BS ISO/IEC 27004:2009 Information technology. Security techniques. Information security management. Measurement
Become a member and save 50%
What is BS ISO/IEC 27004:2009?
BS ISO/IEC 27004 shows you the measurement processes designed to test the performance of computers and implemented information security management systems (ISMS). This international standard was developed to give you best-practice recommendations on data processing, data security, data storage protection and data analysis. It also looks at verification, quality auditing and anti-burglar measures. Although BS ISO/IEC 27004 helps to determine whether ISMS processes need to be changed, no measurement of controls guarantee complete security.
How does it work?
This standard helps you fulfil the measurement requirements set out in ISO/IEC 27001. It looks at the development of base and derived measures, as well as indicators. BS ISO/IEC 27004 also helps you to understand the information security risks you face by implementing and operating an Information Security Measurement Programme. Other recommendations include collecting and analysing data and developing measurement results for all relevant stakeholders.
Who should buy it?
- Organisations of any type or size specialising in information technology, software and networking
- IT managers
- Network managers
Why BSI?
We are global, we’re independent and we’re a trusted service provider to 80,000 businesses. We operate in 147 countries and are the number one certification body in the UK and US. We created 85% of our portfolio because we know standards and we know your business. We’re leaders and we can make you one too.
Contents of BS ISO/IEC 27004 include:
- Management overview
- Scope
- Normative references
- Terms and definitions
- Structure of this International Standard
- Information security measurement overview
- Objectives of information security measurement
- Information Security Measurement Programme
- Success factors
- Information security measurement model
- Overview
- Base measure and measurement method
- Derived measure and measurement function
- Indicators and analytical model
- Measurement results and decision criteria
- Management responsibilities
- Resource management
- Measurement training, awareness, and competence
- Measures and measurement development
- Definition of measurement scope
- Identification of information need
- Object and attribute selection
- Measurement construct development
- Measure selection
- Measurement method
- Measurement function
- Analytical model
- Indicators
- Decision criteria
- Stakeholders
- Measurement construct
- Data collection, analysis and reporting
- Measurement implementation and documentation
- Measurement operation
- Procedure integration
- Data collection, storage and verification
- Data analysis and measurement results reporting
- Analyse data and develop measurement results
- Communicate measurement results
- Information Security Measurement Programme Evaluation and Improvement
- Evaluation criteria identification for the Information Security Measurement Programme
- Monitor, review, and evaluate the Information Security Measurement Programme
- Implement improvements
- Template for an information security measurement construct
- Measurement construct examples
- Bibliography
