An Introduction to ISO/IEC 27001:2013

This book serves as a basic introduction to ISO/IEC 27001:2012, and a straight-forward guide to implementation. This will be a simple to understand 'pocket guide' packed with useful how-to information The guidance will be applicable to a wide range of differing ISMS implementations appropriate to SMEs as well as much larger organisations The book will also include a practical, easy to use assessment/risk treatment method that delivers results directly expressed in business meaningful terms (i.e. the likelihood that information security events occur and their probable consequences). No prior knowledge of ISO/IEC 27001 or management systems is assumed.

Table of Contents:
INTRODUCTION - Preface, What this book is about, How to use this book, Benefits CHAPTER 1 - Information Security Management Systems Introduction, Purpose and benefits, Understanding management system standards, Structure of the ISO/IEC 27001 standard, Management system versus information security specific requirements, Relation with other standards CHAPTER 2 - Management system-specific requirements Introduction, Continuous improvement, Scope, organisation and context, Policy and objectives, Risks and opportunities, Operation, Performance evaluation and actions, Management and support CHAPTER 3 - Information security-specific requirements, Introduction, Risk assessment and risk treatment, Identifying controls The Statement of Applicability, Evaluating effectiveness CHAPTER 4 - Implementation guidance, Introduction, Implementation strategies, Preparation and project planning, Choice of documentation media, Risk assessment/risk treatment methods, Identifying controls in practice, Management system process examples, Dos and don'ts, GLOSSARY, BIBLOGRAPHY and REFERENCES, INDEX

About the Author :
Dr. David Brewer was one of the first consultants to advise the British Government on information security matters, providing assistance to establish the first ever computer security evaluation facilities and evaluation criteria. He was a founder member of the Department of Trade and Industry's Commercial Computer Security Centre (1987-1992) and became a co-author of the European IT Security Evaluation Criteria (the forerunner of ISO/IEC 15408) and associated evaluation manual and a co-author of the original ISMS standard, BS 7799 Part 2. He is now an active member of the UK delegation to ISO JTC 1 SC27 WG1, which is responsible for the IS27000 family of standards; and is co-editor for the revision of ISO/IEC 27004 (Measurements). He has conducted a wide variety of consultancy assignments in information security spanning 32 years in over 23 countries. He is well known for his work in rolling out ISO/IEC 27001 to the whole of the Civil Service in Mauritius, which is an exemplar of his ISMS implementation methodology, and his ability to train people to train others. His seminal research papers include "The Chinese Wall Security Policy", published in 1989 and "Measuring the Effectiveness of an Internal Control System", published in 2003.