ISO/IEC 27001:2013(E)
iii
Contents Page
Foreword.........................................................................................................................................................................................................................................
ͳ
0 Introduction
................................................................................................................................................................................................................
͵
1 Scope
..................................................................................................................................................................................................................................
ͷ
2 Normative references
.......................................................................................................................................................................................
ͷ
3 Terms anddefinitions
......................................................................................................................................................................................ͷ
4 Context of the organization
........................................................................................................................................................................ͷ
4.1 Understanding the organization and its context........................................................................................................5
4.2 Understanding the needs and expectations of interested parties
...............................................................5
4.3 Determining the scope of the information security management system
...........................................5
4.4 Information security management system......................................................................................................................7
5 Leadership
...................................................................................................................................................................................................................7
5.1 Leadership and commitment......................................................................................................................................................7
5.2 Policy................................................................................................................................................................................................................7
5.3 Organizational roles, responsibilities and authorities
..........................................................................................9
6 Planning
..........................................................................................................................................................................................................................9
6.1 Actions to address risks and opportunities....................................................................................................................9
6.2 Information security objectives and planning to achieve them....................................................................13
7 Support
............................................................................................................................................................................................................................13
7.1 Resources
......................................................................................................................................................................................................13
7.2 Competence................................................................................................................................................................................................13
7.3 Awareness....................................................................................................................................................................................................13
7.4 Communication
.......................................................................................................................................................................................15
7.5 Documented information................................................................................................................................................................15
8 Operation
......................................................................................................................................................................................................................17
8.1 Operational planning and control...........................................................................................................................................17
8.2 Information security risk assessment.................................................................................................................................17
8.3 Information security risk treatment
.....................................................................................................................................17
9 Performance evaluation
................................................................................................................................................................................17
9.1 Monitoring, measurement, analysis and evaluation.......... ......................................................................................17
9.2 Internal audit.............................................................................................................................................................................................19
9.3 Management review............................................................................................................................................................................19
10 Improvement
.............................................................................................................................................................................................................21
10.1 Nonconformity and corrective action..................................................................................................................................21
10.2 Continual improvement...................................................................................................................................................................21
AnnexA (normative) Reference control objectives and controls
.........................................................................................23
Bibliography
..............................................................................................................................................................................................................................49
时代新威ISO/IEC 27001：2013集中培训研讨会学习资料，仅供内部培训学习使用。
