Fazila Nurani, CIPP/C

Most organizations are dependent upon their information and business systems, leaving them exposed to critical loss in the aftermath of a security breach. Fortunately, by implementing an information security management system (ISMS), as outlined in the only internationally accepted standard/code to address information security, a business can significantly reduce the risk of a security breach.

ISO/IEC 17799:2005 (ISO 17799), known as the Code of Practice for information security management, was developed by an IT Security Subcommittee of the International Organization for Standardization and was published in June 2005. ISO 17799 is superior to other security standards becauseit is globally accepted and comprehensive. ISO 17799 has been crafted cleverly to work well across industries and geographies. Also, the International Organization for Standardization consciously has made this standard consistent with most other existing information security audit- and control-standards, such as those developed by the NIST (National Institute of Standards and Technology). Therefore, ISO 17799 can be the common framework that links to all other standards, regulatory requirements and corporate governance initiatives.

ISO 17799 provides practical guidelines for developing organizational security controls and effective security management practices. An ISO 17799 evaluation results in a snapshot of the company's security infrastructure, in that it provides a high-level view of how well (or how badly) a company implements information security. This standard is a great tool for companies whether establishing or improving information security within their organization.
The information security process traditionally has been based on sound best practices and guidelines, with the goals of preventing, detecting and containing security breaches, as well as restoration of the affected data to its previous state. While this cumulative wisdom of the ages is valid, it also is subject to various interpretations and implementations. ISO 17799 offers an achievable benchmark against which to build organizational information security.

Control Selection Based on Risks Identified
ISO 17799 consists of 39 security controls, which can be used as a basis for a security risk assessment. The controls encompass all forms and types of information, whether they are electronic files, paper documents or various forms of communications such as email, fax and spoken conversations. The standard sets out a variety of hardware and software considerations, policies, procedures and organizational structures that protect a company's information assets from a broad range of modern security threats and vulnerabilities. How organizations shape their information security programs will depend on the unique requirements and risks they face. An organization only should deploy controls that relate to, and are in proportion to, the actual risks it faces.

Controls also can be described as the "countermeasures" for risks. Apart from knowingly accepting risks considered acceptable, or transferring those risks (through insurance) to others, there are essentially four types of control:

  • Deterrent controls reduce the likelihood of a deliberate attack.
  • Preventative controls protect vulnerabilities and make an attack unsuccessful or reduce its impact.
  • Corrective controls reduce the effect of an attack.
  • Detective controls discover attacks and trigger preventative or corrective controls.

It is essential that any controls that are implemented are cost-effective. The cost of implementing and maintaining a control should be no greater than the identified and quantified cost of the impact of the identified threat (or threats). It is not possible to provide total security against every single risk; the trade-off involves providing effective security against most risks. No board should sign off on any ISMS proposal that seeks to remove all risk from the business — the business does, after all, exist within a risk framework and, since it is impossible to exist risk-free, there is little point in proposing to eliminate every risk.
No organization should invest in information security technology (hardware or software) or implement information security management processes and procedures without having carried out an appropriate risk and control assessment that assures them that:

  • The proposed investment (the total cost of the control) is the same as, or less than, the cost of the identified impact;
  • The risk classification, which takes into account its probability, is appropriate for the proposed investment; and
  • Mitigating the risk is a priority — i.e. all the risks with higher prioritization already have been adequately controlled and, therefore, it is appropriate now to invest in controlling this one.

If the organization cannot justify that the proposed investment meets these criteria, it would be wasting money — and the time required to implement the control — while leaving itself open to more likely risks and, conceivably, with inadequate resources to respond to the more likely risk when it occurs. Simply put — there is a risk associated with not carrying out an adequate risk assessment.

The Security Categories in ISO 17799
Once information security needs and requirements are identified, a suitable set of controls from ISO 17799 can be established, implemented, monitored, reviewed and improved upon in order to ensure that the specific security objectives of the organization are met. The following is a high-level description of the 11 security categories containing the 39 controls outlined in the standard:


  1. Security Policy: Establish a comprehensive information security document. The policy should contain a set of implementation-independent, conceptual information security policy statements governing the security goals of the organization.
  2. Organizational Security: Create a management framework that sustains and manages the security infrastructure. This step involves organizing the protection of information both internally and externally. For example, an internal control would be allocating information security responsibilities; whereas an external control would be addressing security in third-party service agreements.
  3. Asset Classification and Control: Institute an organizational asset management system to assess the ability of the security infrastructure to protect organizational assets. This control would include using an information classification system.
  4. Personnel Security: Human resource security management addresses an organization's ability to mitigate the risk inherent in human interactions. This involves exploring different ways of emphasizing the security interests in company information to employees prior to, during, and at termination of employment. This control addresses the need to provide security training, education and awareness.
  5. Physical and Environmental Security: Establish protections for company premises and equipment.
  6. Communications and Operations Management: Adopt a comprehensive set of operational procedures, change management procedures, and methods to manage third-party service agreements and protect the exchange of information.
  7. Access Control: Control access to assets based on business and security requirements, including user responsibilities and network access control mechanisms.
  8. System Development and Maintenance: Information systems security management encompasses the acquisition, development and maintenance of information systems.
  9. Incident Management: Develop a plan for the reporting of information security events and weaknesses. This control assists with managing these incidents and related improvements, such as establishing response responsibilities and procedures.
  10. Business Continuity Management: Protect information by engaging in business continuity planning, testing and maintenance.
  11. Compliance: Ensure compliance with regulatory, statutory and contractual security requirements.

ISO 17799 is a comprehensive information security code of practice that provides enterprises an internationally recognized and structured methodology for information security. In addition to ISO 17799, the International Organization for Standardization also published ISO 27001, which specifies a number of requirements for establishing, implementing, maintaining and improving an ISMS using the controls outlined in ISO 17799.

ISO 27001 is the formal standard against which an organization may seek independent certification of their ISMS. While certification is entirely optional, as of January 2007, more than 3,000 organizations worldwide were ISO 27001-certified, demonstrating their commitment to information security. Organizations may be certified as compliant with ISO 27001 by a number of accredited certification bodies worldwide. ISO 27001 certification generally involves a two-stage audit process, with a "table top" review of key documentation at the first stage and a more in-depth audit of the ISMS at the second stage. The certified organization would need to be re-assessed periodically by the certification body.

Organizations can purchase the ISO 17799 code of practice online from the official Web site of the International Organization for Standardization for approximately $160.

Additionally, organizations can obtain more sophisticated resources and tools, such as the ISO 17799 Toolkit, which includes both the ISO 17799 and the ISO 27001 text, a management presentation, a complete set of ISO 17799 compliance information security policies, a certification roadmap as well as an essential audit kit, among others. The ISO 17799 Toolkit is available for purchase at www.17799-toolkit.com for the price of $995. It was put together by David Watson, the first certified ISO 27001 auditor.

In summary, organizations face threats to their information assets on a daily basis. At the same time, they increasingly are becoming dependent on these assets. Technical solutions are only one portion of a holistic approach to information security. Establishing broad information security requirements in the framework of the organization's own unique risk environment are essential.

Fazila Nurani, CIPP/C, is President and Founder of PrivaTech Consulting, based in Toronto, Canada. PrivaTech specializes in advising organizations on compliance with Canadian privacy laws. Nurani, who holds engineering and law degrees, assists businesses in diverse industries manage privacy and information security risks. She may be reached at +1.905.886.0751 or


This e-mail address is being protected from spam bots, you need JavaScript enabled to view it



If you want to comment on this post, you need to login.


Board of Directors

See the esteemed group of leaders shaping the future of the IAPP.

Contact Us

Need someone to talk to? We’re here for you.

IAPP Staff

Looking for someone specific? Visit the staff directory.

Learn more about the IAPP»

Daily Dashboard

The day’s top stories from around the world

Privacy Perspectives

Where the real conversations in privacy happen

The Privacy Advisor

Original reporting and feature articles on the latest privacy developments

Privacy Tracker

Alerts and legal analysis of legislative trends

Privacy Tech

Exploring the technology of privacy

Canada Dashboard Digest

A roundup of the top Canadian privacy news

Europe Data Protection Digest

A roundup of the top European data protection news

Asia-Pacific Dashboard Digest

A roundup of the top privacy news from the Asia-Pacific region

Latin America Dashboard Digest

A roundup of the top privacy news from Latin America

IAPP Westin Research Center

Original works. Groundbreaking research. Emerging scholars.

Get more News »

Find a KnowledgeNet Chapter Near You

Network and talk privacy at IAPP KnowledgeNet meetings, taking place worldwide.

Women Leading Privacy

Events, volunteer opportunities and more designed to help you give and get career support and expand your network.

IAPP Job Board

Looking for a new challenge, or need to hire your next privacy pro? The IAPP Job Board is the answer.

Join the Privacy List

Have ideas? Need advice? Subscribe to the Privacy List. It’s crowdsourcing, with an exceptional crowd.

Find more ways to Connect »

Find a Privacy Training Class

Two-day privacy training classes are held around the world. See the complete schedule now.

Online Privacy Training

Build your knowledge. The privacy know-how you need is just a click away.

The Training Post—Can’t-Miss Training Updates

Subscribe now to get the latest alerts on training opportunities around the world.

New Web Conferences Added!

See our list of upcoming web conferences. Just log on, listen in and learn!

Train Your Staff

Get your team up to speed on privacy by bringing IAPP training to your organization.

Learn more »

CIPP Certification

The global standard for the go-to person for privacy laws, regulations and frameworks

CIPM Certification

The first and only privacy certification for professionals who manage day-to-day operations

CIPT Certification

The industry benchmark for IT professionals worldwide to validate their knowledge of privacy requirements

Certify Your Staff

Find out how you can bring the world’s only globally recognized privacy certification to a group in your organization.

Learn more about IAPP certification »

Get Close-up

Looking for tools and info on a hot topic? Our close-up pages organize it for you in one easy-to-find place.

Where's Your DPA?

Our interactive DPA locator helps you find data protection authorities and summary of law by country.

IAPP Westin Research Center

See the latest original research from the IAPP Westin fellows.

Looking for Certification Study Resources?

Find out what you need to prepare for your exams

More Resources »

GDPR Comprehensive: Spots Going Fast

With the top minds in the field leading this exceptional program, it's no wonder it's filling quickly. Register now to secure your spot.

Be Part of Something Big: Join the Summit

Registration is open for the Global Privacy Summit 2016. Discounted early bird rates available for a short time, register today!

Data Protection Intensive Returns to London

Registration is now open for the IAPP Europe Data Protection Intensive in London. Check out the program!

P.S.R. Call for Speakers Open!

P.S.R. is THE privacy + cloud security event of the year, and you can take a leading role. Propose a session for this year's program.

Sponsor an Event

Increase visibility for your organization—check out sponsorship opportunities today.

Exhibit at an Event

Put your brand in front of the largest gatherings of privacy pros in the world. Learn more.

More Conferences »

Become a Member

Start taking advantage of the many IAPP member benefits today

Corporate Members

See our list of high-profile corporate members—and find out why you should become one, too

Renew Your Membership

Don’t miss out for a minute—continue accessing your benefits

Join the IAPP»