Fazila Nurani, CIPP/C

Most organizations are dependent upon their information and business systems, leaving them exposed to critical loss in the aftermath of a security breach. Fortunately, by implementing an information security management system (ISMS), as outlined in the only internationally accepted standard/code to address information security, a business can significantly reduce the risk of a security breach.

ISO/IEC 17799:2005 (ISO 17799), known as the Code of Practice for information security management, was developed by an IT Security Subcommittee of the International Organization for Standardization and was published in June 2005. ISO 17799 is superior to other security standards becauseit is globally accepted and comprehensive. ISO 17799 has been crafted cleverly to work well across industries and geographies. Also, the International Organization for Standardization consciously has made this standard consistent with most other existing information security audit- and control-standards, such as those developed by the NIST (National Institute of Standards and Technology). Therefore, ISO 17799 can be the common framework that links to all other standards, regulatory requirements and corporate governance initiatives.

ISO 17799 provides practical guidelines for developing organizational security controls and effective security management practices. An ISO 17799 evaluation results in a snapshot of the company's security infrastructure, in that it provides a high-level view of how well (or how badly) a company implements information security. This standard is a great tool for companies whether establishing or improving information security within their organization.
The information security process traditionally has been based on sound best practices and guidelines, with the goals of preventing, detecting and containing security breaches, as well as restoration of the affected data to its previous state. While this cumulative wisdom of the ages is valid, it also is subject to various interpretations and implementations. ISO 17799 offers an achievable benchmark against which to build organizational information security.

Control Selection Based on Risks Identified
ISO 17799 consists of 39 security controls, which can be used as a basis for a security risk assessment. The controls encompass all forms and types of information, whether they are electronic files, paper documents or various forms of communications such as email, fax and spoken conversations. The standard sets out a variety of hardware and software considerations, policies, procedures and organizational structures that protect a company's information assets from a broad range of modern security threats and vulnerabilities. How organizations shape their information security programs will depend on the unique requirements and risks they face. An organization only should deploy controls that relate to, and are in proportion to, the actual risks it faces.

Controls also can be described as the "countermeasures" for risks. Apart from knowingly accepting risks considered acceptable, or transferring those risks (through insurance) to others, there are essentially four types of control:

  • Deterrent controls reduce the likelihood of a deliberate attack.
  • Preventative controls protect vulnerabilities and make an attack unsuccessful or reduce its impact.
  • Corrective controls reduce the effect of an attack.
  • Detective controls discover attacks and trigger preventative or corrective controls.

It is essential that any controls that are implemented are cost-effective. The cost of implementing and maintaining a control should be no greater than the identified and quantified cost of the impact of the identified threat (or threats). It is not possible to provide total security against every single risk; the trade-off involves providing effective security against most risks. No board should sign off on any ISMS proposal that seeks to remove all risk from the business — the business does, after all, exist within a risk framework and, since it is impossible to exist risk-free, there is little point in proposing to eliminate every risk.
No organization should invest in information security technology (hardware or software) or implement information security management processes and procedures without having carried out an appropriate risk and control assessment that assures them that:

  • The proposed investment (the total cost of the control) is the same as, or less than, the cost of the identified impact;
  • The risk classification, which takes into account its probability, is appropriate for the proposed investment; and
  • Mitigating the risk is a priority — i.e. all the risks with higher prioritization already have been adequately controlled and, therefore, it is appropriate now to invest in controlling this one.

If the organization cannot justify that the proposed investment meets these criteria, it would be wasting money — and the time required to implement the control — while leaving itself open to more likely risks and, conceivably, with inadequate resources to respond to the more likely risk when it occurs. Simply put — there is a risk associated with not carrying out an adequate risk assessment.

The Security Categories in ISO 17799
Once information security needs and requirements are identified, a suitable set of controls from ISO 17799 can be established, implemented, monitored, reviewed and improved upon in order to ensure that the specific security objectives of the organization are met. The following is a high-level description of the 11 security categories containing the 39 controls outlined in the standard:


  1. Security Policy: Establish a comprehensive information security document. The policy should contain a set of implementation-independent, conceptual information security policy statements governing the security goals of the organization.
  2. Organizational Security: Create a management framework that sustains and manages the security infrastructure. This step involves organizing the protection of information both internally and externally. For example, an internal control would be allocating information security responsibilities; whereas an external control would be addressing security in third-party service agreements.
  3. Asset Classification and Control: Institute an organizational asset management system to assess the ability of the security infrastructure to protect organizational assets. This control would include using an information classification system.
  4. Personnel Security: Human resource security management addresses an organization's ability to mitigate the risk inherent in human interactions. This involves exploring different ways of emphasizing the security interests in company information to employees prior to, during, and at termination of employment. This control addresses the need to provide security training, education and awareness.
  5. Physical and Environmental Security: Establish protections for company premises and equipment.
  6. Communications and Operations Management: Adopt a comprehensive set of operational procedures, change management procedures, and methods to manage third-party service agreements and protect the exchange of information.
  7. Access Control: Control access to assets based on business and security requirements, including user responsibilities and network access control mechanisms.
  8. System Development and Maintenance: Information systems security management encompasses the acquisition, development and maintenance of information systems.
  9. Incident Management: Develop a plan for the reporting of information security events and weaknesses. This control assists with managing these incidents and related improvements, such as establishing response responsibilities and procedures.
  10. Business Continuity Management: Protect information by engaging in business continuity planning, testing and maintenance.
  11. Compliance: Ensure compliance with regulatory, statutory and contractual security requirements.

ISO 17799 is a comprehensive information security code of practice that provides enterprises an internationally recognized and structured methodology for information security. In addition to ISO 17799, the International Organization for Standardization also published ISO 27001, which specifies a number of requirements for establishing, implementing, maintaining and improving an ISMS using the controls outlined in ISO 17799.

ISO 27001 is the formal standard against which an organization may seek independent certification of their ISMS. While certification is entirely optional, as of January 2007, more than 3,000 organizations worldwide were ISO 27001-certified, demonstrating their commitment to information security. Organizations may be certified as compliant with ISO 27001 by a number of accredited certification bodies worldwide. ISO 27001 certification generally involves a two-stage audit process, with a "table top" review of key documentation at the first stage and a more in-depth audit of the ISMS at the second stage. The certified organization would need to be re-assessed periodically by the certification body.

Organizations can purchase the ISO 17799 code of practice online from the official Web site of the International Organization for Standardization for approximately $160.

Additionally, organizations can obtain more sophisticated resources and tools, such as the ISO 17799 Toolkit, which includes both the ISO 17799 and the ISO 27001 text, a management presentation, a complete set of ISO 17799 compliance information security policies, a certification roadmap as well as an essential audit kit, among others. The ISO 17799 Toolkit is available for purchase at www.17799-toolkit.com for the price of $995. It was put together by David Watson, the first certified ISO 27001 auditor.

In summary, organizations face threats to their information assets on a daily basis. At the same time, they increasingly are becoming dependent on these assets. Technical solutions are only one portion of a holistic approach to information security. Establishing broad information security requirements in the framework of the organization's own unique risk environment are essential.

Fazila Nurani, CIPP/C, is President and Founder of PrivaTech Consulting, based in Toronto, Canada. PrivaTech specializes in advising organizations on compliance with Canadian privacy laws. Nurani, who holds engineering and law degrees, assists businesses in diverse industries manage privacy and information security risks. She may be reached at +1.905.886.0751 or


This e-mail address is being protected from spam bots, you need JavaScript enabled to view it



If you want to comment on this post, you need to login.


Board of Directors

See the esteemed group of leaders shaping the future of the IAPP.

Contact Us

Need someone to talk to? We’re here for you.

IAPP Staff

Looking for someone specific? Visit the staff directory.

Learn more about the IAPP»

Daily Dashboard

The day’s top stories from around the world

Privacy Perspectives

Where the real conversations in privacy happen

The Privacy Advisor

Original reporting and feature articles on the latest privacy developments

Privacy Tracker

Alerts and legal analysis of legislative trends

Privacy Tech

Exploring the technology of privacy

Canada Dashboard Digest

A roundup of the top Canadian privacy news

Europe Data Protection Digest

A roundup of the top European data protection news

Asia-Pacific Dashboard Digest

A roundup of the top privacy news from the Asia-Pacific region

Latin America Dashboard Digest

A roundup of the top privacy news from Latin America

IAPP Westin Research Center

Original works. Groundbreaking research. Emerging scholars.

Get more News »

IAPP Communities

Meet locally with privacy pros, dive deep into specialized topics or connect over common interests. Find your Community in KnowledgeNet Chapters, Sections and Affinity Groups.

IAPP Job Board

Looking for a new challenge, or need to hire your next privacy pro? The IAPP Job Board is the answer.

Join the Privacy List

Have ideas? Need advice? Subscribe to the Privacy List. It’s crowdsourcing, with an exceptional crowd.

Find a KnowledgeNet Chapter Near You

Talk privacy and network with local members at IAPP KnowledgeNet Chapter meetings, taking place worldwide.

Find more ways to Connect »

Find a Privacy Training Class

Two-day privacy training classes are held around the world. See the complete schedule now.

The Privacy Core™ Library Has Evolved

Privacy Core™ e-learning essentials just expanded to include seven new units for marketers. Keep your data safe and your staff in the know!

Online Privacy Training

Build your knowledge. The privacy know-how you need is just a click away.

Upcoming Web Conferences

See our list of upcoming web conferences. Just log on, listen in and learn!

Train Your Team

Get your team up to speed on privacy by bringing IAPP training to your organization.

Let’s Get You DPO Ready

There’s no better time to train than right now! We have all the resources you need to meet the challenges of the GDPR.

Learn more »

CIPP Certification

The global standard for the go-to person for privacy laws, regulations and frameworks

CIPM Certification

The first and only privacy certification for professionals who manage day-to-day operations

CIPT Certification

The industry benchmark for IT professionals worldwide to validate their knowledge of privacy requirements

FIP Designation

Recognizing the advanced knowledge and issue-spotting skills a privacy pro must attain in today’s complex world of data privacy.

Certify Your Staff

Find out how you can bring the world’s only globally recognized privacy certification to a group in your organization.


The IAPP’S CIPP/E and CIPM are the ANSI/ISO-accredited, industry-recognized combination for DPO readiness. Learn more today.

Learn more about IAPP certification »

Are You Ready for the GDPR?

Check out the IAPP's EU Data Protection Reform page for all the tools and resources you need.

IAPP-OneTrust PIA Platform

New U.S. Government Agency privacy impact assessments - free to IAPP members!

IAPP Communities

Meet locally with privacy pros, dive deep into specialized topics or connect over common interests. Find your Community in KnowledgeNet Chapters, Sections and Affinity Groups.

Privacy Vendor List

Find a privacy vendor to meet your needs with our filterable list of global service providers.

More Resources »

Europe Data Protection Intensive 2017

The Intensive is sold out! But cancellations do happen—so hurry and get on the wait list in case more seats become available.

Global Privacy Summit 2017

The world’s premier privacy conference returns with the sharpest minds, unparalleled programs and preeminent networking opportunities.

Canada Privacy Symposium 2017

The Symposium returns to Toronto this spring and registration has opened! Take advantage of Early Bird rates and join your fellow privacy pros for another stellar program.

The Privacy Bar Section Forum 2017

The Privacy Bar Section Forum is sold out! But you can still add your name to the wait list, and we'll keep in touch about your status. Good luck!

Asia Privacy Forum 2017

Call for Speakers open! Join the Forum in Singapore for exclusive networking and intensive education on data protection trends and challenges in the Asia Pacific region.

Privacy. Security. Risk. 2017

We're bringing the best of the best in privacy and infosecurity to sunny San Diego. Early registration for P.S.R. opens May 1.

Europe Data Protection Congress 2017

Call for Speakers open! The Congress is your source for European policy debate, multi-level strategic thinking and thought-provoking discussion. Submit a proposal by March 19.

Sponsor an Event

Increase visibility for your organization—check out sponsorship opportunities today.

More Conferences »

Become a Member

Start taking advantage of the many IAPP member benefits today

Corporate Members

See our list of high-profile corporate members—and find out why you should become one, too

Renew Your Membership

Don’t miss out for a minute—continue accessing your benefits

Join the IAPP»