Re: diff btw BD 7799, ISF Security Standard, ITIL and others..

I make extensive use of the ISF Standard of Good Practice (SoGP), which is 
excellent. I have found that the SoGP is a much more practical standard 
than the BS or ISO frameworks (which, technically are not 'standards'). 
The SoGP also has much more breadth and depth of practical information 
than the more 'academic' BS/ISO frameworks. The ISF Standard is also free, 
whereas the others are not.
I also like ITIL; ISF and ITIL are quite complementary, actually. Both 
strongly enforce business ownership of information and risk. Both are very 
practical. ITIL addresses service excellence through IT operations, with 
security elements present for operations management. ISF focuses on the 
status of controls across multiple areas driving by business risk analysis 
and best practices.
The ISF is about to release its 2005 updated edition of the Standard of 
Good Practice; I'd encourage you to wait a few weeks for that release in 
order to get the most up-to-date information.
Of course, actually joining the ISF as a full Member brings a wealth of 
additional advantages. I get great value from their research reports, 
workshops, conferences, and other resources. It's a terrific value for the 
money.
-- Alan
"The views expressed here are mine and do not reflect the official opinion 
of my employer or the organization through which the Internet was 
accessed."