ICT SCRM ICT SCRM – ISO Standards Upda

ISO Standards Upda

Nadya 

March 2
Standards are a common language used to communica

l l f f f dt d i

Standards are Essential to Global Economy Government

 Ensuring interoperability among trade partners  US National Technology T

levels o

f per

formance 

for pro

duc

ts an

d services

 US National Technology T

Advancement Act of 1995 [P.L] 104-113, Sec 12-d-1)

“Federal agencies 

use such technical stand

t li bj ti 

 Ensuring interoperability among trade partners

 Facilitating increased efficiencies in the global 

economy

 Making the development, manufacturing, and 

l f d t d i ffi i t carry out policy objective

 World Trade Organization 

Technical Barriers to Tradof international standards a

supply of pro

ducts an

d services more effi

cient, 

safer and cleaner

 Providing governments with a technical base for 

health, safety and environmental legislation

 S f di d i l f assessment systems becau

improving the efficiency of facilitating international trad

 S

afeguarding consumers, an

d users in general, of

products and services - as well as to make their lives simpler

Countries use interna

compliance as a tra

differentiator for the

Businesses adopt standards when it is clear 

that they can gain competitive advantage
Most prominent global standards organizations us

consensus-di f t d d d l 

d

riven processes 

for s

tan

dar

ds 

develo

 The International Organization for Standardization (ISO) is the world’s largest developer of standa

governmental consensus-building network of the national standards institutes of 156 countries. Those 

represent the go ernments of their respecti e co ntries b t c represent the go

vernments of their respecti

v

e co

untries, b

ut commonl ha e close ties to both go ern

y ha

v

e close ties to both go

vern

 The International Electrotechnical Commission (IEC) develops international standards and confor

government, business and society for all electrical, electronic and related technologies. Their standardcreation of national standards, and for international commercial contracts and agreements. 

 The International Telecommunications Union (ITU), with roots in the late 1800s stemming from tre

international telegraph interconnections, it is now an international organization within the United Natio

governments and the private sector coordinate global telecom networks and services.

 The Institute of Electrical and Electronics Engineers (IEEE), which establishes standards for elec

technologies and sciences. Like other standards, these support broader commercialization, interoperaand implementation, and protection of users and the environment.

 The Internet Engineering Task Force (IETF), which develops Internet-related standards, especially 

TCP/IP protocol. Its membership is open to the general public, and though it meets three times a yea

conducted electronically via email conducted electronically via email.

Effective standards incorporate the views of all interested parties from manufactu

users to research organizations and governments

Filename/RPS Number 

users to research organizations and governments.
Other players exist and are all connected through high

organi ti l t l li i izations or la

teral li

aisons
The ICT SCRM Standard Development Organization Lan

Active ICT SCRM Standard Development 
Within the ISO structure, ISO/IEC JTC1 SC27 focuses o

security

ISO/IEC

J i t T h i l C itt 1 J

oin

t

Tec

h

nical Committee 

1

(Information Technology)

J

oin

t

Tec

h

nical Committee 

1

(Information Technology)

Subcommittee 27 ( ) SC27

(IT Security Techniques)

Working 

G

G

G 

Group 1

Information Security 

Management Systems

Working 

Group 2

Cryptography and 

Security Mechanisms

Working 

Group 3

Security Evaluation 

Criteria

Working Group 

Security Controls 

Services
SC27 portfolio includes over 90 cyber security standar

45 currently under development or revision, plus study coveri di t f bj t ing a diverse se

t o

f subjec

t

s

Information Security Management SystemSecurity ControlsInformation Security Risk Management

Sector-Specific Guidance 

Financial Services)

Information Security Risk Management

Biometric Techniques

Information Security MeasurementDisaster RecoveryVulnerability ManagementNetwork Security

Biometric TechniquesPrivacy TechnologiesAccess control and managEntity Authentication

Network Security

Hash Functions

Intrusion Detection SystemIncident ManagementApplication SecurityIdentity Management

Hash FunctionsAuthenticated EncryptionRandom Bit GenerationICT Readiness for Busine

Identity Management

Common Criteria

Authentication AssuranceTrusted Platform ModuleCryptographic TechniquesKey Management

Common CriteriaSecurity EngineeringSecurity AssuranceSecurity of Outsourcing

Key Management

ICT Supply Chain Security

Authentication ProtocolsInformation Security Governance

ICT Supply Chain SecurityEconomics of Information Forensic InvestigationCyber Security

A dM M

Filename/RPS Number 

A

n

d

Many 

More...
CS1 represents US interests within SC27

 Operating under the auspices of InterNational Committee for Information Technology S

which is the US counterpart to JTC1 

 With diverse representation of industry, government, and academia

– Alcatel Lucent– Atsec– Boeing

– DHS – DoD– Veridio

– Marks – Microsoft– Mitre

– Booz Allen– CERT– Cisco– EMC

– VHA– WB Ha– Yaana – Zygma 

– NSA– NIST– Oracle

EMC

– Plum Hall Inc

– Fidelity– Gemalto– HP

Plum Hall Inc Zygma 

– Raytheon– Ricoh– SAFECode

– Hitachi Data Systems– Intel– Kantara Initiative– Lexmark

– Surety– Symantec– The Open Group

Lexmark
oISO/IEC 27000 – Overview and Vocabulary

logy

ISO/IEC Information Security Management System (ISMS)

Family of Standards (WG1)

Governance (WG1)

ISO/IEC ISO/IEC 27000 Overview Overview and Vocabulary Vocabulary

ISO/IEC 27001 – ISO/IEC 2700

Termino

ments ISO/IEC 2700

Audit & Certification R

ISO/IEC 27001

ISMS Requirements

ISO/IEC 27002 –

Code of Practice

ISO/IEC 27003 –

ISMS Guidelines

Requirem

ISO/IEC 27007 –

Audit

Code of Practice ISMS Guidelines 

ISO/IEC 27004 –

Measurement

ISO/IEC 2700X (concept) –

Guidelines

Audit

Guidelines

ISO/IEC 27005 –

Risk Management

ISO/IEC 2700X (concept)

Sector-Specific Guidelines

ISO/IEC 2700X (concept)

Sector-Specific Guidelines

Implementation (WG4)

ISO

Security Engineering (WG3)

ISO/IEC 21913 – Secure Tamper Protection S

ISO/IEC 27034–

Application Security

Suppli

ISO/IE

Netwo

ISO/IEC 15408 -

Common Criteria

ISO/IEC 21913 – Secure

System Engineering 

Principles and Techniques

ISO/IEC 21913 – Secure

System Engineering 

Principles and Techniques

Study Period

ISO/IEC 20004-Secure software development and 

evaluation under ISO/IEC 15408 and ISO/IEC 18405evaluation evaluation under ISO/IEC ISO/IEC 15408 and ISO/IEC ISO/IEC 18405
ICT Supply Chain Risk Management requires contribut

coll b ti di i li ith i d 

ll

a

boration among many disciplines with recognize

d 

•ISO/IEC/IEEE 15288 (Systems)

•ISO/IEC15026 (Systems Assurance)

•IEEE 1062 (Software Acquisition)

Capabilit Mat rit Model Integration (CMMI)

Systems

En

gineerin

g

•ISO/IEC 27005 (Risk 

Management: Information 

Security)

•ISO/IEC 16085 

(Risk Mana

gement: Life C

ycle 

•ISO/IEC 27005 (Risk 

Management: Information 

Security)

•ISO/IEC 16085 

(Risk Mana

gement: Life C

ycle 

•Capabilit Capability Mat

urity Model Integration Integration (CMMI) •ISO/

S

•IS

(

•ISO/

S

•IS

g g (

ICT Supply 

Chain

( g

y

Processes )

•ISO/IEC 31000 (Risk 

Management: Principles and 

Guidelines)

( g

y

Processes )

•ISO/IEC 31000 (Risk 

Management: Principles and 

Guidelines)

( 

Ma

Supply Chain

Chain

Assurance

•ISO/IEC 20000 

(IT Service Management)

•Micro

•ISO/I

•Micro

•ISO/I

&

Logistics

(IT Service Management)

•Resiliency Management 

Model (RMM)

•ISO/IEC 28000 (Supply 

•ISO/I

A

•ISO/IE

Lan

•ISO/I

A

•ISO/IE

Lan

Chain Resiliency) 
ISO Standards development process takes 2-5 years an

consensus-building among national standards bodies

 Begins with an established marketplace requirement that is communicated through 

standards body, which proposes the request to a corresponding subcommittee

 The subcommittee presents the proposal subcommittee presents the proposal for a discussion and a vote and if accepte

for

a discussion and

a vote, and, if accepte

subcommittee begins working on the standard

 An editor is sought and provided—an expert who leads the standard’s development The subcommittee reviews multiple drafts and requests subcommittee reviews multiple drafts and requests comments comments from national s

from national s

liaison organizations to advance drafts to the next formal stage of development

 Advancing the standard from one formal stage to another requires an international ba

each standards body, one vote per country

 With their votes, the national standards bodies submit comments on content, sugges

improvement, and explanations for no votes

 When a standard successfully advances through all required stages, it is published as 

standard
How and when did SC27 decide to develop ICT SCRM s

Timeframe Action

February 2009 • CS1 ICT SCRM Ad Hoc stood up, chaired by TMSN, driven by commercial in

• Current membership includes Cisco, Microsoft, EMC, Intel, SAFECode, Boeing, S• US SC7 TAG has been an active member in the CS1 ICT SCRM Ad Hoc since the 

expanding commercial and expert involvement to include IEEE and systems integ

February 2009 –November 2009

• ICT SCRM Ad Hoc reviewed and commented on ISO/IEC 27001, ISO/IEC 27002, 

27036 (old draft)

• Concluded that ICT SCRM required it’s own standard and developed proposal for 

standard for CS1 to consider

November 2009 November 2009 • US 

p p ro

posed ICT SCRM Standard at SC27 meetin

g , in Redmond, WA

• SC27 established ICT Supply Chain Security Study Period to validate need for a s• US Delegate (Booz Allen/DoD) is appointed Study Period Rapporteur

November 2009 – October 2010

• CS1 ICT SCRM Ad Hoc consolidated US contribution to the Study Period (contrib

October Microsoft, Mitre, and DoD) 2010 , , )

• Rapporteur briefed SC27 meeting in April 2010• UK and JP submitted short contributions• Study Period was extended to October 2010

October 2010 • Rapporteur presented Final Study Period report presented at SC27 meeting

• Information Security Forum ( Security Forum (ISF) presented proposal for a joint standard on Inform

ISF) presented proposal for

a joint standard on Inform

Relationships

• SC27 decided to restructure/expand current draft of ISO/IEC 27036 (Guidelin

Outsourcing) to address “Supplier Relationships” in 3 parts

• Rapporteur is nominated Part 3 Project Editor
Restructuring of ISO/IEC 27036 had broad support from 

international community

 Technical experts from a number of NBs and liaison organizations agreed that ISO/IEC 

restructured and that ICT SCRM had to be addressed

– Belgium

– Canada– France– Japan– Korea– L b uxem

bourg

– Malaysia– Russia– Singapore

– South Africa– Sweden– Switzerland– United Kingdom United Kingdom– US– ISF– ISACA
ISO/IEC 27036: Information technology – Security tech

I f ti S it f S li R l ti hi In

formation 

Security 

for 

Supplier 

R

elationships

 Covers information security in relationships between acquirers and suppliers to provide 

information security management for all parties including management of information s

these relationships.

 Applies to all types of organisations (e.g., commercial enterprises, public sector organis

organisations, and partnerships), specifies the information security requirements and gwith managing a supplier relationship (e g identifying and categorizing suppliers; agrewith managing

a supplier relationship (e.g., identifying and categorizing suppliers; agre

validating, and changing supplier arrangements; and exiting).

 Covers all types of supplier relationships, including outsourcing, product and service ac

computing including ICT and other types of supplier relationships (e.g. power supply, h

f )f ) acilities management) that have information security implications)

 Consists of four parts:

– Part 1 – Overview and Concepts (based on ISF proposal and prior ISO/IEC 27036), to introd

– Part 2 

– Common Requirements (based on ISF proposal, 27036), to provide requirements th

contracts

– Part 3 – Guidelines for ICT Supply Chain Security (based on study period outcomes), to a– Part 4 – Guidelines for Outsourcing (placeholder for the current text, remain at WD3 to deter

action)
Intended to point to other relevant standards and be de

coll b ti ith th t d d b di ll

a

boration with other s

tan

dar

ds 

b

odies

Relevant standards:

– Management Systems: ISO/IEC 27000 family; I Management Systems: ISO/IEC 27000 family; ISO 28000 Supply Chain Resiliency

28000, Supply Chain Resiliency

Service Management

– Risk Management: ISO 31000, ISO/IEC 27005, and ISO/IEC 16085

– Lifecycle Processes and Practices, software acquisition, and software assurance ISO

(systems), ISO/IEC/IEEE 12207 (software), IEEE 1062 (systems), ISO/IEC/IEEE 12207 (software), IEEE 1062 (software (software acquisition), ISO/IE

acquisition), ISO/IE

assurance)

– ISO TMB NWIP on Outsourcing

Coo

peration and liaison

– Information Security Forum (ISF)– SC7, Software and System Engineering– TC246, Project committee: Anti-counterfeiting tools– TC247 F d t d t l TC247, Frau

d countermeasures an

d controls

– TC8, Ships and marine technology– TC223, Societal Security

Filename/RPS Number 
Si t t i d Since res

truc

turing was approve

d

ISO/IEC 27036 Parts 1 and 2 editors restructured prior ISO/IEC 27036 text ISO/IEC 27036 Part 3 editor created an outline and preliminary draft based 

Study Period outputs

ISF released their document to ISO to serve as a contribution towards the s

ISF released their document to ISO to serve as

a contribution towards the s

SC27 distributed Preliminary drafts for Parts 1 and 3 to the National Bodies 

comment 

CS1 ICT SCRM Ad Hoc reviewed and commented on Parts 1 and 3 and pro

comments to CS1 for inclusion into the US national position for the Spring 2

Filename/RPS Number 
N t St ex eps

Before April 2011

– CS1 will review CS1 ICT SCRM Ad Hoc contributions revise and include 

CS1 will review CS1 ICT SCRM Ad Hoc contributions, revise, and include 

positions 

– CS1 will send USNB positions to SC27 Secretariat

B d A il 2011 ti Beyond April 2011 meetings

– CS1 ICT SCRM Ad Hoc will continue contributing to ISO/IEC 27002, ISO/

other relevant standards

– ISO/ C 036 go t oug SO de e op e t p ocess stages t a a 

IEC 27036 will go through ISO development process stages with an a

finalizing and publishing by May 2013

Stay tuned for further updates

Filename/RPS Number 
Nadya Bartol

Senior Associate

Booz Allen Hamilton Inc.

One Preserve Parkway

Rockville, MD 20852

Tel (301) 922 (301) 922-9537

bartol_nadya@bah.com