The ISO 27001 standard was published in October 2005. It is the specification for ISMS, an Information Security Management System. The objective of the standard is to "provide a model for establishing, implementing, operating, monitoring, reviewing, maintaining, and improving an Information Security Management System".
Regarding its adoption, this should be a strategic decision. Further, "The design and implementation of an organization's ISMS is influenced by their needs and objectives, security requirements, the process employed and the size and structure of the organization".
Benefits of ISO 27001:2005
- Use within organisations to formulate security requirements and objectives
- Use within organisations as a way to ensure that security risks are cost-effectively managed
- Use within organisations to ensure compliance with laws and regulations
- Use within an organisation as a process framework for the implementation and management of controls to ensure that the specific security objectives of an organisation are met;
- The definition of new information security management processes
- Identification and clarification of existing information security management processes;
- Use by the management of organisations to determine the status of information security management activities
- Use by the internal and external auditors of organisations to demonstrate the information security policies, directives and standards adopted by an organisation and determine the degree of compliance with those policies, directives and standards
- Use by organisations to provide relevant information about information security policies, directives, standards and procedures to trading partners and other organisations that they interact with for operational or commercial reasons
- Implementation of a business enabling information security;
- Use by organisations to provide relevant information about information security to customers