This domain presents controls that tackle the information security aspects of HR. These controls provide a framework for information security by defining the internal organization, such as roles and responsibilities, as well as other information security aspects of the organization such as the use of mobile devices, project management and even teleworking. These controls describe how the organization should handle its information security policies. It should be noted that IT security is not the sole focus of these controls, rather they extend to the areas of managing processes, human resources, legal compliance, physical protection and other areas of organizational management. We will explore the domains of ISO 27001 to give you an overview of the different types of controls that ISP 27001 recommends organizations implement. There are 114 controls in all and for compliance, you only need to implement the controls that make sense for your organization. ISO 27001 Annex A contains 14 domains, which are essentially categories of controls. This shows a changing view on information and is now inventoried just like physical assets. The change in the 2017 version is that information is specifically listed as an asset, which means that it needs to be specifically inventoried. Appendix A in the 2013 version calls for you to specifically inventory assets. This begs the question: what is the difference between the two? Simply put, there is not much substantive difference between the two but one. The first revision was released in 2013 and the second in 2017. Standards frameworks evolve and ISO 27001 has gone through revisions since it was first released in 2005. Custom-made security controls by organization management are how you get around the organization-specific issues. It takes input from management and other organizational decision-makers to give an accurate picture of the security risks, threats and vulnerabilities present. Please note that ISO 27001 is a standards framework that does not work independently. It is not mandatory to implement ISO 27001 in your organization, however, the good it can bring to your information security management may just make you a believer. It was developed to guide organizations, both large and small, to better protect their information in a manner that is risk-based, systematic and cost-effective. Any way you say it, ISO 27001 is a set of standards for information security management called the ISO/IEC 27000 series and provides best practices for information security management systems or ISMS. This framework was created by a partnership between the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC), so you may see it under the alternative name ISO/IEC 27001.

Iso 27001 framework