Internet Security Alliance, ANSI Offer Improved Information Security

June 6, 2007 // Published as a news service by IHS

Information Security Package 27001 is a two-document resource that helps companies implement globally-recognized security management practices into contract-based business operations. The publication complements Information Security Package 17799, released in 2006.

"One of the core problems with creating a global system of Internet security is that domestic efforts are inherently limited," said Bob Feghali, vice president and chief information officer (CIO) at ANSI.

"We can transcend political boundaries and use the market to motivate improved security by relying on standards that have international agreement and domestic acceptance."

Information Security Package 27001 includes:

• INCITS/ISO/IEC 27001:2005 - Information technology - Security techniques - Information security management systems - Requirements. This is an international standard addressing information security controls within the context of an organization's overall business risks.
• Contracting for Information Security in Commercial Transactions Volume II: Model Contract Terms for ISO/IEC 27001 Information Security Management Services. This is an ISA booklet which guides the implementation of INCITS/ISO/IEC 27001 into contract-intensive relationships.

"Business networks are only as safe as their commercial partners," said ISA president Larry Clinton. "This resource gives corporations the vehicle to protect themselves from careless contractors and cyber criminals alike by making it easy and cost-effective to adapt to the most current information security standards. Using this publication will also save companies the time, legal costs and hassle of negotiating contract terms one by one."

The language featured in ISA's booklet embodies cyber security standards endorsed by the 9/11 Commission and implementation requirements in U.S. Senate Bill S.4. The booklet's private sector approach relies on the self-interest of companies in assuring their data is secure; legislation depends on a yet to be determined federal certification program.

Source: American National Standards Institute (ANSI).