Wotsnew

This Website is updated frequently, every few days at least. Hover your mouse cursor over the and icons throughout the site to see when the most recent updates were made. We normally remove the icons after about a month so please revisit every month or check the history of changes below to see what you’ve missed:

September 2010: published a French version of the ISO27k ISMS implementation and certification process diagram (merci cher Chistophe Bregeras pour le traduction!).
August 2010: updated the Mehari description in the ISO27k FAQ. Added a note to the ISO27k Forum etiquette page about Out-Of-Office emails. Noted the NIST infosec glosssary under other standards. Referenced some useful threat catalogs in the FAQ, and added the BITS spreadsheet to the list of risk analysis methods. I’ve just discovered that network security standard ISO/IEC 27033-1 was in fact published at the end of 2009 - how did I miss this? Released a PDF version of the ISO27k FAQ designed for easier printing and offline browsing. ISO/IEC 27031 on the IT parts of business continuity has reached FDIS stage and should hit the streets in 2010.
July 2010: the ISO27k Forum welcomed its 2,000^th member. Updated the forum tips re providing the context when posing questions. The number of ISO/IEC 27001 certificates has passed 6,500. Added more visitor feedback from our survey.
June 2010: added an FAQ&A about the differences between audit and risk assessment. Launched an ISO27k Forum project to identify and address information security risk and control issues that are relatively weak or, in some cases, completely missing from ISO/IEC 27002.
May 2010: this website reached its fifth birthday! Updated the following pages with information from the SC27 meeting in Malaysia at the end of April: ISO/IEC 27000, 27001, 27002, 27005, 27006, 27008, 27010, 27014, 27037 and other ISO27k standards. Provided website visitor and page statistics for our commercial advertisers and sponsors. Expanded the FAQ section on LA and LI qualifications and more CMS/DMS options. The number of ISO27001 certificates issued passed 6,400 this month.
April 2010: fixed all the broken links on the ISO27k Toolkit page [raspberries to NetObjects Fusion for yet again breaking them]. Minor status update re the network security standard ISO/IEC 27033-3. ISO/IEC 27001 may need a restructure to align all the management standards. Minor status updates to various ISO27k pages including 27000, 27005, 27008, 27013 and 27014, based on info released for the forthcoming SC27 meeting in Malaysia next month. Updated ISO/IEC 27031 following the “pass” vote on the FCD. ISO/IEC 31010 on risk assessment has been published. Added the Verinice ISMS support tool to the FAQ. Updated the visitor feedback piechart and comments. ISO27001 certificates passed 6,300 last month.
March 2010: ISO27k Toolkit updated to version 3.9 with an awareness presentation (and we subsequently fixed some broken hyperlinks in the overview document). The ISO27k Forum now has 1,900 members! Added a snippet of news on ISO/IEC 27007. Published a more detailed review of the ITIL v3 security book. Published a Croatian version of the ISO27k implementation and certification process overview diagram, thanks to Juraj Ljubesic, and a Polish version thanks to Robert Plawiak.
February 2010: new Q&A about preparing for recertification audits. Added yet more risk management products to the FAQ. ISO/IEC 27003 has been published.
January 2010: re-sequenced the ISO27k FAQ a bit more logically. Added yet more products to the bottomless pit of ISMS support tools in the FAQ. Answered FAQs about compliance obligations and scoping the ISMS. Started accepting commercial sponsorship and advertisements to help cover our mounting costs - modified the contact us, disclaimer and privacy policy pages accordingly. Updated info drawing on the Committee Drafts of ISO/IEC 27032 (cybersecurity) and ISO/IEC 27034 (application security). Added ISO 19011 to the other standards page. Not sure how I missed it. Note on 27005 about fast-track update. Added info about the IT Grundschutz IT baseline protection manual from Germany to the other standards page. Removed free links to product vendors from the ISO27k FAQ: however vendors are very welcome to sponsor a link and help support this website!
December 2009: further updates to various ISO27k pages following the SC27 meeting last month. The number of 27001 certificates has passed 5,900, and the ISO27k Forum now has over 1,800 members. ISO/IEC 27004 on metrics has been published. Answered an FAQ about how many man-years it takes to implement an ISMS. Published a document mapping PCI-DSS controls to ISO/IEC 27001 Annex A controls (thanks Mohan). Updated the title of ISO/IEC 27031 from the FCD. Noted the imminent release of a revised and ISO27k-aligned ITIL v3 security book.
November 2009: minor updates to the status of various ISO27k standards, drawn from the agenda for the SC27 meeting this month in Redmond. Added yet more advice to the FAQ section on choosing risk analysis methods/tools.
October 2009: after a discussion on the ISO27k Forum, relaxed the criteria for forum membership to welcome on board information security pros who are at the very earliest stages or are perhaps merely considering implementation. Also published a selection of the kind and insightful comments received from Forum members during that discussion. Added a Q&A re policy length.
September 2009: cited two NISTIR papers. Outlined the certification auditor’s interest in ISMS internal audits in the FAQ. Updated the ISO27k Toolkit with additional papers on classification kindly contributed by Mohan Kamat. Added yet more CMS and risk management systems to the ISO27k FAQ. The ISO27k Forum has over 1,700 members. Linked to an IBM paper on the business value of information security (thanks John). Expanded on the FAQ about involving the whole organization. Updated the feedback page.
August 2009: added a Guideline on people asset valuation and Roles and responsibilities for information asset management to the ISO27k Toolkit page, thanks to Mohan Kamat. Updated the page on ISO/IEC 27003 to reflect the FDIS version. Updated the history of ISO/IEC 27002 and BS7799. Reviewed a book on implementing an ISMS in a Windows environment. Updated the list of NIST SP800 standards. Started an FAQ on ISMS content management systems (we will be adding more product links over the next few weeks) and another FAQ on ISO27k conformance vs compliance vs certification. Hyperlinked the FAQ contents list.
July 2009: updated the PDF version of the ISO27k FAQ for those who would rather print it out to contemplate in the “little room”. Added a Q&A to the FAQ about ISMS metrics. Purged broken links throughout the site [if you find any more, do let us know]. Noted an ISMS implementation guidebook by Ted Humphreys. Update on the new ISO27k standard on outsourcing - ISO/IEC 27036 - and on part one of the network security standard ISO/IEC 27033. Added a new white paper - a case study on implementing an ISMS using PMBOK (thanks David). NIST SP800-53 rev C was released at the end of the month and is well worth a look by all ISO27k users.
June 2009: the ISO27k Forum has amassed a community of over 1,600 members! Updated the ISO27k Toolkit to version 3.7 with additional content from Richard and Thomas. Over 5,600 organizations have been certified to ISO/IEC 27001. Added advice on preparing the Risk Treatment Plan to the FAQ. Noted another ISO27k implementation guidance book.
May 2009: added chaRMe information security risk management support tool to the list in the FAQ. Provided info on ISO/IEC 27037. Corrected the description of the Proteus tool. Updated several ISO27k pages following the SC27 meeting in Beijing. Updated the FAQ with info on Lead Auditor and Lead Implementor ‘qualifications’ (short training courses really). ISO/IEC 27000 has been released, and it’s free of charge!
April 2009: ISO/IEC 27011 was published by ISO/IEC in 2008 after all, despite searches on the ISO site initially coming up empty (was fixed after we reported it). The final comments on ISO/IEC 27000 have been addressed so that one is finally about ready to roll. Hundreds of pages of comments on ISO/IEC 27003 and 27004 do not bode well for either standard, especially as these had both progressed to FCD stage. Welcomed our 1,500^th member to the ISO27k Forum. The next SC27 meeting in Beijing is rapidly approaching. Added another view of the certification process to the ISO27k Toolkit (thanks Howard). Added an FAQ comparing the PCI-DSS checklist approach to ISO27k. Updated the ISO/IEC 27003 page with info from the FCD. Corrected the title of ISO/IEC 27011. New project approved for ISO/IEC 27036 (outsourcing). The ISO/IEC secretariat has been referring to ISO/IEC 27009, not ISO/IEC 27013 as previously advised, for the proposed ISMS/ITIL combined management system standard.
March 2009: updated the ISMS metrics examples paper and released version 3.5 of the toolkit. Minor updates to the online ISO27k FAQ but more significant updates to the PDF version. Added a link to a SecureAware demo by Neupart, plus a link to Meycor KP. Updated the website visitor survey results (further feedback is always welcome!).
February 2009: added stochastic techniques, Risk IT, ISO/IEC Guide 73 and a British generic risk management standard to the information security risk analysis methods listed in the FAQ. We’re fast approaching 60 methods! Added a section on ISMS auditing to the FAQ, and another Q&A about limiting the ISMS scope to IT. Changed to an off-site link for the website user survey in an attempt to speed up the dreadfully slow page loading. Added links to BERR’s descriptions of most sections of ISO/IEC 27002. Repeated questions up front in the FAQ quick links section. Noted Brian Honan’s new book on implementing ISO27001 under Windows. Updated the page for ISO/IEC 27032 on cybersecurity.
January 2009 (a busy month!): noted IIA’s GAIT-R risk analysis method in the FAQ and other standards pages. Updated the website visitor feedback. Added pragmatic implementation tips throughout the FAQ. According to a diagram from SC27/WG1 convenor Ted Humphreys, the infosec governance standard will become ’27014 not ’27009 as we originally thought. The ISMS guideline for financial services will probably be ’27015 and the ITIL/ISMS guideline will be ’27013. [Please don’t shoot the messenger for these changes! It’s a drawback of trying bringing you preliminary information as early as possible, perhaps too early sometimes.] Added a Google search box to the home page as requested. The number of ISO/IEC 27001 certified organizations passed 5,190 at the end of 2008! Added a paper detailing the ISMS documents mandated by ISO/IEC 27001 to the ISO27k Toolkit (thanks Osama). The 1^st CD of ISO/IEC 27035 on incident management has been issued in SC27 for comment. Added a new Q&A to the FAQ about mandatory controls. Updated the process diagrams in the ISO27k Toolkit (thanks again Osama!). Added Delphi to the risk analysis methods in the FAQ. Added a begging page to solicit donations towards our costs incurred in maintaining this site.
December 2008: updated the ISO/IEC 27033 page following release of the FCD of 27033 Part 1. Noted ISO/PAS 22399 standard on incident preparedness and operational continuity management on the other standards page. Added another 18 risk management and GRC products to the ISO27k FAQ (thanks to Hakimuddin Gheewala!). Noted release of BS 10008 on protecting electronic forensic evidence. The number of ISO/IEC 27001 certified organizations passed 4,987 at the end of November. Listed two more BSI ISO27k guidelines.
November 2008: further information emerged from the Cyprus meeting. Added new pages for ISO/IEC 27009, 27012 and 27013 and updated anticipated publication dates etc. for other ISO27k standards.
October 2008: published the remaining ISO27k implementation case studies by Stiki. PCI DSS has been updated. Added OCTAVE Allegro to the list of risk analysis methods in the ISO27k FAQ. Suggested that new members to the ISO27k Forum might scan the archives and FAQ to avoid repeating common questions. Explained step 14 of the ISO/IEC 27001 certification process. [The FAQ needs sorting out - one day]. Published a revised mind-map summarizing ISO/IEC 27002. The number of ISO/IEC 27001 certified organizations hit 4,848 at the end of September. Made various updates following the Cyprus meeting of SC27 earlier this month, including a new page for ISO/IEC 27012. Moved the website visitor feedback page underneath the visitor survey. Added a new page for ISO/IEC 27035. Described the structure of ISO/IEC 27001. Linked to a CD of STIGs and associated checklists etc., ideal for developing corporate technical security standards. Added info about ISO TR 13569.
September 2008: added a neat tag line about the ISO27k Forum (“where every contribution is treasured and every member valued”) courtesy of two Forum members celebrating their ISO/IEC 27001 certification (well done Richard and Dr Hasan!). Added advice to the FAQ on desirable characteristics of an ISM/CISO (thanks Wawet). Refined the rules for the ISO27k Forum to mention copyright compliance. Added a Q&A with advice to ISMS implementation project managers to the FAQ (thanks Nathan), and noted vsRisk and RA2 risk analysis software. Linked to deux livres blanc on ISO27k topics (merci bcp Gérôme!). Added a Delicious bookmarklet to the home page. Published three Stiki case studies concerning ISO27k implementations. Added another Q&A to the FAQ, this one on documenting your ISMS. Added a new page to share website visitor feedback from the survey. Have you had your say yet?
August 2008: added info on ISO/PAS 28000 on supply chain security. Referenced FMEA in the ISO27k FAQ and added an FMEA spreadsheet to the ISO27k Toolkit (thanks Bala). ISO 27799 was released in June (don’t know how we missed it!). The 2^nd draft ISO/IEC 27034 on application security has a slightly revised title. 2^nd drafts of ISO/IEC 27007 on ISMS auditing and ISO/IEC 27031 on business continuity have been released to JTC1/SC27 members for comment. Added yet more risk analysis methods and tools to the FAQ. Repaired a broken link in the toolkit and gave NetObjects Fusion a stern ticking-off. Some 4,700 ISO/IEC 27001 certificates have been awarded, reversing a slight dip in the graph compared to the normal trend. Published the whole ISO27k Toolkit as a single ZIP file for easier downloading. Published the whole ISO27k FAQ as a PDF for easier printing. Linked to the pre-release info on PCI DSS v1.2 under other standards (thanks Anton) and to SOMAP’s risk analysis method in the ISO27k FAQ (thanks Adrian). Started using Google Analytics to find out which parts of the site are the most popular. Added a survey to gather feedback from our website visitors.
July 2008: we’ve moved office so altered the address in the privacy policy. Added an information classification guideline to the ISO27k Toolkit (thanks Michael). NIST SP800-55 Revision 1 on information security metrics released. Added a paper describing roles and responsibilities for contingency planning to the ISO27k Toolkit (thanks Larry).
June 2008: updates on the other standards page outlining the latest 2008 versions of ISO/IEC 12207, 15288 and 38500 (thanks Nigel!). Update re FCD voting on ISO/IEC 27000 by September. Added an FAQ section on information vs IT security. Added information on the multi-part network security standard 27033 and ISMS implementation guideline 27003. Added brief mentions of FRAP, FAIR and COBIT to the risk assessment section of the FAQ. ISO/IEC 27005 released.
May 2008: altered the page layouts. The design is still not quite right but will just have to do for now. Substantially updated the ISO/IEC 27033 page with information on the existing ISO/IEC 18028 standard from which 27033 will be derived. Added ISO 38500 IT governance standard to the other standards page. Summarized and commented on the FDIS of ISO 27799. Updated the ISO27k Toolkit overview and contents to 3v1. Updated most page descriptions to match the contents (doh!). Added info on accreditation bodies and accredited ISO/IEC 27001 certification bodies to the FAQ.
April 2008: created a separate page for the ISO27k Toolkit, moving the contents over from the white papers page. Added an ISMS high-level policy and scope examples to the toolkit. Noted the draft ISO 31000 and 31010 risk management standards plus Guide 73 under other standards. Added “DIS” to the ISO/IEC acronyms listed in the FAQ. Linked to 2 new NIST SP800 drafts. Updated numerous ISO27k pages and added new pages for ISO/IEC TR 27008 and ISO/IEC 27010 following the SC27 meeting in Kyoto this month Also updated the other ISO27k standards page with preliminary information on proposed work items. By the end of April, 4,489 organizations were certified against 27001.

March 2008: published release 1 of our ISMS Audit Guideline. Moved and extended information on the ISO27k Forum from the FAQ to a dedicated page. Added notes about the study group looking into a new standard for ISMS technical audits, and ISACA’s exposure draft guideline. Expanded the FAQ item on ISO/IEC acronyms and committee names. Outlined the new ICT DR standard ISO/IEC 24762 to the other standards page, with a link from ISO/IEC 27031. Expanded the ISO/IEC 27005 page with an outline of risk analysis methods worth considering. Linked to the California State guidance on implementing ISO/IEC 27002. Reviewed an incident management book from BSI.
February 2008: published our infosec glossary. Increased the page width across the entire site to make better use of typical LCD screen sizes. Fixed a handful of broken links. Invited visitors to get involved in the project working to develop ISMS audit guidelines. Tidied up some links.
January 2008: expanded advice on security policies and sorted the list of risk analysis methods in the ISO27k FAQ. Published a pair of papers: a case study and business case for ISO27k. Updated the pages on ISO/IEC 27031, 27032 and 27034.
December 2007: uploaded examples of information security metrics aligned with ISO/IEC 27002 from an ISACA workshop. Linked to an ISO survey (thanks Javed). Fixed a handful of broken links. Noted good progress on ISO/IEC 27000. 4,140 organizations were 27001 certified by the start of December 2007. Clarified the SoA and RTP descriptions in the ISMS implementation process outlined in the FAQ. Uploaded a white paper listing the top information security threats, vulnerabilities and impacts, along with risk scenarios and suggested controls.
November 2007: added Microsoft’s security risk management guide to the list of risk analysis methods referenced in the ISO27k FAQ (thanks Javier). Also referenced NIST SP 800-39. Updated the status of standards up to ISO/IEC 27011. Updated the ISMS documents checklist. Uploaded a laptop security policy sample. Minor updates on most of the ISO27k standards pages following feedback from the JTC1/SC27 meeting in Lucerne last month. Published a Spanish version of the ISO/IEC 27002 implementation guidance and metrics paper, along with an updated English version with fixed hyperlinks, and BS 25999-2 has been released (thanks again Javier). Added a bunch of links.
October 2007: published an infosec risk analysis spreadsheet, a router security checklist aligned with ISO27k and a revised information asset inventory doc. We’ve heard that part 2 of the business continuity standard BS 25999 is due to be published early in November (thanks Rob). Added more standards and info to the other standards page, drawing on an excellent summary of security standards in the APEC-TEL handbook. Published a risk register template (thanks Madhukar).
September 2007: updated the ISO/IEC 27000 page to reflect the current status of this document (i.e. the second Committee Draft). Similarly for ISO/IEC 27005 (second Final Committee Draft). Added a question and answer about getting hold of and contributing to draft standards to the FAQ. Added a page for our growing collection of ISO27k white papers, including a new generic checklist of ISMS documents. Started adding sample ISMS documents too. Updated the ISO/IEC 27033 page a little. Uploaded an annotated presentation on infosec frameworks (thanks Rob). Published a Visio version of the Corrective Action Procedure, then an example ISMS internal audit procedure (thanks Richard) and a document outlining a typical information security management function and key roles. Added a brief note to ISO/IEC 27000 (this one will probably be free of charge!) and 27011 (progressing relatively quickly). The ISO/IEC 27001 certificate count passed 4,000 (4,036 in fact) by the end of September.
August 2007: clarified history by retracing the origins of ISO/IEC 27002. Made page titles a bit more descriptive. Noted BSI DISC PD003, ISO27k’s progenitor, and a rumoured predecessor from NCC. Published a graph showing growth in ISO/IEC 27001 certificates issued over the last two years. Updated the other standards page with more information on ISO 9000 and PCI DSS. Added info on ISO/IEC 18028. Added more info on accredited ISMS certification bodies to the FAQ. Some 3,879 organizations have been ’27001 certified by the end of August.
July 2007: noted ISO 31000 (draft) guidance on risk management in the FAQ. Revised the site map to describe each page in a few words or less. Started spartan pages for ISO/IEC 27032 and ISO/IEC 27034. Published ISO/IEC’s confirmation of the name change for ISO/IEC 17799:2005 becoming 27002:2005, and a press release on the same subject. It has been proposed that ISO/IEC 18028 be renamed ISO/IEC 27033. The telecomms implementation guide will be ISO/IEC 27011. Noted BSI’s release of BS25999-2 in draft for comments this month. The number of ISO/IEC 27001-certified organizations reached 3,781 at the end of July.
June 2007: updated the FAQ with advice on creating an inventory of information assets based on a contribution to the forum by FF Ramos (thanks Fabio!). Updated references from ISO/IEC 17799 to ISO/IEC 27002 following the renaming by ISO/IEC. ISO/IEC 27001 certifications passed 3,600 in May. Added a link to Proteus Enterprise security risk management software to the FAQ. Added a little to the explanation of ISO/IEC JTC1 SC27 in the FAQ. Noted that ISO/IEC 27031 is to be a business continuity standard, not telecomms implementation guidance (we don’t now know what the latter standard’s number will be). Added a link to NFPA 1600 emergency management and BCP standard on other standards. Having been (rightly) pulled up elsewhere for not using the full names, added the IEC part to many of the ISO/IEC standards listed on this site. Published version 1 of the ISO/IEC 27001/2 implementation guidance and metrics paper (later revised).
May 2007: ISO/IEC 27006 was published by ISO/IEC in Feb (don’t know how I missed it). ISO/IEC 27001 certifications have passed 3,500 and the ISO27k Forum has over 500 members. Added a link to a useful ISO27k implementation guide/manual from Australia.
April 2007: added a disclaimer regarding our (non-)relationship to ISO/IEC. Updated information on X.1051 / ISO/IEC 27011 (thanks Benjamin). Published a flow chart diagram of a generic ISO/IEC 27001/2 implementation and certification process, and some more detailed explanation in the FAQ. Updated the risk analysis FAQ section to mention the Australia/New Zealand risk management standard 4360. Like expectant parents, we’re anxiously awaiting official news of the renaming of ISO/IEC 17799 to ISO/IEC 27002 ...
March 2007: made a couple of updates to the FAQ including an outline of ISO/IEC committee JTC1/SC27’s 5 working groups and a section on risk analysis. Set up separate pages for ISO/IEC 27031, the telecomms industry ISO/IEC 27002 implementation guidance, and ISO 27799, the health industry’s equivalent. Uploaded a mind map summarizing ISO/IEC 27002. The Xisec ISMS International User Group site is evidently being redeveloped so we’ve suspended the link for now at least.
February 2007: it turns out that ISO/IEC 27007 is the number for a proposed ISMS auditing guideline, not a DCP standard as we originally guessed (sorry!). ISO/IEC 17799 is due to become ISO/IEC 27002 this April. Made a slight update to the description of risk management standard ISO/IEC 27005, thanks a presentation to ISACA by Peter Weiss. Noted ISO 27799, a healthcare industry implementation guide for ISO/IEC 27002 (published in June 2008). The count of ISO/IEC 27001 certified organizations has passed 3,300. The ITU has revised its ISO/IEC 17799 implementation guidelines.
January 2007: fixed a few broken links. For the record, 3,246 organizations were certified ISO/IEC 27001 compliant at the start of 2007. ANSI is selling PDFs of ISO/IEC 27001 and ISO/IEC 27002 for just US$30 each! Linked to a useful ITCi cross-reference matrix. Removed reference to the BSI booklets by Ted Humphreys as they are nowhere to be seen on BSI-Global :-( Referenced a hard disk encryption standard in preparation: IEEE 1619.
December 2006: continued building the FAQ with more advice on starting an ISO/IEC 27001/2 implementation. More questions and (especially) more answers are always welcome. Corrected our office address. Fixed various broken links. Added ITU to the other standards page with a note about X.1051.
November 2006: NIST has released the final version of Special Publication SP 800-100, their information security handbook. Corrected links to the register of ISO/IEC 27001 certificates. Added a Q&A about getting started on ISO/IEC 27001 implementation to the FAQ.
October 2006: revised the description of ISO 27006 which it turns out will not be a disaster recovery standard but will offer guidance to accredited ISMS certification bodies (thanks for the update Javier). Updated the other ISO 27000-series pages with information from SC27. Revised the privacy policy since we are not using other CISSPs to administer the forum after all. Linked to a Canadian ISO 17799 user group meeting in Toronto. Tweaked site design and added a simple logo (any graphic artists reading this who can do better are invited to contribute!). Referenced PAS77, a new IT service continuity management standard, and BS 25999-1 that will soon replace PAS56. Finally got around to referencing two guidebooks on ISO/IEC 27001 published last year by BSI. ISO/IEC 27001 certifications have now passed the 3,000 mark! Updated the NIST Special Publications list.
September 2006: tidied-up the index on the ISO/IEC 27002 page. Referenced records management standard ISO 15489 and sorted the ISO standards on the other standards page.
August 2006: answered another FAQ re what happens during the certification process itself. Redesigned the home page.
July 2006: announced the release of ISO 18043 covering IDS. Set up the discussion forum (email reflector, newsgroup) on Google Groups for those with a professional interest in implementing the standards. Extensively revised the FAQ and links pages to list many more sources of information and guidance on ISO/IEC 27001/2. Added a graphical site map. Published a privacy policy. Outlined certification and accreditation in the FAQ (twice). Noted NIST/NSA/DISA’s invaluable STIGs on the other standards page. Caved-in to demand by publishing guideline prices for some ISO27k standards in the FAQ. Added a page of book reviews. Added some more NIST Special Publications under other standards and quick links to navigate the same page. ISO/IEC 27004 is in circulation as a Working Draft.
June 2006: provided more information re ISO TR 18044 on security incident management. Added ‘quick links’ contents list to the FAQ. Updated links to BSI metrics booklets.
May 2006: linked to the Australian Government Information and Communications Technology Security Manual. Updated the other standards page re NIST Special Publications and referenced a new BSI security metrics booklet on the links page.
April 2006: NIST FIPS 200 has been released - now listed on the other standards page. Linked to an ISACA paper about the things to do post-certification. Added links to ISM³ and NIST SP 800-55 on the other standards page. Made minor updates to ISO/IEC 27000, 27001, 27002, 27005 and 27006 pages following a BSI presentation to ISSA.
March 2006: updated the ISO/IEC 27002 / ISO/IEC 17799 / BS 7799 page to outline the content of the 2005 version. I do hope ISO will stick to a consistent name. Also updated the ISO/IEC 27006 page with a bit more info on SS507, the Singaporean standard for DR service providers, and an outline of the proposed ISO standard (thanks again Catalin!). Updated the ISO/IEC 27003 page with preliminary information on the implementation guide structure. Updated the ISO/IEC 27005 page to note the delayed release this month of BS 7799-3:2006. Linked to the excellent www.ISO27000.es for Spanish-speaking information security professionals.
February 2006: corrected NIST’s full name on the other standards page (thanks Jim). Answered a FAQ about keeping up with ISO27k news. Referenced a paper by Rebecca Herold. Noted delayed release of BS 7799-3. Updated info on ISO/IEC 27005 and ISO/IEC 27006, and noted use of TR 13335-3 and -4 for the former, and SS507 for the latter (thanks Catalin!).
January 2006: referenced PAS56 in other standards. The number of BS 7799 Part 2 / ISO/IEC 27001 certified organizations passed 2,000 around Christmas 2005!
December 2005: ISO 20000 (ITIL) and COBIT v4 were released this month - see the other standards page for links to more information. These are important standards supplementing the ISO27k series.
October 2005: ISO/IEC 27001 has been released a month earlier than we expected and refers to ISO/IEC 17799:2005 - various pages updated accordingly. Added an initial information page on ISO/IEC 27006, and a guide to ISO’s acronyms for standards passing through the process to the FAQ (thanks Guy Coulleit).
September 2005: added links on the other standards page to a whole bunch of NIST standards and the ISF Standard of Good Practice (free!).
August 2005: BS 7799 part 2 certifications have passed 1,700! Added some information on BS 7799 part 3 which is expected to become ISO/IEC 27005. Updated pages on BS 7799 part 2 (ISO/IEC 27001) and ISO/IEC 17799 (ISO/IEC 27002). Added “site last updated” field to the home page. Centered all pages.
July 2005: the FDIS draft of ISO/IEC 27001 was released. ISO/IEC 27000, 27003 and 27005 pages were updated (thanks for the info Steve).
June 2005: mentioned the release of the new 2005 version of ISO/IEC 17799. Noted Systems Security Engineering - Capability Maturity Model under the >other standards page. Restructured the site more logically and added breadcrumb trails and page descriptions. Published initial information about ISO/IEC 27003.
May 2005: domain registered, website built. Changes will be frequent, especially whilst the website is knocked into shape and then it will continue evolving as the ISO27k standards are developed. Call back often!

Live on the edge or bookmark and revisit this page from time to time to keep up with developments in the exciting and dynamic world of ISO27k.