the development of an ISO standard is based on a consensus approach. So it takes into account comments from all uh stakeholders and um all ISO country members uh regardless of um the size of the strength of the economy have the same footage within um the organization so that means that it uh sometimes takes a little bit of time um before a standard gets approved or gets developed. Everybody knows of course the ISO 27001 standard because that is the standard everybody knows and that everybody wants to get certified against However, the ISO 27001 is part of a bigger family of standards, which is called the ISO 27000 family of standards. On the slide you see an overview of the different types of standards that you have. So not all of the standards that are part of the ISO 27000 family of standards are standards against which you can get certified. So let's have a look at what are the standards that are on the slide. And we will go a little bit deeper in each of the standards in the following slide. So firstly, everything starts with the ISO 27000, which is really a vocabulary or dictionary that gives an explanation of all of the Yeah, all of the words, all of the terminology that is used in the rest of the standards. ISO 27001 specifies then the requirements for establishing, implementing, maintaining, and continually improving an ISMS. ISO 27701 specifies the requirements and provides guidance for establishing, implementing, maintaining, and continuing Improving a privacy information management system, also called PIMS, in the form of an extension to the ISO 27001. So it's basically an add-on to the ISO 27001 ISO 27006 specifies the requirements and provides guidance for bodies that want to provide audits and certify certification of an ISMS. So your certification body. That you contact to do an audit will need to have ISO 27006 in place. Then you have a couple of general guides that really help you with implementing your ISMS So the ISO 27002 is the one that is mostly known with everybody, as commonly known. It's a set, uh it's a reference set of generic information security controls, including with implementation guidance. So it gives an explanation of the annex A controls of the ISO 27001 and it helps you in understanding how you could potentially implement Them. ISO 2703 provides explanation and guidance on ISO 2701. So it basically is the manual on how you should implement an ISO 27. ISO 27004 gives guidelines to help organizations come up with good information security performance indicators So it has a whole standard which gives you indication on what can you use to measure the effectiveness of your ISMS. ISO 27005 provide guidance on information security risk management. ISO 27000 And uh and seven provides then guidance on managing an ISMS audit program, how you should conduct audits, what are the competences that an ISMS auditor uh should have um and you will see uh parts of that coming back throughout this course obviously um and then you we have a couple of other ones so um and lastly we have the ISO 27008 uh which provides guidance On reviewing and assessing the implementation and operation of the information security control. So that's really linked to the ISO 2702. And then you have a couple of uh industry specific uh standards and you also have the ISO 2700799 which provides guidelines for organizations in the health information industry implementing the controls provided by ISO twenty seven thousand and two. And you have a couple of them you have uh one for the health uh sector you have one um which Is 27011, which gives information on the telecoms industry, and you have a lot of other standards that provide insight either per sector or either per specification within the realm of information. Security. Now looking at the development of the ISO 27000 family of standards is actually uh begins already um in the early 90s or in the middle of uh the the 90s where um the British Standard 7799 was published, which was actually a code of conduct that was published by the British Standards Institution. Many of these controls that were in that original standard are still visible in the ISO 2702. So the the British standard was basically developed by the UK government and by the Department of Trade and Industry. So that document provided really practices for information security management, and it was intended to help organizations establish and implement an ISMS and ensure the availability, integrity and confidentiality of their information. So Uh moving on, in um basically in 2002, so seven years later, the BS uh seventy-seven nine nine um was published, which was an uh specification of that uh first uh code of practice. Um that was um at the previously published uh 7799 became then the dot one um so it gave a little bit more explanation In the meantime, in 2000, there was also a code of practice on information security management published by ISO itself. So it already took some elements from the British standard. And that standard was then called the ISO 17799. So the specifications became a little bit more clear. Eventually all of these documents uh became adopted by the ISO standards. So where the um British Standard 779 DOS 2 became the ISO 27000 and one and the one version became um the ISO 27000 and two. So um this logically uh puts the requirements first and the code of practice and the guidance is basically uh second. Um they were uh later um so 2013 ish um they were um and uh as well in between 2008 and 2012 they were um yeah supplemented by uh several other ISO standards like the 2700345 um and other uh specific um interpretive guidance uh standards were created. where the latest version of the ISO 27001 and 27002 standard were published in 2020. So you see you see the the history of the uh 27,000 family uh goes already a long way back where um we recently had in 20 The latest revision. So let's dive a little bit deeper in each of the standards. First of all, of course, the most important one I would almost say is the ISO 27000M1 So this standard really gives the requirements for establishing, implementing, maintaining, and improving an ISMS The clauses are expressed with the verb shell. So that means that it is a requirement, it's mandatory, so you cannot choose to do it. It is mandatory, so you need to implement it. The standard is applicable for all organizations, though it doesn't matter which industry you're in, what size you're in, what type of organization you are, you can use it in whatever format that you like Organizations can obtain certification against this standard. So it really helps you with getting that ESMS. implemented um and as we already also explained in the lead implementer course of course and there needs to be a link when implementing the ISO 2701, there needs to be a link with your business strategy. It's not set up in isolation. Um, and you set it up to really um Yeah, preserve the confidentiality, integrity, and availability of information by really applying that risk management process And to give confidence to your interested parties and your customers, your employees, your shareholders, that risks are adequately. managed. Looking at the ISO 27002, this standard gives guidance. So that means that the clauses are expressed with the verb should So um it really looks at the annex A controls that are present in the 27001. So it gives a little bit guidance on What is um what is the control about? So it gives uh the context of each control and what is the reason why a control was chosen by um the International Standardization Organization. It will give some guidance on how you could implement a certain control within an organization. It will give some best practices and it will also help you in developing organizations specific organization uh security guidelines. So this is really guidelines and there's nowhere written that organizations um are mandated to implement the controls as they've been written down in the 27-2 standard, but it helps you to give some insight. side that also means that um you cannot gain um certification against the ISO twenty seven thousand and two standard I use this standard a lot because it helps you when you have a discussion with your technical teams, when you're stuck in how it something should be implemented in an organization, then you can have a look at the best practice and you you can start your discussion from that point in time. The 2703 is also a guidance uh standard um so it gives guidance and explanation on the requirements of an ISO 27001 So it basically contains also 10 clauses with clauses 4 to 10 exactly mirroring the ISO 27001. So This document um does not contain any new requirements, but it really consists out of giving you an indication on how you should be implementing the ISO 27001. So you get some insight on what is meant with context of the organization, what is the standard expecting you to deliver there. Since it's a guidance standard, you can also not obtain certification against this. ISO 27701. That standard or this standard is an extension to the ISO 27001 and the ISO 27002 specifically for privacy manner. So it provides, as does the 2701, but it provides requirements and guidelines for establishing, implementing, maintaining, and continually improving a privacy information management system. Which is also called PIMPS in short. It provides guidance both for controllers and processors, information on or guidance on that personal identifiable information processing. Organizations can also obtain certification against this standard. It's usually done together with an ISO 27001 certification. Like an ISO 27001, this standard is also applicable to all types and size of the organization. So both public and private companies, government organizations. um which are uh PII controllers or PII processors. Um so it it follows the same structure as the ISO 27000 ISO 27009 provides requirements for creating sector-specific standards as an extension to the ISO 27001. So it really gives an explanation on how you can include specific requirements additional to those in 2701 um how you should interpret the 27001 requirements and how to include or modify controls in addition to those in ISO 27001 and ISO 2700 So if you would want to create a new ISO standard for your specific industry and there's no ISO standard available yet, this is the standard that you want to have a look at to understand how you can create additions to the already existing. Existing one. ISO 27010 and everything that comes after 27010 are sector-specific standards. So you have specific standards for telecommunication, for health. For finance and insurance, but you have also ISO standards for specific sectors related to information security. So you will find ISO standards on application security on cybersecurity, on security incident management, on privacy protection, 27,017 and 18. are both for public and private clouds. So for each of them you will find specific ISO standards that relate for that. So if you look on the website of the of ISO, you can find all of them and of course you can also purchase those either on the ISO website or on the PECB website. Website, you can uh purchase them as well. But you can find um really on everything that you can think about in information security, like storage, like privacy, like um incident investigation, incident response uh you can find um uh a lot of um isost standards uh related uh to that Now when looking at the implementation of an ISMS, besides having the certificates, there are a couple of advantages on implementing an ISO 27001. Firstly, it will of course help you to protect your data. That's the basis, that's the reason why you do it. So you will have robust data protection, so you will have enhanced security measures. That protects sensitive data from unauthorized access, from breaches, from leaks. And you will also be able to assure that you have the confidentiality integrity and availability of your data ensured. It will help you to assure compliance First of all, as security practices are aligned with laws and regulations, because that's a standard element in the ISO standard, and you will also adhere to data protection laws. You will be able to make a step up in risk management. You will be able to identify and evaluate information security risks And that will able enable the organization to really prioritize and also proactively address potential threats. You will be able to implement security controls and incident response plans, and that will also minimize, of course, the impact. of potential security incidents. You will be able to improve your security posture. You will be able to better manage Your information security threats, and you will be implementing, of course, a standard that is internationally recognized with internationally recognized information security controls And you will be able to prevent certain security incidents from happening. Prevent the prevention of security incidents. uh is uh of course cheaper than uh recovering from a cyber attack. So uh the financial losses that would be associated with a security incident will be less And you will have efficient resources, of course, to mitigate those risks. So you will be able to do a better resource allocation in line with the risk management that you've done. So there is a multitude of advantages that are related to an ISO twenty-seven thousand and one implementation, besides having the certificate So when starting with an ISO implementation, the goal should not be having the certificate. It's a nice reward, but all the other advantages should be the reason why you implement I saw twenty seven thousand and one.