BS 7799-3 Security Risk Standard Now Available
The new BSI security standard, numbered BS7799-3, has been released.
This is officially titled Guidelines for Information Security Risk Management, and is designed to support the general security management standard, ISO27001, which was published in October 2005.
Whilst ISO27001 covers all aspects of an information security management system, BS7799-3 focuses specifically upon risk, including the following aspects:
- the assessment & evaluation of risks
- implementation of security controls to address these
- monitoring of the risks
- maintenance of the risk control system.
The BS7799-3 document is organized as follows:
- Scope
- Normative references
- Terms/definitions
- Information security risks in the organizations context
- Risk assessment
- Risk treatment and management decision making
- Ongoing risk management
The standard itself is available for the main BSI outlet,
StandardsDirect:
http://17799.standardsdirect.org/bs7799.htm
Or as part of a special edition of the ISO17799 Toolkit: