British Risk Management Standard – BS7799-3:2006
Risk assessment is fundamental to developing an ISMS that meets the requirements of ISO27001:2005 (BS7799-2).
Identifying, evaluating, treating and managing information security risks are key processes if businesses want to keep their information safe and secure. Whilst these processes are specified in the new information security standard BS ISO/IEC 27001:2005, further guidance is required on how to manage these risks, as well as how to put them in context with other business risks.
There are two sources for this guidance. ISO/IEC 27005 is one; British Standard BS7799-3:2006 is the other. It covers:
- Risk assessment
- Risk treatment
- Management decision making
- Risk re-assessment
- Monitoring and reviewing of risk profile
- Information security risk in the context of corporate governance
- Compliance with other risk based standards and regulations.
BS7799-3:2006 gives guidance to support the requirements given in BS ISO/IEC 27001:2005 regarding all aspects of an information security management system (ISMS) risk management cycle. This includes assessing and evaluating the risks, implementing controls to treat the risks, monitoring and reviewing the risks, and maintaining and improving the system of risk controls.
The focus of this standard is effective information security through an ongoing programme of risk management activities. This focus is targeted at information security in the context of an organisation's business risks.
The guidance set out in this British Standard is intended to be applicable to all organisations, regardless of their type, size and nature of business. It is intended for those business managers and their staff involved in ISMS risk management activities.
BS 7799-3:2006 was published on 16 March 2006 and is available.
ISBN 10: 0580472477
ISBN 13: 9780580472473
Format: Hardcopy
Other formats: Download
RELATED PRODUCTS
To write review for this product Click here
