As per a recent publishing in Security Magazine, 2021 will put more demands on ‘Security and privacy by design’. The advent of technology and usage of virtual means to conduct business has converged infosec, cybersec and data privacy into a single conduit increasing the risk of breaching all three in one shot. The world today needs greater focus on tightening the noose around vulnerabilities of the combined landscape. To bring about standardisation in this new mix, ISO/IEC JTC 1/SC 27 was founded by ISO/IEC JTC 1 in 1990; long before what we are undergoing today. The scope of ISO/IEC JTC 1/SC 27 was “The development of standards for the protection of information and ICT.” This included generic methods, techniques and guidelines to address both security and privacy aspects.
The first standard was published in 2013 and was called – ISO/IEC 27014:2013. The standard is withdrawn now as a new publication is available as – ISO/IEC 27014:2020 for 88 Swiss Francs. Organisations that advocate to ISO 27001 framework can benefit from this enhancement as the document provides guidance on concepts, objectives and processes for the governance of information security, by which organizations can evaluate, direct, monitor and communicate the information security-related processes within the organization.
The intended audience for this document is:
– governing body and top management;
– those who are responsible for evaluating, directing and monitoring an information security management system (ISMS) based on ISO/IEC 27001;
– those responsible for information security management that takes place outside the scope of an ISMS based on ISO/IEC 27001, but within the scope of governance.
This document is applicable to all types and sizes of organizations.
All references to an ISMS in this document apply to an ISMS (Information Security Management System) based on ISO/IEC 27001.
The free preview of this new standard is available here.