Outline of ISO/IEC 27002:2005
Prepared for the international community of
ISO27k implementers at ISO27001security.com
Version 1 28th November 2007

0 INTRODUCTION
0.1 WHAT IS INFORMATION SECURITY?
0.2 WHY INFORMATION SECURITY IS NEEDED?
0.3 HOW TO ESTABLISH SECURITY REQUIREMENTS
0.4 ASSESSING SECURITY RISKS
0.5 SELECTING CONTROLS
0.6 INFORMATION SECURITY STARTING POINT
Information security is defined as the preservation of confidentiality, integrity and availability of information …
Information security is defined as the preservation of confidentiality, integrity and availability of information …
0.7 CRITICAL SUCCESS FACTORS
0.8 DEVELOPING YOUR OWN GUIDELINES
1 SCOPE
2 TERMS AND DEFINITIONS
3 STRUCTURE OF THIS STANDARD
3.1 CLAUSES
Security controls directly address risks to the organization, therefore risk analysis is a starting point for designing controls.

Security controls directly address risks to the organization, therefore risk analysis is a starting point for designing controls.

3.2 MAIN SECURITY CATEGORIES
4 RISK ASSESSMENT AND TREATMENT
4.1 ASSESSING SECURITY RISKS
Information security policies, standards, procedures and guidelines drive risk management, security and control requirements throughout the organization
Information security policies, standards, procedures and guidelines drive risk management, security and control requirements throughout the organization
4.2 TREATING SECURITY RISKS
5 SECURITY POLICY
5.1 INFORMATION SECURITY POLICY 5.1.1 Information security policy document 5.1.2 Review of the information security policy
6 ORGANIZATION OF INFORMATION SECURITY
Defines the hierarchical structure and reporting responsibilities necessary to manage, control and direct information security
Defines the hierarchical structure and reporting responsibilities necessary to manage, control and