ISO 27005 介绍
ISO 27005 is the name of the prime 27000 series standard covering information security risk management. The standard provides guidelines for information security risk management (ISRM) in an organization, specifically supporting the requirements of an information security management system defined by ISO 27001.
The ISO 27005 standard comprises 55 pages, and is applicable to all types of organization. It does not provide or recommend a specific methodology. This will depend upon a number of factors, such as the actual scope of the Information Security Management System (ISMS), or perhaps the industry/commercial sector. THE CONTENTS OF ISO 27005 The content sections are: ?Foreword ?Introduction ?Normative references ?Terms and definitions ?Structure ?Background ?Overview of the ISRM Process ?Context Establishment ?Information Security Risk Assessment (ISRA) ?Information Security Risk Treatment ?Information security Risk Acceptance ?Information security Risk Communication ?Information security Risk Monitoring and Review ?Annex A: Defining the scope of the process ?Annex B: Asset valuation and impact assessment ?Annex C: Examples of Typical Threats ?Annex D: Vulnerabilities and vulnerability assessment methods ?Annex E: ISRA approaches ISO/IEC 27005 已经于2008年6月15日正式发布，不过不是大家以为的那样，将BS7799-3接纳为27005标准。ISO/IEC 27005是对ISO/IEC TR 13335的修订，废弃和替代了ISO/IEC TR 13335-3:1998, and ISO/IEC TR 13335-4:2000。
The ISO 27005 standard comprises 55 pages, and is applicable to all types of organization. It does not provide or recommend a specific methodology. This will depend upon a number of factors, such as the actual scope of the Information Security Management System (ISMS), or perhaps the industry/commercial sector. THE CONTENTS OF ISO 27005 The content sections are: ?Foreword ?Introduction ?Normative references ?Terms and definitions ?Structure ?Background ?Overview of the ISRM Process ?Context Establishment ?Information Security Risk Assessment (ISRA) ?Information Security Risk Treatment ?Information security Risk Acceptance ?Information security Risk Communication ?Information security Risk Monitoring and Review ?Annex A: Defining the scope of the process ?Annex B: Asset valuation and impact assessment ?Annex C: Examples of Typical Threats ?Annex D: Vulnerabilities and vulnerability assessment methods ?Annex E: ISRA approaches ISO/IEC 27005 已经于2008年6月15日正式发布，不过不是大家以为的那样，将BS7799-3接纳为27005标准。ISO/IEC 27005是对ISO/IEC TR 13335的修订，废弃和替代了ISO/IEC TR 13335-3:1998, and ISO/IEC TR 13335-4:2000。