ISO/IEC 17799:2005 By Another Name Is Still The Same

Now Available:

Featured Resources:

I've been doing some compliance gap analysis work comparing the policies of one of my clients with ISO/IEC 17799:2005. It was renamed in July of this year to ISO/IEC 27002:2005. So, along with the name change, did the content also change? Having the 2005 tacked on the end of the new name would seem to possibly indicate not. Hmm...

So I contacted Dr. Gary Hinson, ISO/IEC 17799 / ISO/IEC 27002 guru extraordinaire.

He indicated that ISO/IEC 27002:2005 has the exact same content as ISO/IEC 17799:2005; only the title is different.

The ANSI store, which sells the standards, does not really clearly communicate that the content is exactly the same in the renamed document. The description simply states:

"ISO/IEC 27002:2005 Information technology - Security techniques - Code of practice for information security management (Redesignation of ISO/IEC 17799:2005)"

"Redesignation" could mean the content has also changed.

Will everyone know that "redesignation," as used on the ANSI site, means that only the title has changed, but the content remains exactly the same?

Probably not. I'm sure there have been folks who have made the purchase from the ANSI site only to find they did not get anything updated from what they already had.

So, let's look at the BSI site, which also sells the standards.

They have more description for the document, including this statement that a little more clearly indicates the content is the same:

"International Relationships ISO/IEC 17799:2005 Identical"

So, if you already have ISO/IEC 17799:2005 and want to be sure you have the most up-to-date version...you already do!

Categories

Rebecca Herold's Bio:

Rebecca Herold,CISSP, CIPP, CISM, CISA, FLMI, has been providing information security, privacy and regulatory assistance and services to organizations from a wide range of industries for over 18 years. Rebecca was instrumental in building the information security and privacy program while at Principal Financial Group, which was awarded the CSI Information Security Program of the Year Award in 1998. IT Security ranked Rebecca as one of the top 59 IT security influencers, and Computerworld put Rebecca their list of the 25 top privacy experts and on their list of the 9 best privacy consulting firms. Rebecca has been CPO for two consulting organizations, and has had her own information privacy, security and compliance business since 2004. Rebecca has written chapters for several books, dozens of articles, and has been writing a monthly privacy column for the CSI Alert newsletter since the beginning of 2001, and is working on her 11th book. Some of her other books include The Privacy Papers, Managing an Information Security and Privacy Awareness and Training Program, The Definitive Guide to Security Inside the Perimeter (Realtime Publishers), The Shortcut Guide to Improving IT Service Support through ITIL (Realtime Publishers), and The Practical Guide to HIPAA Privacy and Security Compliance. In addition, Rebecca is the leader of The Realtime IT Compliance Community where she posts to her IT Compliance weblog. You can contact Rebecca at: rebecca_herold@realtimepublishers.net.

Now Available:

Featured Resources:

Realtime Communities

Newsletter

Monthly Archives

RSS

Ask the Expert