EN ISO/IEC 27005:2024 PDF

Name: EN ISO/IEC 27005:2024 — Information security, cybersecurity and privacy protection - Guidance on managing information security risks (ISO/IEC 27005:2022)
SKU: EN ISO/IEC 27005:2024
Price: 125.65 EUR
Availability: InStock

Information security, cybersecurity and privacy protection - Guidance on managing information security risks (ISO/IEC 27005:2022)

Название (английский):

EN ISO/IEC 27005:2024

Information security, cybersecurity and privacy protection - Guidance on managing information security risks (ISO/IEC 27005:2022)

Статус документа:: Действующий
Формат:: Электронный (PDF)
Количество страниц:: 79
Дата публикации:: 7 августа 2024 г.
Издание:: CEN/CENELEC EN 27005 edition 1 version 1
ICS:: 03.100.70

Тип поставки:

Full version1 185 €Read online 24h10 €Read online 72h15 €

Язык документа:

ruen

Срок поставки:14 раб. дн. (перевод)

Цена:1 185 €

Описание (английский):

This document provides guidance to assist organizations to: — fulfil the requirements of ISO/IEC 27001 concerning actions to address information security risks; — perform information security risk management activities, specifically information security risk assessment and treatment. This document is applicable to all organizations, regardless of type, size or sector.

Abstract

Похожие стандарты

Стандарты, упомянутые в описании

Overview

EN ISO/IEC 27005:2024 (adoption of ISO/IEC 27005:2022 as EN ISO/IEC 27005:2024) provides detailed guidance on managing information security risks to support implementation of an Information Security Management System (ISMS). It helps organizations of any type, size or sector to fulfil ISO/IEC 27001 requirements related to identifying, assessing and treating information security risks, with additional emphasis on cybersecurity and privacy protection.

Key topics and technical coverage

This guidance covers the full information security risk management lifecycle and related ISMS processes, including:

Risk management process and cycles - principles for establishing iterative risk management activities.

Context establishment - organizational considerations, stakeholder requirements and risk criteria.

Risk assessment - identification, description and ownership of information security risks.

Risk analysis: assessing potential consequences and likelihood to determine risk levels.
Risk evaluation: comparing results against risk acceptance criteria and prioritizing risks.

Risk treatment - selecting treatment options, determining and implementing controls, and documenting a risk treatment plan.

Controls alignment - comparing selected controls with ISO/IEC 27001:2022 Annex A and producing a Statement of Applicability.

Operation and monitoring - performing assessments and treatments, documented information, communication, monitoring, management review, corrective action and continual improvement.

Practical techniques - Annex A provides examples of techniques to support risk assessment activities.

Definitions, normative references and structured guidance to choose appropriate methods and criteria.

Practical applications

ISO/IEC 27005 is practical for organizations that need to:

Implement or mature an ISMS and meet ISO/IEC 27001 risk requirements.

Conduct systematic information security and cybersecurity risk assessments.

Develop risk treatment plans and justify control selections (useful for audits and compliance).

Integrate privacy risk considerations into security risk workflows.

Prioritize security investments and supplier/vendor risk measures based on documented risk levels.

Establish repeatable, auditable processes for monitoring, review and continual improvement.

Related standards

ISO/IEC 27001 - requirements for an Information Security Management System (ISMS)

The broader ISO/IEC 27000 family - context for security management and implementation guidance

Keywords: ISO/IEC 27005:2024, information security risk management, ISO/IEC 27001, risk assessment, risk treatment, ISMS, cybersecurity, privacy protection, Statement of Applicability.

EN ISO/IEC 27005:2024 PDF

Abstract

Похожие стандарты

Overview

Key topics and technical coverage

Practical applications

Who should use this standard

Related standards

Технические детали

ISO/IEC 27001:2022/Amd 1:2024

Information security, cybersecurity and privacy protection — Information security management systems — Requir…

SIST EN ISO/IEC 27005:2024

Information security, cybersecurity and privacy protection - Guidance on managing information security risks…

BS EN ISO/IEC 27000:2020

Information technology. Security techniques. Information security management systems. Overview and vocabulary