Information Security Risk Management: Handbook For ISO/IEC 27001

Description

The key handbook on how to implement ISO/IEC 27005 (Information Security: Risk Management).

This book is a practical handbook for the use and application of ISO/IEC 27005. It provides specific guidance and advice to support the implementation of requirements defined in ISO/IEC 27001 that relate to risk management processes and associated activities.

The book focuses on having an information security management system (ISMS) as a framework for achieving the effective management of information security risks.

International standard ISO/IEC 27001 is a world recognised standard for establishing, implementing, monitoring and reviewing, updating and improving an ISMS. ISO/IEC 27005 is an ISMS risk management standard that supports the implementation of ISO/IEC 27001.

If you are a business manager or are involved in ISMS risk management activities, this book will provide practical advice and guidance on managing information security risks.

The book is full of practical advice and guidance on managing information security risks. It provides a framework for professionals to make business decisions as well as understanding common risk practices that enable an organization's information to be effectively protected, based on the risks they face.

Professionals working in the fields of either information security or risk management will find this a useful reference, as it is based on international practices, methods and standards. It will assist those that implement the international standard ISO/IEC 27001 information security management system (ISMS).

CONTENTS:

* Introduction

    * Nature of the information security risk landscape

    * Risk management framework

    * Risk assessment

    * Risk treatment

    * System of risk controls

    * Risk monitoring and reviews

    * Risk control improvements

    * Documentation system

    * Audits and reviews

    * Standards

    * Definitions

    * Examples of legal and regulatory compliance

    * Examples of assets, threats, vulnerabilities and risk assessment methods.