04/30062174 DC : DRAFT JUN 2004

FOREWORD
INTRODUCTION
WHAT IS INFORMATION SECURITY?
WHY INFORMATION SECURITY IS NEEDED?
HOW TO ESTABLISH SECURITY REQUIREMENTS
ASSESSING SECURITY RISKS
SELECTING CONTROLS
INFORMATION SECURITY STARTING POINT
CRITICAL SUCCESS FACTORS
DEVELOPING YOUR OWN GUIDELINES
1 SCOPE
2 TERMS AND DEFINITIONS
   2.1 DEFINITIONS
3 STRUCTURE OF THIS STANDARD
   3.1 CLAUSES
   3.2 MAIN SECURITY CATEGORIES
4 RISK ASSESSMENT AND TREATMENT
   4.1 ASSESSING SECURITY RISKS
   4.2 TREATING SECURITY RISKS
5 SECURITY POLICY
   5.1 INFORMATION SECURITY POLICY
6 ORGANIZING INFORMATION SECURITY
   6.1 INTERNAL ORGANIZATION
   6.2 EXTERNAL PARTIES
7 ASSET MANAGEMENT
   7.1 RESPONSIBILITY FOR ASSETS
   7.2 INFORMATION CLASSIFICATION
8 HUMAN RESOURCES SECURITY
   8.1 PRIOR TO EMPLOYMENT
   8.2 DURING EMPLOYMENT
   8.3 TERMINATION OR CHANGE OF EMPLOYMENT
9 PHYSICAL AND ENVIRONMENTAL SECURITY
   9.1 SECURE AREAS
   9.2 EQUIPMENT SECURITY
10 COMMUNICATIONS AND OPERATIONS MANAGEMENT
   10.1 OPERATIONAL PROCEDURES AND RESPONSIBILITIES
   10.2 THIRD PARTY SERVICE DELIVERY MANAGEMENT
   10.3 SYSTEM PLANNING AND ACCEPTANCE
   10.4 PROTECTION AGAINST MALICIOUS AND MOBILE CODE
   10.5 BACK-UP
   10.6 NETWORK SECURITY MANAGEMENT
   10.7 MEDIA HANDLING
   10.8 EXCHANGES OF INFORMATION
   10.9 ELECTRONIC COMMERCE SERVICES
   10.10 MONITORING
11 ACCESS CONTROL
   11.1 BUSINESS REQUIREMENT FOR ACCESS CONTROL
   11.2 USER ACCESS MANAGEMENT
   11.3 USER RESPONSIBILITIES
   11.4 NETWORK ACCESS CONTROL
   11.5 OPERATING SYSTEM ACCESS CONTROL
   11.6 APPLICATION AND INFORMATION ACCESS CONTROL
   11.7 MOBILE COMPUTING AND TELEWORKING
12 INFORMATION SYSTEMS ACQUISITION, DEVELOPMENT AND
   MAINTENANCE
   12.1 SECURITY REQUIREMENTS OF INFORMATION SYSTEMS
   12.2 CORRECT PROCESSING IN APPLICATIONS
   12.3 CRYPTOGRAPHIC CONTROLS
   12.4 SECURITY OF SYSTEM FILES
   12.5 SECURITY IN DEVELOPMENT AND SUPPORT PROCESSES
   12.6 VULNERABILITY MANAGEMENT
13 INFORMATION SECURITY INCIDENT MANAGEMENT
   13.1 REPORTING INFORMATION SECURITY EVENTS AND WEAKNESSES
   13.2 MANAGEMENT OF INFORMATION SECURITY INCIDENTS AND
         IMPROVEMENTS
14 BUSINESS CONTINUITY MANAGEMENT
   14.1 INFORMATION SECURITY ASPECTS OF BUSINESS CONTINUITY
         MANAGEMENT
15 COMPLIANCE
   15.1 COMPLIANCE WITH LEGAL REQUIREMENTS
   15.2 COMPLIANCE WITH SECURITY POLICIES AND STANDARDS
   15.3 INFORMATION SYSTEMS AUDIT CONSIDERATIONS
ANNEX A LINKS BETWEEN CONTROLS
ANNEX B BIBLIOGRAPHY