रण ल सर ष एव ब य मद क ववषय सममत एल टई लए,17 2) इल तनक एव स चन र य ग क वव पररषद एल टई लएसए क रध न सद य

Transcription

1 य पक पर च लन मस द रलख रषण स ञ पन स द भ तकन क सममतत : एलआईट ड 17/ट - 81 स 106 एलआईट ड 17 -प न ददन क 31 अग त 2016 व ल क न म: 1) न रण ल सर ष एव ब य मद क ववषय सममत एल टई लए,17 3) गच रखन व ल 2) इल तनक एव स चन र य ग क वव पररषद एल टई लएसए क रध न सद य अ य मह दय(य ) क पय स ल नक म स ल न रलख क अवल कन कर : क पय इन मस द क अवल कन कर और अपनए स मत य, यह ब ह ए कक यदद यह र एय म नक रक म ह अमल करन म प क यवस य म य कद न टय सक ए ह, ज स मत य जन क अ त म त ग यदद क ट स मत र नह ह ए य स मत स प दक य रक त क ह ए ह क पय य अन म ह उपर मस द क मलए पक अन म दन म न लन क अन म ए द वप, यदद पक स मत क रक त कनएक ह यदद चयरमन ववषय सममत व र ऐस रहन व त ह इस क व यक क रभ व ट क मलए चयरमन ववषय सममत क प स पर म भ ह य ववषय सममत क प स अवल क भ करक अन म ककय ज ए यह मस द टटसए म नक क अन स र सब ध ह इस पर क स स ल न नह ह टटसए म नक क ब द मस द पर ववच र भ अवल कन ककय ज ए यदद टटसए म नक क स ई रत अपषष ह मल व र अन र ध ज ज ए यदद क ट स मत य क ऊपर तनममभ ह क पय अध ह षर क तन नमलखख प पर स ल न फ म ई म ज द

2 ध यव द, वद य, (र न भ) स ल नक : उपर रमख (इल तनक व ट ई ) ट मल: hlitd@bis.org.in, litd@bis.org.in टमलफ स:

3 र.स. 1 रलख स. एल टई लए 17(10651) 2 एल टई लए 17(10672) 3 एल टई लए 17(10673) 4 एल टई लए 17(10674) एल टई लए 17(10675) एल टई लए 17(10676) एल टई लए 17(10677) एल टई लए 17(10678) 9 एल टई लए 17(10679) 10 एल टई लए 17(10680) स ल नक श षक न र य ग क सर ष कनएक डल ईल रम ण क पहच न, स रहण एव स रषण ह दद तनद न र य ग क सर ष कनएक स इबर सर ष ह दद तनद न र य ग क सर ष कनएक अ ष रएय एव अ - स न मक स रषण क मलए न सर ष रब धन न र य ग क सर ष कनएक पए ट ट र ससर क प म प ललक ल उल ए ई अम यय न (पए ट ट) क सर ष र त स दह न र य ग क सर ष कनएक डलईर क मलए ट एस एम क ल स बध ए दद तनद ( न क ल पर क द ) सर ष न र य ग क सर ष कनएक अनग च स षप स न प यत य ( टलएपएएस) क चयन न ए एव रच लन न र ध ग क - सर ष कनएक - ल रण सर ष न र ध ग क - सर ष कनएक - न सर ष रब धन प यत य क डलईर एव रम णन उपललध कर न क मलए तनक य क अपष ए न र ध ग क - सर ष कनएक - ल उल सव ओ क न सर ष क ल क र त स दह न र ध ग क - सर ष कनएक नईवकभ सर ष 1 मस ह वल कन एव अवध रण ए

4 DRAFT IN WIDE CIRCULATION Technical Committee: LITD 17 Document Dispatch Advice Ref LITD17/T- 61 To 95 Date ADDRESSED TO: 1. All Members of Information Systems Security Sectional Committee, LITD All Principal Members of Electronics and Information Technology Division Council (LITDC) 3. All others interested Dear Madam/Sir(s), Please find enclosed draft Indian Standards give in Annex: Kindly examine these draft standards and forward your views stating any difficulties, which you are likely to experience in your business or profession, if this is finally adopted as National Standards. Last Date for comments: 30/09/2016 Comments if any, may please be made in the format indicated and mailed to the undersigned t the above address. In case no comments are received or comments received are of editorial nature. You will kindly permit us to presume your approval for the above document as finalized. However, in case of comments of technical in nature are received then it may be finalized either in consultation with the Chairman, Sectional Committee or referred to the Sectional committee for further necessary action if so desired by the Chairman, Sectional Committee. This document is identical with corresponding IEC Standard and is not attached with this letter. For considering comments on the document corresponding IEC Standard may be referred. In case of soft copy of IEC standard is required, a request may be sent by mail. Thanking you, Yours faithfully, (Reena Garg ) Head (Electronics & IT)

5 Annex Sl. No. Document No/IS No. Title 1 LTD 17/10651 /ISO : 2012 Information Guidelines for identification, collection, acquisition and preservation of digital evidence 2 LTD 17/10672 /ISO/IEC 27032: LTD 17/10673 /ISO/IEC : LTD 17/10674 /ISO/IEC : LTD 17/10675 /ISO/IEC TR : 6 LTD 17/10676 /ISO/IEC 27039:2015 Information technology Security techniques Guidelines for cyber security Information technology Security Techniques Information security management for inter-sector and inter-organizational communications Information technology Security Techniques Code of practice for protection of personally identifiable information (PII) in public clouds acting as PII processors Information technology Security Techniques Guidance for auditors on ISMS controls (focused on the information security controls Information technology Security techniques Selection, deployment and operations of intrusion detection systems (IDPS) 8 LTD 17/10677 /ISO/IEC 27040:2015 LTD 17/10678 /ISO/IEC 27006: LTD 17/10679 /ISO/IEC 27017: LTD 17/10680 /ISO/IEC : Information Storage security Information Requirements for bodies providing audit and certification of information security management systems Information Code of practice for information security controls based on ISO/IEC for cloud services Information technology security techniques network security Part 1 overview and concepts

6 11 एल टई लए 17(10) अन प मल य कन तनक य क रम खण उ प द क 12 एल टई लए 17(10) 13 एल टई लए 17(10) न र ध ग क - सर ष कनएक - तनज 14 एल टई लए 17(10) 15 एल टई लए 17(10) अपष ए परख न र ध ग क - सर ष कनएक - तनज म लपक र परख न र ध ग क - सर ष कनएक - ल इ वई क ई र फ 1: स म य न र ध ग क - सर ष कनएक - ल इ वई क ई र फ 2 : लल क मसफर 16 एल टई लए 17(10) 17 एल टई लए 17(10) 18 एल टई लए 17(10) 19 एल टई लए 17(10) न र ध ग क - सर ष कनएक - एक न द मलव रण ल 20 एल टई लए 17(10) न र ध ग क - सर ष कनएक - एक न द मलव रण ल 21 एल टई लए 17(10) न र ध ग क - सर ष कनएक - एक न द मलव रण ल 22 एल टई लए 17(10) 23 एल टई लए 17(10) न र ध ग क - सर ष कनएक - ई इम ई प सव ए - 24 एल टई लए 17(10) 25 एल टई लए 17(10) 26 एल टई लए 17(10) न र ध ग क - सर ष कनएक - ल इ वई क ई र फ 3: म मसफर न र ध ग क - सर ष कनएक - ल इ वई क ई र फ 4: असममम कनएक क रय स य रवव य स न र ध ग क - सर ष कनएक - अ ल क र व पर ध रर क ई र कफक कनएक 1: स म य 2 : असममम मसफर 1 : स म य 3 : लल क मसफर न र ध ग क - सर ष कनएक - 1 : परख न र ध ग क - सर ष कनएक - 2 : व र ई कन उ प दद करन क र न र ध ग क - सर ष कनएक - 3 : मल ल ई कन उ प दद करन क र न र ध ग क - सर ष कनएक - 4 ररम ई एस स क सर ष

7 एल टई लए 17(10) ISO /IEC17065 : 2012 ISO/IEC 29100:2011 Conformity assessment -- Requirements for bodies certifying products, Information technology -- Security techniques -- Privacy framework ISO/IEC 29101:2013 Information technology -- Security techniques -- Privacy architecture framework Information technology -- Security techniques -- Lightweight cryptography -- Part 1: General Information technology -- Security techniques -- Lightweight cryptography -- Part 2: Block ciphers Information technology -- Security techniques -- Lightweight cryptography -- Part 3: Stream ciphers Information technology -- Security techniques -- Lightweight cryptography -- Part 4: Mechanisms using asymmetric techniques ISO/IEC :2012 ISO/IEC :2012 ISO/IEC :2012 ISO/IEC : न र ध ग क - सर ष कनएक - र लम बएई जनर न ISO/IEC :2008 ISO/IEC :2006 ISO/IEC :2005 ISO/IEC :2010 ISO/IEC :2008 ISO/IEC :2009 ISO/IEC :2009 ISO/IEC :2005 ISO/IEC 18031:2011 Doc. No. LITD 17( 3594)ISO/IEC : 2011 Information Technology Security techniques Biometric information protection. Doc. No. LITD 17 (3595) ISO/IEC : 2009 Information Technology Information technology -- Security techniques -- Cryptographic techniques based on elliptic curves Part 1: General Information technology -- Security techniques -- Encryption algorithms -Part 2: Asymmetric ciphers Information technology -- Security techniques -- Encryption algorithms -Part 1: General Information technology -- Security techniques -- Encryption algorithms -Part 3: Block ciphers Information technology -- Security techniques -- Time-stamping services - Part 1: Framework Information technology -- Security techniques -- Time-stamping services - Part 2: Mechanisms producing independent tokens. Information technology -- Security techniques -- Time-stamping services - Part 3: Mechanisms producing linked tokens Information technology -- Security techniques -- IT network security -Part 4: Securing remote access Information technology -- Security techniques -- Random bit generation - These draft will be reissued in Wide circulation after finalizing the text and the manner in which the comments resolved by panel may be incorporated in ISO document.

8 Security techniques Security evaluation of biometrics

9 Doc No.: LITD 17 (10651) IS /ISO/IEC : 2012 भ रत य म नक स चन र य ग क स रष तकन क ड ज़ टल रम ण क पहच न, स रहण एव स रषण ह त द श नन श Indian Standard INFORMATION TECHNOLOGY SECURITY TECHNIQUES GUIDELINES FOR IDENTIFICATION, COLLECTION, ACQUISITION AND PRESERVATION OF DIGITAL EVIDENCE ICS BIS 2016 BUREAU OF INDIAN STANDARDS MANAK BHAVAN, 9 BAHADUR SHAH ZAFAR MARG NEW DELHI Sep 2016 Price Group

10 Information Systems Security and Biometrics Sectional Committee, LITD 17 NATIONAL FOREWORD This Indian Standard which is identical with ISO/IEC : 2012 Information technology Security techniques Guidelines for identification, collection, acquisition and preservation of digital evidence issued by the International Organization for Standardization (ISO) and International Electrotechnical Commission (IEC) jointly was adopted by the Bureau of Indian Standards on the recommendations of the Information Systems Security and Biometrics Sectional Committee and approval of the Electronics and Information Technology Division Council. The text of ISO/IEC Standard has been approved as suitable for publication as an Indian Standard without deviations. Certain conventions are however not identical to those used in Indian Standards. Attention is particularly drawn to the following: a) Wherever the words International Standard appear referring to this standard, they should be read as Indian Standard. b) Comma (,) has been used as a decimal marker while in Indian Standards, the current practice is to use a point (.) as the decimal marker. In this adopted standard, reference appears to certain International Standards for which Indian Standards also exist. The corresponding Indian Standards, which are to be substituted in their places are, listed below along with their degree of equivalence for the editions indicated: International Standard Corresponding Indian Standard Degree of Equivalence ISO/IEC 17025:2005, General requirements for the competence of testing and calibration laboratories IS/ ISO/IEC 17025:2005, General requirements for the competence of testing and calibration laboratories ISO/IEC 27000, Information systems Overview and vocabulary IS/ISO/IEC 27000:2009 Information technology security techniques systems Overview and vocabulary -do- IS/ISO/IEC ISO/IEC 17020, Conformity General Criteria for the Operation of assessment Requirements for the Various Types of Bodies Performing operation of various types of bodies Inspection performing inspection -do- Identical

11 The technical committee has reviewed the provisions of following International Standard referred in this adopted standard and has decided that it is acceptable for use in conjunction with this standard: International Standard ISO/TR 15801, Title Document management Information stored electronically Recommendations for trustworthiness and reliability For the purpose of whether deciding a particular requirement of this standard is complied with, the final value, observed or calculated, expressing the result of a test or analysis, shall be rounded off in accordance with IS 2 : 1960 Rules for rounding off numerical values (revised). The number of significant places retained in the rounded off value should be same as that of the specified value in this standard.

12 Doc No.: LITD 17 (10672) IS /ISO/IEC : 2012 भ रत य म नक स चन र य ग क स रष तकन क स इबर स रष ह त द श नन श Indian Standard INFORMATION TECHNOLOGY SECURITY TECHNIQUES GUIDELINES FOR CYBER SECURITY ICS BIS 2016 BUREAU OF INDIAN STANDARDS MANAK BHAVAN, 9 BAHADUR SHAH ZAFAR MARG NEW DELHI Sep 2016 Price Group

13 Information Systems Security and Biometrics Sectional Committee, LITD 17 NATIONAL FOREWORD This Indian Standard which is identical with ISO/IEC : 2012 Information technology Security techniques Guidelines for cyber security issued by the International Organization for Standardization (ISO) and International Electrotechnical Commission (IEC) jointly was adopted by the Bureau of Indian Standards on the recommendations of the Information Systems Security and Biometrics Sectional Committee and approval of the Electronics and Information Technology Division Council. The text of ISO/IEC Standard has been approved as suitable for publication as an Indian Standard without deviations. Certain conventions are however not identical to those used in Indian Standards. Attention is particularly drawn to the following: a) Wherever the words International Standard appear referring to this standard, they should be read as Indian Standard. b) Comma (,) has been used as a decimal marker while in Indian Standards, the current practice is to use a point (.) as the decimal marker. In this adopted standard, reference appears to certain International Standards for which Indian Standards also exist. The corresponding Indian Standards, which is to be substituted in its places is, listed below along with their degree of equivalence for the editions indicated: International Standard ISO/IEC 27000, Information systems Overview and vocabulary Corresponding Indian Standard IS/ISO/IEC Information technology security techniques systems Overview and vocabulary Degree of Equivalence Identical For the purpose of whether deciding a particular requirement of this standard is complied with, the final value, observed or calculated, expressing the result of a test or analysis, shall be rounded off in accordance with IS 2 : 1960 Rules for rounding off numerical values (revised). The number of significant places retained in the rounded off value should be same as that of the specified value in this standard.

14 Doc No.: LITD 17 (10673) IS /ISO/IEC : 2015 भ रत य म नक न र य ग क सर ष तकन क अ तष र य एव अ त-स ठन मक स र षण क ल ए न सर ष रब धन Indian Standard INFORMATION TECHNOLOGY SECURITY TECHNIQUES INFORMATION SECURITY MANAGEMENT FOR INTER-SECTOR AND INTERORGANIZATIONAL COMMUNICATIONS ICS BIS 2016 BUREAU OF INDIAN STANDARDS MANAK BHAVAN, 9 BAHADUR SHAH ZAFAR MARG NEW DELHI Sep 2016 Price Group

15 Information Systems Security and Biometrics Sectional Committee, LITD 17 NATIONAL FOREWORD This Indian Standard which is identical with ISO/IEC : 2015 Information technology Security ttechniques for inter-sector and interorganizational communications issued by the International Organization for Standardization (ISO) and International Electrotechnical Commission (IEC) jointly was adopted by the Bureau of Indian Standards on the recommendations of the Information Systems Security and Biometrics Sectional Committee and approval of the Electronics and Information Technology Division Council. The text of ISO/IEC Standard has been approved as suitable for publication as an Indian Standard without deviations. Certain conventions are however not identical to those used in Indian Standards. Attention is particularly drawn to the following: a) Wherever the words International Standard appear referring to this standard, they should be read as Indian Standard. b) Comma (,) has been used as a decimal marker while in Indian Standards, the current practice is to use a point (.) as the decimal marker. In this adopted standard, reference appears to certain International Standards for which Indian Standards also exist. The corresponding Indian Standards, which is to be substituted in its places is, listed below along with their degree of equivalence for the editions indicated: International Standard ISO/IEC : 2014, Information systems Overview and vocabulary ISO/IEC 27001:2013, Information systems Requirements Corresponding Indian Standard Degree of Equivalence IS/ISO/IEC 27000:2014 Information technology security techniques systems Overview and vocabulary(first Revision) Identical IS/ISO/IEC 27001:2013, Information systems Requirements -do-

16 ISO/IEC 27002:2013, Information Code of practice for information security controls IS/ISO/IEC 27002:2013, Information Code of practice for information security controls -do- For the purpose of whether deciding a particular requirement of this standard is complied with, the final value, observed or calculated, expressing the result of a test or analysis, shall be rounded off in accordance with IS 2 : 1960 Rules for rounding off numerical values (revised). The number of significant places retained in the rounded off value should be same as that of the specified value in this standard.

17 Doc No.: LITD 17 (10674) IS /ISO/IEC : 2014 भ रत य म नक न र य ग क सर ष तकन क प आईआई र स सर क प म प ल क उड ए ट अभभ य य न (प आईआई) क सर ष र तत स ह त Indian Standard INFORMATION TECHNOLOGY SECURITY TECHNIQUES CODE OF PRACTICE FOR PROTECTION OF PERSONALLY IDENTIFIABLE INFORMATION (PII) IN PUBLIC CLOUDS ACTING AS PII PROCESSORS ICS BIS 2016 BUREAU OF INDIAN STANDARDS MANAK BHAVAN, 9 BAHADUR SHAH ZAFAR MARG NEW DELHI Sep 2016 Price Group

18 Information Systems Security and Biometrics Sectional Committee, LITD 17 NATIONAL FOREWORD This Indian Standard which is identical with ISO/IEC : 2014 Information technology Security Techniques Code of practice for protection of personally identifiable information (PII) in public clouds acting as PII processors issued by the International Organization for Standardization (ISO) and International Electrotechnical Commission (IEC) jointly was adopted by the Bureau of Indian Standards on the recommendations of the Information Systems Security and Biometrics Sectional Committee and approval of the Electronics and Information Technology Division Council. The text of ISO/IEC Standard has been approved as suitable for publication as an Indian Standard without deviations. Certain conventions are however not identical to those used in Indian Standards. Attention is particularly drawn to the following: a) Wherever the words International Standard appear referring to this standard, they should be read as Indian Standard. b) Comma (,) has been used as a decimal marker while in Indian Standards, the current practice is to use a point (.) as the decimal marker. In this adopted standard, reference appears to certain International Standards for which Indian Standards also exist. The corresponding Indian Standards, which are to be substituted in their places are, listed below along with their degree of equivalence for the editions indicated: International Standard ISO/IEC : 2014, Information systems Overview and vocabulary ISO/IEC 27001:2013, Information systems Requirements Corresponding Indian Standard Degree of Equivalence IS/ISO/IEC 27000:2014 Information technology security techniques systems Overview and vocabulary(first Revision) Identical IS/ISO/IEC 27001:2013, Information systems Requirements -do-

19 ISO/IEC 27002:2013, Information Code of practice for information security controls IS/ISO/IEC 27002:2013, Information Code of practice for information security controls -do- The technical committee has reviewed the provisions of following International Standard referred in this adopted standard and has decided that it is acceptable for use in conjunction with this standard: International Standard Title ISO/IEC Rec. ITU-T Y.3500 Information technology Cloud computing Overview and vocabulary1) ISO/IEC 29100:2011 Information Privacy framework For the purpose of whether deciding a particular requirement of this standard is complied with, the final value, observed or calculated, expressing the result of a test or analysis, shall be rounded off in accordance with IS 2 : 1960 Rules for rounding off numerical values (revised). The number of significant places retained in the rounded off value should be same as that of the specified value in this standard.

20 Doc No.: LITD 17 (10675) IS /ISO/IEC TR : 2011 भ रत य म नक न र य ग क सर ष तकन क आड टर क ल ए आईएसएमएस क र स ब ध द श नन श ( न सर ष क र पर क द त) Indian Standard INFORMATION TECHNOLOGY SECURITY TECHNIQUES GUIDANCE FOR AUDITORS ON ISMS CONTROLS (FOCUSED ON THE INFORMATION SECURITY CONTROLS) ICS BIS 2016 BUREAU OF INDIAN STANDARDS MANAK BHAVAN, 9 BAHADUR SHAH ZAFAR MARG NEW DELHI Sep 2016 Price Group

21 Information Systems Security and Biometrics Sectional Committee, LITD 17 NATIONAL FOREWORD This Indian Standard which is identical with ISO/IEC TR : 2011 Information Guidance for auditors on ISMS controls (focused on the information security controls issued by the International Organization for Standardization (ISO) and International Electrotechnical Commission (IEC) jointly was adopted by the Bureau of Indian Standards on the recommendations of the Information Systems Security and Biometrics Sectional Committee and approval of the Electronics and Information Technology Division Council. The text of ISO/IEC Standard has been approved as suitable for publication as an Indian Standard without deviations. Certain conventions are however not identical to those used in Indian Standards. Attention is particularly drawn to the following: a) Wherever the words International Standard appear referring to this standard, they should be read as Indian Standard. b) Comma (,) has been used as a decimal marker while in Indian Standards, the current practice is to use a point (.) as the decimal marker. In this adopted standard, reference appears to certain International Standards for which Indian Standards also exist. The corresponding Indian Standards, which is to be substituted in its places is, listed below along with their degree of equivalence for the editions indicated: International Standard ISO/IEC 27000: 2009, Information systems Overview and vocabulary Corresponding Indian Standard IS/ISO/IEC 27000:2009 Information technology security techniques systems Overview and vocabulary Degree of Equivalence Identical For the purpose of whether deciding a particular requirement of this standard is complied with, the final value, observed or calculated, expressing the result of a test or analysis, shall be rounded off in accordance with IS 2 : 1960 Rules for rounding off numerical values (revised). The number of significant places retained in the rounded off value should be same as that of the specified value in this standard.

22 Doc No.: LITD 17 (10676) IS /ISO/IEC TR : 2015 भ रत य म नक न र य ग क सर ष तकन क अनग चत स तषप स न प यततय (आईड प एस) क चयन तन त एव रच लन Indian Standard INFORMATION TECHNOLOGY SECURITY TECHNIQUES SELECTION, DEPLOYMENT AND OPERATIONS OF INTRUSION DETECTION SYSTEMS (IDPS) ICS BIS 2016 BUREAU OF INDIAN STANDARDS MANAK BHAVAN, 9 BAHADUR SHAH ZAFAR MARG NEW DELHI Sep 2016 Price Group

23 Information Systems Security and Biometrics Sectional Committee, LITD 17 NATIONAL FOREWORD This Indian Standard which is identical with ISO/IEC : 2015 Information technology Security techniques Selection, deployment and operations of intrusion detection systems (IDPS) issued by the International Organization for Standardization (ISO) and International Electrotechnical Commission (IEC) jointly was adopted by the Bureau of Indian Standards on the recommendations of the Information Systems Security and Biometrics Sectional Committee and approval of the Electronics and Information Technology Division Council. The text of ISO/IEC Standard has been approved as suitable for publication as an Indian Standard without deviations. Certain conventions are however not identical to those used in Indian Standards. Attention is particularly drawn to the following: a) Wherever the words International Standard appear referring to this standard, they should be read as Indian Standard. b) Comma (,) has been used as a decimal marker while in Indian Standards, the current practice is to use a point (.) as the decimal marker. For the purpose of whether deciding a particular requirement of this standard is complied with, the final value, observed or calculated, expressing the result of a test or analysis, shall be rounded off in accordance with IS 2 : 1960 Rules for rounding off numerical values (revised). The number of significant places retained in the rounded off value should be same as that of the specified value in this standard.

24 Doc No.: LITD 17 (10677) IS /ISO/IEC : 2015 भ रत य म नक न र य ग क सर ष तकन क भ ड रण सर ष Indian Standard INFORMATION TECHNOLOGY SECURITY TECHNIQUES STORAGE SECURITY ICS BIS 2016 BUREAU OF INDIAN STANDARDS MANAK BHAVAN, 9 BAHADUR SHAH ZAFAR MARG NEW DELHI Sep 2016 Price Group

25 Information Systems Security and Biometrics Sectional Committee, LITD 17 NATIONAL FOREWORD This Indian Standard which is identical with ISO/IEC : 2015 Information technology Security Techniques Storage security issued by the International Organization for Standardization (ISO) and International Electrotechnical Commission (IEC) jointly was adopted by the Bureau of Indian Standards on the recommendations of the Information Systems Security and Biometrics Sectional Committee and approval of the Electronics and Information Technology Division Council. The text of ISO/IEC Standard has been approved as suitable for publication as an Indian Standard without deviations. Certain conventions are however not identical to those used in Indian Standards. Attention is particularly drawn to the following: a) Wherever the words International Standard appear referring to this standard, they should be read as Indian Standard. b) Comma (,) has been used as a decimal marker while in Indian Standards, the current practice is to use a point (.) as the decimal marker. In this adopted standard, reference appears to certain International Standards for which Indian Standards also exist. The corresponding Indian Standards, which are to be substituted in their places are, listed below along with their degree of equivalence for the editions indicated: International Standard ISO/IEC 27000, Information systems Overview and vocabulary ISO/IEC 27001:2013, Information systems Requirements ISO/IEC Information technology Security techniques Information security risk management Corresponding Indian Standard Degree of Equivalence IS/ISO/IEC Information technology security techniques systems Overview and vocabulary(first Revision) Identical IS/ISO/IEC 27001:2013, Information systems Requirements -do- IS/ISO/IEC 27005, Information Code of practice for information -do-

26 security controls The technical committee has reviewed the provisions of following International Standard referred in this adopted standard and has decided that it is acceptable for use in conjunction with this standard: International Standard ISO/IEC Rec. ITU-T Y.3500 ISO/IEC 29100:2011 Title Information technology Cloud computing Overview and vocabulary1) Information Privacy framework For the purpose of whether deciding a particular requirement of this standard is complied with, the final value, observed or calculated, expressing the result of a test or analysis, shall be rounded off in accordance with IS 2 : 1960 Rules for rounding off numerical values (revised). The number of significant places retained in the rounded off value should be same as that of the specified value in this standard.

27 Doc No.: LITD 17 (10678) IS /ISO/IEC : 2015 भ रत य म नक न र य ग क सर ष तकन क न सर ष रब धन प यततय क आड टर एव रम णन उपल ध कर न क ललए तनक य क अप ष ए Indian Standard INFORMATION TECHNOLOGY SECURITY TECHNIQUES REQUIREMENTS FOR BODIES PROVIDING AUDIT AND CERTIFICATION OF INFORMATION SECURITY MANAGEMENT SYSTEMS ICS BIS 2016 BUREAU OF INDIAN STANDARDS MANAK BHAVAN, 9 BAHADUR SHAH ZAFAR MARG NEW DELHI Sep 2016 Price Group

28 Information Systems Security and Biometrics Sectional Committee, LITD 17 NATIONAL FOREWORD This Indian Standard which is identical with ISO/IEC : 2015 Information Requirements for bodies providing audit and certification of information security management systems issued by the International Organization for Standardization (ISO) and International Electrotechnical Commission (IEC) jointly was adopted by the Bureau of Indian Standards on the recommendations of the Information Systems Security and Biometrics Sectional Committee and approval of the Electronics and Information Technology Division Council. The text of ISO/IEC Standard has been approved as suitable for publication as an Indian Standard without deviations. Certain conventions are however not identical to those used in Indian Standards. Attention is particularly drawn to the following: a) Wherever the words International Standard appear referring to this standard, they should be read as Indian Standard. b) Comma (,) has been used as a decimal marker while in Indian Standards, the current practice is to use a point (.) as the decimal marker. In this adopted standard, reference appears to certain International Standards for which Indian Standards also exist. The corresponding Indian Standards, which are to be substituted in their places are, listed below along with their degree of equivalence for the editions indicated: International Standard ISO/IEC 27000, Information systems Overview and vocabulary ISO/IEC 27001:2013, Information systems Requirements Corresponding Indian Standard Degree of Equivalence IS/ISO/IEC 27000, Information technology security techniques systems Overview and vocabulary(first Revision) Identical IS/ISO/IEC 27001:2013, Information systems Requirements -do-

29 The technical committee has reviewed the provisions of following International Standard referred in this adopted standard and has decided that it is acceptable for use in conjunction with this standard: International Standard ISO/IEC :2015, Title Conformity assessment Requirements for bodies providing audit and certification of management systems Part 1: Requirements For the purpose of whether deciding a particular requirement of this standard is complied with, the final value, observed or calculated, expressing the result of a test or analysis, shall be rounded off in accordance with IS 2 : 1960 Rules for rounding off numerical values (revised). The number of significant places retained in the rounded off value should be same as that of the specified value in this standard.

30 Doc No.: LITD 17 (10679) IS /ISO/IEC : 2015 भ रत य म नक न र य ग क सर ष तकन क ल उड स व ओ क न सर ष क र ल क र तत स ह त Indian Standard INFORMATION TECHNOLOGY SECURITY TECHNIQUES CODE OF PRACTICE FOR INFORMATION SECURITY CONTROLS BASED ON ISO/IEC FOR CLOUD SERVICES ICS BIS 2016 BUREAU OF INDIAN STANDARDS MANAK BHAVAN, 9 BAHADUR SHAH ZAFAR MARG NEW DELHI Sep 2016 Price Group

31 Information Systems Security and Biometrics Sectional Committee, LITD 17 NATIONAL FOREWORD This Indian Standard which is identical with ISO/IEC : 2015 Information Code of practice for information security controls based on ISO/IEC for cloud services issued by the International Organization for Standardization (ISO) and International Electrotechnical Commission (IEC) jointly was adopted by the Bureau of Indian Standards on the recommendations of the Information Systems Security and Biometrics Sectional Committee and approval of the Electronics and Information Technology Division Council. The text of ISO/IEC Standard has been approved as suitable for publication as an Indian Standard without deviations. Certain conventions are however not identical to those used in Indian Standards. Attention is particularly drawn to the following: a) Wherever the words International Standard appear referring to this standard, they should be read as Indian Standard. b) Comma (,) has been used as a decimal marker while in Indian Standards, the current practice is to use a point (.) as the decimal marker. In this adopted standard, reference appears to certain International Standards for which Indian Standards also exist. The corresponding Indian Standards, which are to be substituted in their places are, listed below along with their degree of equivalence for the editions indicated: International Standard ISO/IEC 27000, Information systems Overview and vocabulary ISO/IEC 27002:2013, Information Code of practice for information security controls Corresponding Indian Standard Degree of Equivalence IS/ISO/IEC 27000, Information technology security techniques systems Overview and vocabulary(first Revision) Identical IS/ISO/IEC 27002:2013, Information Code of practice for information security controls -do-

32 The technical committee has reviewed the provisions of following International Standard referred in this adopted standard and has decided that it is acceptable for use in conjunction with this standard: International Standard Recommendation ITU-T Y.3500 (in force) ISO/IEC 17788: (in force) Recommendation ITU-T Y.3502 (in force) ISO/IEC 17789: (in force) Title Information technology Cloud computing Overview and vocabulary. Information technology Cloud computing Reference architecture For the purpose of whether deciding a particular requirement of this standard is complied with, the final value, observed or calculated, expressing the result of a test or analysis, shall be rounded off in accordance with IS 2 : 1960 Rules for rounding off numerical values (revised). The number of significant places retained in the rounded off value should be same as that of the specified value in this standard.

33 Doc No.: LITD 17 (10680) IS /ISO/IEC : 2015 भ रत य म नक न र ध ग क सर ष तकन क न टवकक सर ष भ 1 सस ह वल कन एव अवध रण ए ( पहल प नर षण ) Indian Standard INFORMATION TECHNOLOGY SECURITY TECHNIQUES NETWORK SECURITY PART 1 OVERVIEW AND CONCEPTS (First Revision) ICS BIS 2016 BUREAU OF INDIAN STANDARDS MANAK BHAVAN, 9 BAHADUR SHAH ZAFAR MARG NEW DELHI Sep 2016 Price Group

34 Information Systems Security and Biometrics Sectional Committee, LITD 17 NATIONAL FOREWORD This Indian Standard (Part 1) which is identical with ISO/IEC : 2015 Information network security Part 1 overview and concepts issued by the International Organization for Standardization (ISO) and International Electrotechnical Commission (IEC) jointly was adopted by the Bureau of Indian Standards on the recommendations of the Information Systems Security and Biometrics Sectional Committee and approval of the Electronics and Information Technology Division Council. This standard was originally published in 2013 and was identical with : 2009 and has now been revised to align it with the latest version of ISO/IEC The text of ISO/IEC Standard has been approved as suitable for publication as an Indian Standard without deviations. Certain conventions are however not identical to those used in Indian Standards. Attention is particularly drawn to the following: a) Wherever the words International Standard appear referring to this standard, they should be read as Indian Standard. b) Comma (,) has been used as a decimal marker while in Indian Standards, the current practice is to use a point (.) as the decimal marker. In this adopted standard, reference appears to certain International Standards for which Indian Standards also exist. The corresponding Indian Standards, which are to be substituted in their places are, listed below along with their degree of equivalence for the editions indicated: International Standard ISO/IEC 27000, Information systems Overview and vocabulary ISO/IEC 27002:2013, Information Code of practice for information security controls Corresponding Indian Standard Degree of Equivalence IS/ISO/IEC 27000, Information technology security techniques systems Overview and vocabulary(first Revision) Identical IS/ISO/IEC 27002:2013, Information Code of practice for information security controls -do-

35 The technical committee has reviewed the provisions of following International Standard referred in this adopted standard and has decided that it is acceptable for use in conjunction with this standard: International Standard Recommendation ITU-T Y.3500 (in force) ISO/IEC 17788: (in force) Recommendation ITU-T Y.3502 (in force) ISO/IEC 17789: (in force) Title Information technology Cloud computing Overview and vocabulary. Information technology Cloud computing Reference architecture For the purpose of whether deciding a particular requirement of this standard is complied with, the final value, observed or calculated, expressing the result of a test or analysis, shall be rounded off in accordance with IS 2 : 1960 Rules for rounding off numerical values (revised). The number of significant places retained in the rounded off value should be same as that of the specified value in this standard.