RE: ISO Certification

John, All,
 
There is NO such thing as ISO 17799 certification. This can never be possible 
since this standards is a guidance document, not a specfication. Certification 
of an ISMS is always against ISO 27001:2005 (previously BS7799-2:2002 until 
October 18th).
 
Regards,

Ernst J. Oud
Deloitte

________________________________

From: john_blackley@dell.com [mailto:john_blackley@dell.com]
Sent: Tue 11/8/2005 20:17
To: security-management@securityfocus.com
Subject: Re: ISO Certification



I wasn't aware that there is such a thing as an 'ISO17799' certification. I'm 
happy to look into it.

ISO17799 is a code of practice for information security. BS7799:2 is a standard 
specification for information security management systems (ISMS).

You CAN achieve certification against BS7799:2. In order to be awarded a 
certificate, a BS7799 assessor will audit the ISMS. The assessor cannot also be 
a consultant. There are very strict rules about this. The assessor will work 
for a Certification Body (such as Det Norske Veritas and BSI Assessment 
Services Limited).

Hope this helps.

John




--------------------------------------------------------------------------------
This e-mail message and its attachments are subject to the disclaimer published 
at the following website of Deloitte : 
http://www.deloitte.com/nl/disclaimer