A part of ISO (the International Standardization Organization) is developing a family of ISMS standards jointly with the International Electrotechnical Committee, the ISO/IEC 27000 series. These standards fall under the general title of “Information technology – Security techniques”: the 27000 series specifically addresses standards related to information security management systems (ISMS). There are presently three principal standards in this series: one defines a management standard, which sets out the requirements of an ISMS; another sets out a code of practice, with extensive guidance as to how implementers should select information security controls to be implemented within their ISMS. A third sets out the requirements for bodies which undertake the certification of ISMSs. These three standards are: ISO/IEC 27002 "Code of practice for information security management" ISO/IEC 27001 "Information security management systems - Requirements" ISO/IEC 27006 "Requirements For Bodies Providing Audit And Certification Of Information Security Management Systems" These three standards are based upon existing and proven practices which have been in use internationally since 1995. Today they are recognized globally as the de facto information security standards for businesses and governments alike. Additional standards in the ‘27000’ series support those cited above, one (ISO/IEC 27000) provides an overview of the family, and also defines the terms used within the 27000 family, so is a 'must buy' if investing in an ISMS. For more details on the organisation of ISO and the inter-relationships between the 2700x family of standards, click here.