An Introduction to Information Security and ISO27001

This book is intended to meet the needs of two groups: individual readers who have turned to it as an introduction to a topic that they know little about; and organisations implementing, or considering implementing, some sort of information security management regime, particularly if using ISO/IEC 27001:2005, who wish to raise awareness. In either case, the book furnishes readers with an understanding of the basics of information security, including: a definition of what information security means; how managing information security can be achieved using an approach recognised worldwide; the sorts of factors that need to be considered in an information security regime, including how the perimeters of such a scheme can be properly defined; how an information security management system can ensure it is maximising the effect of any budget it has; what sort of things resources might be invested in to deliver a consistent level of assurance; how organisations can demonstrate the degree of assurance they offer with regard to information security; and, how to interpret claims of adherence to the ISO 27001 standard and exactly what it means. Corporate bodies will find this book useful at a number of stages in any information security project, including: the decision-making stage, to ensure that those committing to an information security project do so from a truly informed position; project initiation stage, as an introduction to information security for the project board, project team members and those on the periphery of the project; and, as part of an ongoing awareness campaign, being made available to all staff and to new starters as part of their introduction to the company. A word of warning: this is not an implementation or 'How to do it' guide. Implementing an ISO27001-compliant ISMS requires more advice than a pocket guide such as this could possibly offer. The project is in most cases likely to equate to a significant business-change project, and will require all the project governance arrangements that suit such an undertaking.

Table of Contents:
IntroductionChapter 1: Information Security - What's That? Chapter 2: It's Not IT Chapter 3: ISO27001 and the Management System Requirements Chapter 4: Information Assets and the Information Security Risk Assessment Chapter 5: Information Security Controls Chapter 6: Certification Chapter 7: Signposting ITG Resources

About the Author :
ABOUT THE AUTHORSteve G Watkins: Director, Training and Consultancy, IT Governance Ltd.Steve managed the world's first successful BS7799 implementation project. He has over 18 years' experience of managing integrated manage-ment systems, including maintenance of Information Security, Quality, Environmental and Investor in People certifications.Steve's experience includes senior management positions in both the public and private sectors, having responsibility for nearly all corporate support functions.As well as being a trained ISO27001 and ISO9001 auditor, Steve is a trained EFQM assessor and holds diplomas in safety and financial management. He is Chair of the UK ISO/IEC 27001 Users Group (which is the UK chapter of the International ISMS User Group) and also sits on the Management Committee of the British Standards Society, where he chairs the Corporate Governance Special Interest Group.Steve can be contacted at:swatkins@itgovernance.co.uk.