A good reference site is:
http://www.iso27001security.com/html/iso27000.html
On Nov 10, 2005, at 12:05 AM, Oud, Ernst (NL - Amstelveen) wrote:
John, All,
There is NO such thing as ISO 17799 certification. This can never
be possible since this standards is a guidance document, not a
specfication. Certification of an ISMS is always against ISO
27001:2005 (previously BS7799-2:2002 until October 18th).
Regards,
Ernst J. Oud
Deloitte
From: john_blackley@dell.com [mailto:john_blackley@dell.com]
Sent: Tue 11/8/2005 20:17
To: security-management@securityfocus.com
Subject: Re: ISO Certification
I wasn't aware that there is such a thing as an 'ISO17799'
certification. I'm happy to look into it.
ISO17799 is a code of practice for information security. BS7799:2
is a standard specification for information security management
systems (ISMS).
You CAN achieve certification against BS7799:2. In order to be
awarded a certificate, a BS7799 assessor will audit the ISMS. The
assessor cannot also be a consultant. There are very strict rules
about this. The assessor will work for a Certification Body (such
as Det Norske Veritas and BSI Assessment Services Limited).
Hope this helps.
John
----------------------------------------------------------------------
----------
This e-mail message and its attachments are subject to the
disclaimer published at the following website of Deloitte :
http://www.deloitte.com/nl/disclaimer
-- This communication is confidential to the parties it is intended
to serve --
Security Posture securityposture.com tel/fax
University of New Haven unhca.com 925-454-0171
Fred Cohen & Associates all.net 572 Leona Drive
Security Management Partners policygeeks.com Livermore, CA 94550
