Familia ISO 27000: Un conjunto de estándares especializados

Así como tenemos la ISO 9000 como emblema por temas de calidad, en Seguridad tenemos la familia 27000 donde se ha centralizado todos los tópicos relacionados.

A continuación se presenta un listado referencial. Puede faltar alguno o no estar con su última versión, pero la intención principal es decirle al lector que sobre la ISO 27001 y 27002 se puede seguir profundizando y ampliando tanto los controles como las medidas de mitigación.

The published standards in the ISO 27000 family:

ISO/IEC 27000

• ISO/IEC 27000:2018 (ISO 27000) Information technology – Security techniques – Information security management systems – Overview and vocabulary.

ISO/IEC 27001

• ISO/IEC 27001:2013 (ISO27001) Information technology – Security techniques – Information security management systems – Requirements. The latest version of the ISO 27001 Standard.
• ISO/IEC 27001:2013/Cor 1:2014 (ISO27001) (ISO27001) Information technology – Security techniques – Information security management.
• ISO/IEC 27001:2013/Cor 2:2015 (ISO27001) Information technology – Security techniques – Information security management systems – Requirements. The latest version of the ISO 27001 Standard.

ISO/IEC 27002

• ISO/IEC 27002:2013 (ISO 27002) Information technology – Security techniques – Code of practice for information security controls. The latest version of the code of practice for information security controls.
• ISO/IEC 27002:2013/Cor 1:2014 (ISO 27002) Information technology – Security techniques – Code of practice for information security controls. The latest version of the code of practice for information security controls.
• ISO/IEC 27002:2013/Cor 2:2015 (ISO 27002) Information technology – Security techniques – Code of practice for information security controls. The latest version of the code of practice for information security controls.

ISO/IEC 27003

• ISO/IEC 27003:2017 (ISO 27003) Information technology – Security techniques – Information security management system implementation guidance.

ISO/IEC 27004

• ISO/IEC 27004:2016 (ISO 27004) Information technology – Security techniques – Information security management – Monitoring, measurement, analysis and evaluation.

ISO/IEC 27005

• ISO/IEC 27005:2018 (ISO 27005) Information technology – Security techniques – Information security risk management.

ISO/IEC 27006

• ISO/IEC 27006:2015 (ISO 27006) Information technology – Security techniques – Requirements for bodies providing audit and certification of information security management systems.

ISO/IEC 27007

• ISO/IEC 27007:2017 (ISO 27007) Information technology – Security techniques – Guidelines for information security management systems auditing.

ISO/IEC 27008

• ISO/IEC TR 27008:2011 (ISO 27008) Information technology – Security techniques – Guidelines for auditors on information security controls.

ISO/IEC 27009

• ISO/IEC 27009:2016 (ISO 27009) Information technology — Security techniques — Sector-specific application of ISO/IEC 27001 – Requirements.

ISO/IEC 27010

• ISO/IEC 27010:2015 (ISO 27010) Information technology – Security techniques – Information security management for inter-sector and inter-organizational communications.

ISO/IEC 27011

• ISO/IEC 27011:2016 (ISO 27011) Information technology – Security techniques – Information security management guidelines for telecommunications organizations based on ISO/IEC 27002.

ISO/IEC 27013

• ISO/IEC 27013:2015 (ISO 27013) Information technology – Security techniques – Guidance on the integrated implementation of ISO/IEC 27001 and ISO/IEC 20000-1.

ISO/IEC 27014

• ISO/IEC 27014:2013 (ISO 27014) Information technology – Security techniques – Governance of information security.

ISO/IEC 27016

• ISO/IEC TR 27016:2014 (ISO 27016) Information technology – Security techniques – Information security management – Organizational economics.

ISO/IEC 27017

• ISO/IEC 27017:2015 (ISO 27017) Information technology – Security techniques – Code of practice for information security controls based on ISO/IEC 27002 for cloud services.

ISO/IEC 27018

• ISO/IEC 27018:2014 (ISO27018) Information technology – Security techniques – Code of practice for protection of personally identifiable information (PII) in public clouds acting as PII processors.

ISO/IEC 27023

• ISO/IEC 27023:2015 (ISO 27023) Information technology – Security techniques – Mapping the revised editions of ISO/IEC 27001 and ISO/IEC 27002.

ISO/IEC 27031

• ISO/IEC 27031:2011 (ISO 27031) Information technology – Security techniques – Guidelines for information and communication technology readiness for business continuity.

ISO/IEC 27032

• ISO/IEC 27032:2012 (ISO 27032) Information technology – Security techniques – Guidelines for cybersecurity.

ISO/IEC 27033

• ISO/IEC 27033-1:2015 (ISO 27033-1) Information technology – Security techniques – Network security – Part 1: Overview and concepts.
• ISO/IEC 27033-2:2012 (ISO 27033-2) Information technology – Security techniques – Network security – Part 2: Guidelines for the design and implementation of network security.
• ISO/IEC 27033-3:2010 (ISO27033-3) Information security – Security techniques – Network security – Part 3: Reference networking scenarios – Threats, design techniques and control issues.
• ISO/IEC 27033-4:2014 (ISO 27033-4) Information technology – Security techniques – Network security – Part 4: Securing communications between networks using security gateways.
• ISO/IEC 27033-5:2013 (ISO 27033-5) Information technology – Security techniques – Network security – Part 5: Securing communications across networks using Virtual Private Networks (VPNs).
• ISO/IEC 27033-6:2016 (ISO 27033-5) Information technology — Security techniques — Network security — Part 6: Securing wireless IP network access.

ISO/IEC 27034

• ISO/IEC 27034-1:2011 (ISO 27034-1) Information technology – Security techniques – Application security – Part 1: Overview and concepts.
• ISO/IEC 27034-1:2011/Cor 1:2014 (ISO 27034-1) Information technology – Security techniques – Application security – Part 1: Overview and concepts.
• ISO/IEC 27034-2:2015 (ISO 27034-2) Information technology – Security techniques – Application security – Part 2: Organization normative framework for application security.
• ISO/IEC 27034-3:2018 (ISO 27034-3) Information technology – Application security – Part 3: Application security management process.
• ISO/IEC 27034-5 Information technology – Security techniques – Application security – Part 5: Protocols and application security controls data structure. 
• ISO/IEC TS 27034-5-1:2018 (ISO 27034-5-1) Information technology – Application security – Part 5-1: Protocols and application security controls data structure, XML schemas. 
• ISO/IEC 27034-6:2016 (ISO 27034-6) Information technology – Security techniques – Application security – Part 6: Case studies. 
• ISO/IEC 27034-7:2018 (ISO 27034-7) Information technology – Application security – Part 7: Assurance prediction framework.

ISO/IEC 27035

• ISO/IEC 27035-1 2016 (ISO 27035) Information technology — Security techniques — Information security incident management — Part 1: Principles of incident management.
• ISO/IEC 27035:2016-2 (ISO 27035) Information technology — Security techniques — Information security incident management — Part 2: Guidelines to plan and prepare for incident response.  >>

ISO/IEC 27036

• ISO/IEC 27036-1:2014 (ISO 27036-1) Information technology – Security techniques – Information security for supplier relationships – Part 1: Overview and concepts.
• ISO/IEC 27036-2:2014 (ISO 27036-2) Information technology – Security techniques – Information security for supplier relationships – Part 2: Requirements.
• ISO/IEC 27036-3:2013 (ISO 27036-3) Information technology – Security techniques – Information security for supplier relationships – Part 3: Guidelines for information and communication technology supply chain security.
• ISO/IEC 27036-4:2016 (ISO 27036-4) Information technology – Security techniques – Information security for supplier relationships – Part 4: Guidelines for security of cloud services.

ISO/IEC 27037

• ISO/IEC 27037:2012 (ISO 27037) Information technology — Security techniques — Guidelines for identification, collection, acquisition and preservation of digital evidence.

ISO/IEC 27038

• ISO/IEC 27038:2014 (ISO 27038) Information technology – Security techniques – Specification for digital redaction.

ISO/IEC 27039

• ISO/IEC 27039:2015 (ISO 27039) Information technology – Security techniques – Selection, deployment and operations of intrusion detection systems (IDPS).

ISO/IEC 27040

• ISO/IEC 27040:2015 (ISO 27040) Information technology – Security techniques – Storage security

ISO/IEC 27041

• ISO/IEC 27041:2015 (ISO 27041) Information technology – Security techniques – Guidance on assuring suitability and adequacy of incident investigative methods.

ISO/IEC 27042

• ISO/IEC 27042:2015 (ISO 27042) Information technology – Security techniques – Guidelines for the analysis and interpretation of digital evidence.

ISO/IEC 27043

• ISO/IEC 27043:2015 (ISO 27043) Information technology – Information technology – Security techniques – Incident investigation principles and processes.

ISO/IEC 27050

• ISO/IEC 27050-1:2016 (ISO 27050) Information technology — Security techniques — Electronic discovery — Part 1: Overview and concepts.
• ISO 27050-2:2018 (ISO 27050-2) Information technology – Electronic discovery – Part 2: Guidance for governance and management of electronic discovery.
• ISO/IEC 27050-3: 2017 (ISO 27050-3) Information technology – Security techniques – Electronic discovery – Part 3: Code of Practice for electronic discovery.

ISO/IEC 273013

• ISO/IEC TR 27103:2018 Information technology – Security techniques – Cybersecurity and ISO and IEC standards.

ISO/IEC TR 27103

• ISO/IEC 27102:2019 Information security management – Guidelines for cyber-insurance.

ISO/IEC 273013

• ISO/IEC TR 27103:2018 (ISO 27103) Information technology — Security techniques — Electronic discovery — Part 1: Overview and concepts.

ISO/IEC 27701

• ISO/IEC 27701:2019 (ISO 27701) Information technology — Security techniques — Enhancement to ISO/IEC 27001 for privacy management — Requirements.

Autor / Redactor / Director