What Is ISO 17799?

ISO 17799 is an outdated standard for information security adopted by the International Organization for Standardization (ISO) in 2000. The code of practice, derived from the British Standard known as BS7799, outlined best practices regarding the confidentiality, integrity and availability of information within an organization. Officially known as ISO/IEC 17799, the standard was intended to guide information management personnel in charge of establishing security systems. Topics addressed included defining information security terms, classifying information types, outlining minimum requirements, and suggesting appropriate responses to breaches in security.

By 2005, advances in technology necessitated revisions to ISO 17799 to align with then-current practices and capabilities. It is common practice of the ISO to revise standards every few years to ensure guidelines, codes of practice, and standards are relevant and reflect current technologies and international business philosophies. As a result of the 2005 revisions, ISO 17799 became known as ISO/IEC 17799:2005. To help differentiate between various incarnations of ISO 17799, the original standard became known as ISO/IEC 17799:2000.

In 2007, the ISO and the International Electrotechnical Commission (IEC) renumbered the ISO 17799 standard, labeling it as ISO/IEC 27002. Often referenced as the ISMS Family of Standards, the ISO 27000 series deals entirely with Information Security Management Systems, or ISMS. Renumbering ISO 17799 allowed ISO/IEC officials to group future security standards into one category of guidelines for easy reference. Few changes to the standard occurred in 2007, as the choice to renumber such standards was purely an administrative change to accommodate anticipated future needs.

From the beginning, ISO 17799 dealt with matters such as security policies, control of access, defining types of information, development of information systems, and risk assessment. Organizational leaders could use ISO 17799 as a guide for developing information systems and ensuring the security of such systems. Additional guidelines regarding acquisition of existing systems, as typically occurs during business mergers, outlined steps to maintain information security without limiting access to key personnel. Recommendations for developing security practices as well as handling instances of security breaches were also included in the first ISO 17799.

Originally, the complete ISO 17799 standard included eleven topic-specific sections. Those sections included security policy, organization of information security, asset management, human resources security, physical and environmental security, communications and operations management, access control, information systems acquisition, incident management, business continuity management, and compliance. ISO/IEC 27002 included an additional topic section, just after the introductory sections, that covered risk assessment exclusively. All other topic-specific sections remained intact, but included relevant updates and revisions.