标准改版背景介绉--Why 新版标准内容解析--What 讣证转换时间安排--When 体系换证应对方案--How

ISO 27001主任审核员2017培训课件

ISO27001讲稿内容详实，非常实用。

ISO27001-BS7799标准全面解析，详述了BS7799的发展历程，及其与iso27001，iso17799的关系。文章以问答的方式回答了很多问题，非常细致。很值得参考。

ISO27001相关文档，2013中文版，ISO 27000、ISO 27001-7、ISO_IEC_15408-1_2009等

TISAX认证官方说明文档翻译,详细了解TISAX如何申请、自评、审核。

ISO_IEC_27001_2013_cn，ISO27000系列标准的主体标准,是2013年颁布的标准。无水印，中文版

ISO27001标准的英文原版。。 ISO27001标准的英文原版。。 ISO27001标准的英文原版。。 ISO27001标准的英文原版。。 ISO27001标准的英文原版。。

ISO27001信息安全管理体系中英文版，不知道你们需不需要。
This second edition cancels and replaces the first edition(ISO/EC 27001: 2005), which has beentechnically revised第二版进行了技术上的修订,并取消和替代第一版( ISO/EC27001:2005)。0 Introduction1.1 General01总则This International Standard has been prepared to provide requirements for establishingimplementing, maintaining and continually improving an information security managementsystem. The adoption of an information security management system is a strategicdecision for an organization. The establishment and implementation of an organizationsinformation security management system is influenced by the organization's needs andobjectives, security requirements, the organizational processes used and the size andstructure of the organization. All of these influencing factors are expected to change overtime本标准用于为建ν、实迤、保持和持续改进信息安全管理体系提供要求。采用信息安全管理体系是组织的项战咯性决策。·个组织信息安全管理体系的建立和实施受其需要和目标、安全要求、所采用的过程以及组织的规模和结构的影响。所有这些影响因素会不断发生变化。The information security management system preserves the confidentiality, integrity andavailability of information by applying a risk management process and gives confidence tointerested parties that risks are adequately managed信息安全管理体系通过应用风险管理过程来保持信息的俣密性、完整性和可用性,以充分管理风险并给予相关方信心。It is important that the information security management system is part of and integratedwith the organizations processes and overall management structure and that informationsecurity is considered in the design of processes, information systems, and controls. It isexpected that an information security management system implementation will be scaledin accordance with the needs of the organization信息安全管理体系是组织过程和整体管理结构的一部分并与其整合在一起是非常重要的。信息安全在设计过程、信息系统、控制措施时就要考虑信息安全。按照组织的需要实施信息安全管理体系,是本标准所期望的This International Standard can be used by internal and external parties to assess theorganization's ability to meet the organization, s own information security requirements本标准可被内部和外部相关方使用,评估组织的能力是否满足组织自身信息安全要求。The order in which requirements are presented in this International Standard does notreflect their importance or imply the order in which they are to be implemented The listitems are enumerated for reference purpose only.本标准中要求的顺序并不能反映他们的重要性或意味着他们的实施顺序。列举的条目仅用于参考目的ISO/EC 27000 describes the overview and the vocabulary of information securitymanagement systems, referencing the information security management system family ofstandards(including ISo/EC 27003[2], Iso/EC 27004[3 and ISo/EC 27005[41), withrelated terms and definitionsIsO/EC27000描述了信息安全管理体系的概述和词汇,参考了信息安全管理体系标准族(包括 ISO/EC27003、|SOEC27004和lOEC27005)以及相关的术语和定义1.2 Compatibility with other management system standards02与其他管理体系的兼容性This International Standard applies the high-level structure, identical sub-clause titles,identical text. common terms and core definitions defined in Annex sl of iso/ecDirectives, Part 1, Consolidated Iso Supplement, and therefore maintains compatibilitywith other management system standards that have adopted the AnneX SL本标准应用了 ISO/EC导则第一部分lsO补充部分附录SL中定义的高层结构、相同的子章节标题、相同文本、通用术语和核心定义。因此保持了与其它采用附录SL的管理体系标准的兼容性。This common approach defined in the Annex sl will be useful for those organizations thatchoose to operate a single management system that meets the requirements of two ormore management system standards附录SL定义的通用方法对那些选择运作单·管理体系(可同吋满足两个或多个管理体系标准要求)的组织来说是|分有益的。Information technology- Security techniques- Information securitymanagement systems-Requirements信息技术安全技术-信息安全管理体系-要求1 Scope1范围This International Standard specifies the requirements for establishing, implementing,maintaining and continually improving an information security management system withinthe context of the organization木标准从组织环境的角度,为建立、实施、运行、保持和持续改进信息安全管理体系规定了要求。This International Standard also includes requirements for the assessment and treatmentof information security risks tailored to the needs of the organization. The requirementsset out in this International Standard are generic and are intended to be applicable to allorganizations, regardless of type, size or nature. Excluding any of the requirementsspecified in Clauses 4 to 10 is not acceptable when an organization claims conformity tothis Intemational standard本标准还规定了为适应组织需要而定制的信息安全风险评估和处置的要求。本标准规定的要求是通用的,适用于各种类型、规模和特性的组织。组织声称符合本标准时,对于第4章第10章的要求不能删减。2 Normative references2规范性引用文件The following documents, in whole or in part, are normatively referenced in this documentand are indispensable for its application. For dated references, only the edition citedapplies. For undated references, the latest edition of the referenced document(includingany amendments)applies下列文件的全部或部分内容在本文件中进行了规范引用,对于其应用是必不可少的。凡是注日期的引用文件,只有引用的版本适用于本标准;凡是不注日期的引用文什,其最新版本(包括任何修改)适用于本标准。ISO/EC 27000, Information technology- Secunity techniques - Information securitymanagement systems-Overview and vocabulary丨sO/EC27000,信息技术一安全技术一信息安全管埋体系一概述和词汇3 Terms and definitions3术语和定义For the purposes of this document, the terms and definitions given in ISO/EC 27000SO|Ec27000中的术语和定义适用于本标准。4 Context of the organization4组织环境4. 1 Understanding the organization and its context4.1埋解组织及其环境The organization shall determine external and internal issues that are relevant to itspurpose and that affect its ability to achieve the intended outcome(s) of its informationsecurity management system组织应确定与其目标相关并影响其实现信息安全管理体系预期结果的能力的外部和内部问题NOTE Determining these issues refers to establishing the external and internal context ofthe organization considered in Clause53of|S31000:2009[5],注:确定这些问题涉及到建立组织的外部和内部坏境,在lSO3100020095]的5.3节考虑了这一事项。4.2 Understanding the needs and expectations of interested parties42理解相关方的需求和期望The organization shall determine组织应确定a) interested parties that are relevant to the information security management system; andb the requirements of these interested parties relevant to information securitya)与信息安全管理体系有关的相关方b)这些相关方与信息安全有关的要求NOTE The requirements of interested parties may include legal and regulatoryrequirements and contractual obligations.注:相关方的要求可能包括法律法规要求和合同义务。4.3 Determining the scope of the information security management system4.3确定信息安全管理体系的范围The organization shall determine the boundaries and applicability of the informationsecurity management system to establish its scope.组织应确定信息安全管理体系的边界和适用性,以建立其范围When determining this scope the organization shall consider当确定该范围时,组织应考虑a the external and internal issues referred to in 4.1b the requirements referred to in 4.2; andc)interfaces and dependencies between activities performed by the organization, andthose that are performed by other organizations. The scope shall be available asdocumented informationa)在4.1中提及的外部和内部问题b)在4.2中提及的要求;c)组织所执行的活动之间以及与其它组织的活动之间的接口和依赖性范围应文件化并保持可用性。4. 4 Information security management system44信息安全管理体系The organization shall establish, implement, maintain and continually improve aninformation security management system, in accordance with the requirements of thisInternational standard组织应按照本标准的要求建立、实施、保持和持续改进信息安全管理体系。5 Leadersh5领导5.1 Leadership and commitment51领导和承诺Top management shall demonstrate leadership and commitment with respect to theinformation security management system by:高层管理者应通过下列方式展示其关于信息安全管理体系的领导力和水诺:a)ensuring the information security policy and the information security objectives areestablished and are compatible with the strategic direction of the organizationb) ensuring the integration of the information security management system requirementsinto the organization' s processesc)ensuring that the resources needed for the information security management systemare available:d)communicating the importance of effective information security management and ofconforming to the information security management system requirementse)ensuring that the information security management system achieves its intendedoutcome(s)f directing and supporting persons to contribute to the effectiveness of the informationsecurity management systemg) promoting continual improvement; andsupporting other relevant management roles to demonstrate their leadership as itapplies to their areas of responsibilitya)确保建立信息安全方针和信息安全目标,并与组织的栈略方向保持一致;b)确保将信息安全管理体系要求整合到组织的业务过程中;c)确保信息安全管理体系所需资源可用;d)传达信息安全管理有效实施、符合信息安全管理体系要求的重要性;e)确保信息安全管理体系实现其预期结果:f)指挥并支持人员为信息安全管理体系的有效实施作出贡献g)促进持续改进;h)支持其他相关管理角色在其职责范围内展示他们的领导力5.2 Policy52方针Top management shall establish an information security policy that高层管理者应建立信息安全方针,以:a is appropriate to the purpose of the organizationb includes information security objectives(see 6.2)or provides the framework for settingnformation security objectives;c)includes a commitment to satisfy applicable requirements related to informationsecuritd)includes a commitment to continual improvement of the information securitymanagement system The information security policy shalle)be available as documented informationf be communicated within the organization; andg)be available to interested parties, as appropriatea)适于组织的日标b)包含信息安全目标(见62)或设置信息安全目标提供框架c)包含满足适用的信息安全相关要求的承诺;d)包含信息安全管理体系持续改进的承诺。信息安全方针应:e)文件化并保持可用性f)在组织内部进行传达g)适当时,对相关方可用。5.3 Organizational roles, responsibilities and authorities53组织角色、职责和权限Top management shall ensure that the responsibilities and authorities for roles relevant tonformation security are assigned and communicated.高层管理者应确保分配并传达了信息安仝相关角色的职责和权限。Top management shall assign the responsibility and authority for高层管理者应分配下列职责和权限:a)ensuring that the information security management system conforms to therequirements of this International Standard; andb) reporting on the performance of the information security management system to topmanagementa)确保信息安全管理体系符合木标准的要求;b)将信息安全管理体系的绩效报告给高层管理者。NOTE Top management may also assign responsibilities and authorities for reportingperformance of the information security management system within the organization YE髙层管理者可能还要分配在组织内部报告信息安全管理体系缋效的职责和权限

2015年12月信息安全管理体系（ISMS）基础知识 试卷.pdf 2016年6月信息安全管理体系（ISMS）基础知识 试卷.pdf 2016年6月信息安全管理体系（ISMS）审核知识 试卷.pdf 2016年12月信息安全管理体系（ISMS）基础知识 试卷.pdf 2016年12月信息安全管理体系（ISMS）审核知识 试卷.pdf 2017年3月信息安全管理体系（ISMS）基础知识 试卷.pdf 2017年3月信息安全管理体系（ISMS）审核知识 试卷.pdf 2017年9月信息安全管理体系（ISMS）基础知识 试卷.pdf 2017年9月信息安全管理体系（ISMS）审核知识 试卷.pdf 2018年3月信息安全管理体系（ISMS）基础知识 试卷.pdf 2018年3月信息安全管理体系（ISMS）审核知识 试卷.pdf