Offering more tailored protection for specific sectors (e.g. finance, transportation and healthcare, and infrastructure projects such as smart cities) to ward off threats to their information has become a political, business and economic imperative, driving a need for sector-specific cyber standards. The recently published ISO/IEC 27009 will help standards developers do just that, providing the necessary advice and guidance on how to create standards that apply ISO/IEC 27001 to individual sectors.
ISO/IEC 27009, Information technology – Security techniques – Sector-specific application of ISO/IEC 27001 – Requirements, joins the ISO/IEC 27000 family of standards to help maximize the effectiveness of ISO/IEC 27001. It explains how to include requirements and controls additional to those in ISO/IEC 27001 that are applicable to specific sectors, enabling them to achieve consistency when developing standards in this family.
Prof. Edward Humphreys, Convenor of ISO/IEC SC 27/WG 1, the working group that developed the standard, said ISO/IEC 27001 is the international common language for information security management, so ISO/IEC 27009 will enhance this common language across the sector landscape and shape the development of standards for sector-specific information security and privacy.
“We have already developed several sector-specific standards, such as ISO/IEC 27011 for telecoms, ISO/IEC 27017 for cloud computing and ISO/IEC 27019 for the energy sector. These standards are examples of where controls, additional to those in ISO/IEC 27001, have been defined to meet the requirements of the specific sectors concerned. In developing these standards, it became clear that a harmonized structure and language, based on ISO/IEC 27001, and specific guidance would make the development of future sector-specific standards more effective, and avoid duplication.
“ISO/IEC 27009 will ensure that the development of new, and the revision of existing, sector-specific standards can all adopt an approach that is consistent with ISO/IEC 27001. Therefore, it will provide advice on how to add to, refine or interpret the requirements of ISO/IEC 27001 and how to add or modify the implementation guidance of ISO/IEC 27002 for sector-specific use.”
ISO/IEC 27009 can be purchased from your local ISO member or through the ISO Store.