Certifications and Standards Flashcards
What are the ISO Standards for Information Security?
ISO/IEC 27001: Information Security Management System (ISMS)
ISO/IEC 27002: Code of Practice for Information Security Controls
ISO/IEC 27004: Information Security Management — Monitoring, Measurement, Analysis, and Evaluation
ISO/IEC 27005: Information Security Risk Management
ISO/IEC 27017: Code of Practice for Information Security Controls for Cloud Services
ISO/IEC 27035: Information Security Incident Management
What are the ISO Standards for Privacy?
ISO/IEC 27701: Privacy Information Management System (PIMS)
ISO/IEC 27018: Code of Practice for Protecting Personal Data in the Cloud
ISO/IEC 29100: Privacy Framework
ISO/IEC 29134: Guidelines for Privacy Impact Assessment (PIA)
ISO/IEC 27001
ISO/IEC 27001: Information Security Management System (ISMS)
Requirements for establishing, implementing, maintaining, and continually improving an information security management system (ISMS).
Organizations can be certified to ISO/IEC 27001, demonstrating their commitment to information security management to stakeholders.
ISO/IEC 27002
ISO/IEC 27002: Code of Practice for Information Security Controls
Guidelines for implementation, and management of security controls.
It includes 114 controls organized in 14 control clauses and 35 control objectives. Security controls are access control, cryptography, physical and environmental security, incident management, etc.
ISO/IEC 27005
ISO/IEC 27005: Information Security Risk Management.
Guidelines for ISRM, supporting the overall ISMS as per ISO/IEC 27001.
Comparing with NIST RMF, it does not prescribe specific risk assessment methodologies but supports various approaches, such as qualitative, quantitative, or hybrid assessments. It is used internationally across various industries, not just government.
ISO/IEC 27701
ISO/IEC 27701: Privacy Information Management System (PIMS)
Extension to ISO/IEC 27001 and ISO/IEC 27002, it provides guidance on establishing, implementing, maintaining, and continually improving a Privacy Information Management System (PIMS).
Requirements and guidance for protecting privacy, managing personal data, and demonstrating compliance with data protection regulations like GDPR.
ISO/IEC 27017
ISO/IEC 27017: Code of Practice for Information Security Controls for Cloud Services
Purpose: This standard provides guidelines for information security controls applicable to the provision and use of cloud services.
Key Components: It includes specific controls and implementation guidance tailored to cloud service environments, addressing both cloud service providers and cloud service customers.
ISO/IEC 27018
ISO/IEC 27018: Code of Practice for Protecting Personal Data in the Cloud
Purpose: This standard focuses on the protection of personal data in cloud computing environments for cloud service providers.
Controls and guidelines for implementing measures to protect personal data, ensure compliance with legal and regulatory requirements, and manage cloud-specific risks.
ISO/IEC 27035
ISO/IEC 27035: Information Security Incident Management
Purpose: This standard provides guidelines for the detection, reporting, assessment, and response to information security incidents.
Key Components: It includes a structured approach to managing and responding to incidents, helping organizations to minimize the impact of security breaches.
ISO/IEC 29100
ISO/IEC 29100: Privacy Framework
Purpose: This standard provides a framework for the protection of privacy in the context of processing personal data.
Key Components: It includes principles, actors, and controls for privacy and data protection, offering a foundation for developing and implementing privacy policies.
ISO/IEC 27004
ISO/IEC 27004: Information Security Management — Monitoring, Measurement, Analysis, and Evaluation
Purpose: This standard provides guidelines on how to assess the effectiveness of an ISMS and the controls in place.
Key Components: It includes methodologies for monitoring, measuring, analyzing, and evaluating the performance of the ISMS.
ISO/IEC 29134
ISO/IEC 29134: Guidelines for Privacy Impact Assessment (PIA)
Purpose: This standard provides guidelines for conducting privacy impact assessments (PIAs) to assess the impact of data processing on privacy.
Key Components: It includes a process for identifying and mitigating privacy risks associated with processing personal data.
What is ISO?
International Organization for Standardization. ISO standards provide comprehensive frameworks and guidelines for organizations to enhance their information security and privacy practices, ensuring robust protection of information assets and personal data. Implementing these standards helps organizations to manage risks effectively, comply with legal and regulatory requirements, and build trust with stakeholders.
What is NIST?
National Institute of Standards and Technology. Since 1901 , it is a U.S. federal agency under the DoC that develops technology, metrics, and standards to drive innovation and economic competitiveness.
What are the most important NIST Standards?
- NIST SP 800-30: Guide for Conducting Risk Assessments
- NIST SP 800-37: Risk Management Framework for Information Systems and Organizations
- NIST SP 800-39: Managing Information Security Risk
- NIST SP 800-53: Security and Privacy Controls for Information Systems and Organizations
- NIST SP 800-161: Cybersecurity Supply Chain Risk Management
- NIST SP 800-171: Protecting CUI in Nonfederal Systems and Organizations
- NIST CSF 2.0
- NIST SP 800-218: SSDF
NIST SP 800-218
NIST SP 800-218: Secure Software Development Framework (SSDF) Version 1.1
Set of high-level secure software development practices that can be integrated into each SDLC implementation. The goals are to reduce the number of vulnerabilities in released software, mitigate the potential impact of the exploitation of undetected or unaddressed vulnerabilities, and address the root causes of vulnerabilities to prevent future recurrences.
NIST SP 800-53
SP 800-53: Security and Privacy Controls for Information Systems and Organizations.
Provides a catalog of security and privacy controls for federal information systems and organizations. It includes guidelines for selecting and specifying security controls for information systems supporting executive agencies of the U.S. federal government.
NIST SP 800-171
NIST SP 800-171 r3: Protecting CUI in Nonfederal Systems and Organizations
Provides guidelines on protecting Controlled Unclassified Information (CUI) in non-federal systems and organizations. CUI is a category of information in the United States that requires safeguarding or dissemination controls pursuant to and consistent with applicable laws, regulations, and government-wide policies, but which is not classified under Executive Order 13526 (“Classified National Security Information”).
NIST SP 800-30
NIST SP 800-30 r1: Guide for Conducting Risk Assessments.
It provides guidance for risk assessments and provides the methodology for identifying, analyzing, and prioritizing risks. It is part of the broader NIST RMF with 800-37 and 39.
FISMA mandates agencies to conduct regular risk assessments.
NIST SP 800-37
NIST SP 800-37 r2: Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy.
It also part of the Risk Management Framework (RMF) and defines the six-step RMF process for managing security risks.
Risk assessment findings from NIST 800-30 inform security control selection in NIST 800-37’s RMF.
FISMA requires continuous monitoring and a formal security authorization process.
NIST SP 800-39
SP 800-39: Managing Information Security Risk.
It expands the RMF by providing guidance on enterprise-wide risk management and defines risk tolerance and risk governance.
FISMA requires agencies to consider organizational-level risk and not just IT system risk.
NIST SP 800-88
NIST SP 800-88, Revision 1, Guidelines for Media Sanitization, describes the best practices for combating data remanence.
NIST SP 800-161
NIST SP 800-161: Cybersecurity Supply Chain Risk Management.
It aims to help federal agencies manage supply chain risks by incorporating supply chain risk management (SCRM) practices into their overall risk management activities. This involves identifying, assessing, and mitigating risks that arise from the global and complex nature of supply chains.
NIST CSF 2.0
A voluntary framework that provides a policy framework of computer security guidance for how private sector organizations in the U.S. can assess and improve their ability to prevent, detect, and respond to cyber attacks.
