य पक पर च लन मस द रलख रषण स ञ पन स द भ तकन क सममतत : एलआईट ड 17/ट - 81 स 106 एलआईट ड 17 -प न ददन क 31 अग त 2016 व ल क न म: 1) न रण ल सर ष एव ब य मद क ववषय सममत एल टई लए,17 3) गच रखन व ल 2) इल तनक एव स चन र य ग क वव पररषद एल टई लएसए क रध न सद य अ य मह दय(य ) क पय स ल नक म स ल न रलख क अवल कन कर : क पय इन मस द क अवल कन कर और अपनए स मत य, यह ब ह ए कक यदद यह र एय म नक रक म ह अमल करन म प क यवस य म य कद न टय सक ए ह, ज स मत य जन क अ त म त ग 30-09-2016 यदद क ट स मत र नह ह ए य स मत स प दक य रक त क ह ए ह क पय य अन म ह उपर मस द क मलए पक अन म दन म न लन क अन म ए द वप, यदद पक स मत क रक त कनएक ह यदद चयरमन ववषय सममत व र ऐस रहन व त ह इस क व यक क रभ व ट क मलए चयरमन ववषय सममत क प स पर म भ ह य ववषय सममत क प स अवल क भ करक अन म ककय ज ए यह मस द टटसए म नक क अन स र सब ध ह इस पर क स स ल न नह ह टटसए म नक क ब द मस द पर ववच र भ अवल कन ककय ज ए यदद टटसए म नक क स ई रत अपषष ह मल व र अन र ध ज ज ए यदद क ट स मत य क ऊपर तनममभ ह क पय अध ह षर क तन नमलखख प पर स ल न फ म ई म ज द
ध यव द, वद य, (र न भ) स ल नक : उपर रमख (इल तनक व ट ई ) ट मल: hlitd@bis.org.in, litd@bis.org.in टमलफ स: 01123237093
र.स. 1 रलख स. एल टई लए 17(10651) 2 एल टई लए 17(10672) 3 एल टई लए 17(10673) 4 एल टई लए 17(10674) 5 6 7 8 एल टई लए 17(10675) एल टई लए 17(10676) एल टई लए 17(10677) एल टई लए 17(10678) 9 एल टई लए 17(10679) 10 एल टई लए 17(10680) स ल नक श षक न र य ग क सर ष कनएक डल ईल रम ण क पहच न, स रहण एव स रषण ह दद तनद न र य ग क सर ष कनएक स इबर सर ष ह दद तनद न र य ग क सर ष कनएक अ ष रएय एव अ - स न मक स रषण क मलए न सर ष रब धन न र य ग क सर ष कनएक पए ट ट र ससर क प म प ललक ल उल ए ई अम यय न (पए ट ट) क सर ष र त स दह न र य ग क सर ष कनएक डलईर क मलए ट एस एम क ल स बध ए दद तनद ( न क ल पर क द ) सर ष न र य ग क सर ष कनएक अनग च स षप स न प यत य ( टलएपएएस) क चयन न ए एव रच लन न र ध ग क - सर ष कनएक - ल रण सर ष न र ध ग क - सर ष कनएक - न सर ष रब धन प यत य क डलईर एव रम णन उपललध कर न क मलए तनक य क अपष ए न र ध ग क - सर ष कनएक - ल उल सव ओ क न सर ष क ल क र त स दह न र ध ग क - सर ष कनएक नईवकभ सर ष 1 मस ह वल कन एव अवध रण ए
DRAFT IN WIDE CIRCULATION Technical Committee: LITD 17 Document Dispatch Advice Ref LITD17/T- 61 To 95 Date 31-08-2015 ADDRESSED TO: 1. All Members of Information Systems Security Sectional Committee, LITD 17 2. All Principal Members of Electronics and Information Technology Division Council (LITDC) 3. All others interested Dear Madam/Sir(s), Please find enclosed draft Indian Standards give in Annex: Kindly examine these draft standards and forward your views stating any difficulties, which you are likely to experience in your business or profession, if this is finally adopted as National Standards. Last Date for comments: 30/09/2016 Comments if any, may please be made in the format indicated and mailed to the undersigned t the above address. In case no comments are received or comments received are of editorial nature. You will kindly permit us to presume your approval for the above document as finalized. However, in case of comments of technical in nature are received then it may be finalized either in consultation with the Chairman, Sectional Committee or referred to the Sectional committee for further necessary action if so desired by the Chairman, Sectional Committee. This document is identical with corresponding IEC Standard and is not attached with this letter. For considering comments on the document corresponding IEC Standard may be referred. In case of soft copy of IEC standard is required, a request may be sent by mail. Thanking you, Yours faithfully, (Reena Garg ) Head (Electronics & IT)
Annex Sl. No. Document No/IS No. Title 1 LTD 17/10651 /ISO 27037 : 2012 Information Guidelines for identification, collection, acquisition and preservation of digital evidence 2 LTD 17/10672 /ISO/IEC 27032:2012 3 LTD 17/10673 /ISO/IEC 27010 :2012 4 LTD 17/10674 /ISO/IEC 27018 : 2014 5 LTD 17/10675 /ISO/IEC TR 27008 : 6 LTD 17/10676 /ISO/IEC 27039:2015 Information technology Security techniques Guidelines for cyber security Information technology Security Techniques Information security management for inter-sector and inter-organizational communications Information technology Security Techniques Code of practice for protection of personally identifiable information (PII) in public clouds acting as PII processors Information technology Security Techniques Guidance for auditors on ISMS controls (focused on the information security controls Information technology Security techniques Selection, deployment and operations of intrusion detection systems (IDPS) 8 LTD 17/10677 /ISO/IEC 27040:2015 LTD 17/10678 /ISO/IEC 27006:2015 9 LTD 17/10679 /ISO/IEC 27017:2015 10 LTD 17/10680 /ISO/IEC 27033-1 : 2015 7 Information Storage security Information Requirements for bodies providing audit and certification of information security management systems Information Code of practice for information security controls based on ISO/IEC 27002 for cloud services Information technology security techniques network security Part 1 overview and concepts
11 एल टई लए 17(10) अन प मल य कन तनक य क रम खण उ प द क 12 एल टई लए 17(10) 13 एल टई लए 17(10) न र ध ग क - सर ष कनएक - तनज 14 एल टई लए 17(10) 15 एल टई लए 17(10) अपष ए परख न र ध ग क - सर ष कनएक - तनज म लपक र परख न र ध ग क - सर ष कनएक - ल इ वई क ई र फ 1: स म य न र ध ग क - सर ष कनएक - ल इ वई क ई र फ 2 : लल क मसफर 16 एल टई लए 17(10) 17 एल टई लए 17(10) 18 एल टई लए 17(10) 19 एल टई लए 17(10) न र ध ग क - सर ष कनएक - एक न द मलव रण ल 20 एल टई लए 17(10) न र ध ग क - सर ष कनएक - एक न द मलव रण ल 21 एल टई लए 17(10) न र ध ग क - सर ष कनएक - एक न द मलव रण ल 22 एल टई लए 17(10) 23 एल टई लए 17(10) न र ध ग क - सर ष कनएक - ई इम ई प सव ए - 24 एल टई लए 17(10) 25 एल टई लए 17(10) 26 एल टई लए 17(10) न र ध ग क - सर ष कनएक - ल इ वई क ई र फ 3: म मसफर न र ध ग क - सर ष कनएक - ल इ वई क ई र फ 4: असममम कनएक क रय स य रवव य स न र ध ग क - सर ष कनएक - अ ल क र व पर ध रर क ई र कफक कनएक 1: स म य 2 : असममम मसफर 1 : स म य 3 : लल क मसफर न र ध ग क - सर ष कनएक - 1 : परख न र ध ग क - सर ष कनएक - 2 : व र ई कन उ प दद करन क र न र ध ग क - सर ष कनएक - 3 : मल ल ई कन उ प दद करन क र न र ध ग क - सर ष कनएक - 4 ररम ई एस स क सर ष
27 11 12 13 14 15 16 एल टई लए 17(10) ISO /IEC17065 : 2012 ISO/IEC 29100:2011 Conformity assessment -- Requirements for bodies certifying products, Information technology -- Security techniques -- Privacy framework ISO/IEC 29101:2013 Information technology -- Security techniques -- Privacy architecture framework Information technology -- Security techniques -- Lightweight cryptography -- Part 1: General Information technology -- Security techniques -- Lightweight cryptography -- Part 2: Block ciphers Information technology -- Security techniques -- Lightweight cryptography -- Part 3: Stream ciphers Information technology -- Security techniques -- Lightweight cryptography -- Part 4: Mechanisms using asymmetric techniques ISO/IEC 29192-1:2012 ISO/IEC 29192-2:2012 ISO/IEC 29192-3:2012 ISO/IEC 29192-4:2013 17 18 19 20 21 22 23 24 25 26 27 28 न र ध ग क - सर ष कनएक - र लम बएई जनर न ISO/IEC 15946-1:2008 ISO/IEC 18033-2:2006 ISO/IEC 18033-1:2005 ISO/IEC 18033-3:2010 ISO/IEC 18014-1:2008 ISO/IEC 18014-2:2009 ISO/IEC 18014-3:2009 ISO/IEC 18028-4:2005 ISO/IEC 18031:2011 Doc. No. LITD 17( 3594)ISO/IEC 24745 : 2011 Information Technology Security techniques Biometric information protection. Doc. No. LITD 17 (3595) ISO/IEC 19792 : 2009 Information Technology Information technology -- Security techniques -- Cryptographic techniques based on elliptic curves Part 1: General Information technology -- Security techniques -- Encryption algorithms -Part 2: Asymmetric ciphers Information technology -- Security techniques -- Encryption algorithms -Part 1: General Information technology -- Security techniques -- Encryption algorithms -Part 3: Block ciphers Information technology -- Security techniques -- Time-stamping services - Part 1: Framework Information technology -- Security techniques -- Time-stamping services - Part 2: Mechanisms producing independent tokens. Information technology -- Security techniques -- Time-stamping services - Part 3: Mechanisms producing linked tokens Information technology -- Security techniques -- IT network security -Part 4: Securing remote access Information technology -- Security techniques -- Random bit generation - These draft will be reissued in Wide circulation after finalizing the text and the manner in which the comments resolved by panel may be incorporated in ISO document.
Security techniques Security evaluation of biometrics
Doc No.: LITD 17 (10651) IS /ISO/IEC 27037 : 2012 भ रत य म नक स चन र य ग क स रष तकन क ड ज़ टल रम ण क पहच न, स रहण एव स रषण ह त द श नन श Indian Standard INFORMATION TECHNOLOGY SECURITY TECHNIQUES GUIDELINES FOR IDENTIFICATION, COLLECTION, ACQUISITION AND PRESERVATION OF DIGITAL EVIDENCE ICS 35.040 BIS 2016 BUREAU OF INDIAN STANDARDS MANAK BHAVAN, 9 BAHADUR SHAH ZAFAR MARG NEW DELHI 110002 Sep 2016 Price Group
Information Systems Security and Biometrics Sectional Committee, LITD 17 NATIONAL FOREWORD This Indian Standard which is identical with ISO/IEC 27037 : 2012 Information technology Security techniques Guidelines for identification, collection, acquisition and preservation of digital evidence issued by the International Organization for Standardization (ISO) and International Electrotechnical Commission (IEC) jointly was adopted by the Bureau of Indian Standards on the recommendations of the Information Systems Security and Biometrics Sectional Committee and approval of the Electronics and Information Technology Division Council. The text of ISO/IEC Standard has been approved as suitable for publication as an Indian Standard without deviations. Certain conventions are however not identical to those used in Indian Standards. Attention is particularly drawn to the following: a) Wherever the words International Standard appear referring to this standard, they should be read as Indian Standard. b) Comma (,) has been used as a decimal marker while in Indian Standards, the current practice is to use a point (.) as the decimal marker. In this adopted standard, reference appears to certain International Standards for which Indian Standards also exist. The corresponding Indian Standards, which are to be substituted in their places are, listed below along with their degree of equivalence for the editions indicated: International Standard Corresponding Indian Standard Degree of Equivalence ISO/IEC 17025:2005, General requirements for the competence of testing and calibration laboratories IS/ ISO/IEC 17025:2005, General requirements for the competence of testing and calibration laboratories ISO/IEC 27000, Information systems Overview and vocabulary IS/ISO/IEC 27000:2009 Information technology security techniques systems Overview and vocabulary -do- IS/ISO/IEC 17020 ISO/IEC 17020, Conformity General Criteria for the Operation of assessment Requirements for the Various Types of Bodies Performing operation of various types of bodies Inspection performing inspection -do- Identical
The technical committee has reviewed the provisions of following International Standard referred in this adopted standard and has decided that it is acceptable for use in conjunction with this standard: International Standard ISO/TR 15801, Title Document management Information stored electronically Recommendations for trustworthiness and reliability For the purpose of whether deciding a particular requirement of this standard is complied with, the final value, observed or calculated, expressing the result of a test or analysis, shall be rounded off in accordance with IS 2 : 1960 Rules for rounding off numerical values (revised). The number of significant places retained in the rounded off value should be same as that of the specified value in this standard.
Doc No.: LITD 17 (10672) IS /ISO/IEC 27032 : 2012 भ रत य म नक स चन र य ग क स रष तकन क स इबर स रष ह त द श नन श Indian Standard INFORMATION TECHNOLOGY SECURITY TECHNIQUES GUIDELINES FOR CYBER SECURITY ICS 35.040 BIS 2016 BUREAU OF INDIAN STANDARDS MANAK BHAVAN, 9 BAHADUR SHAH ZAFAR MARG NEW DELHI 110002 Sep 2016 Price Group
Information Systems Security and Biometrics Sectional Committee, LITD 17 NATIONAL FOREWORD This Indian Standard which is identical with ISO/IEC 27032 : 2012 Information technology Security techniques Guidelines for cyber security issued by the International Organization for Standardization (ISO) and International Electrotechnical Commission (IEC) jointly was adopted by the Bureau of Indian Standards on the recommendations of the Information Systems Security and Biometrics Sectional Committee and approval of the Electronics and Information Technology Division Council. The text of ISO/IEC Standard has been approved as suitable for publication as an Indian Standard without deviations. Certain conventions are however not identical to those used in Indian Standards. Attention is particularly drawn to the following: a) Wherever the words International Standard appear referring to this standard, they should be read as Indian Standard. b) Comma (,) has been used as a decimal marker while in Indian Standards, the current practice is to use a point (.) as the decimal marker. In this adopted standard, reference appears to certain International Standards for which Indian Standards also exist. The corresponding Indian Standards, which is to be substituted in its places is, listed below along with their degree of equivalence for the editions indicated: International Standard ISO/IEC 27000, Information systems Overview and vocabulary Corresponding Indian Standard IS/ISO/IEC 27000 Information technology security techniques systems Overview and vocabulary Degree of Equivalence Identical For the purpose of whether deciding a particular requirement of this standard is complied with, the final value, observed or calculated, expressing the result of a test or analysis, shall be rounded off in accordance with IS 2 : 1960 Rules for rounding off numerical values (revised). The number of significant places retained in the rounded off value should be same as that of the specified value in this standard.
Doc No.: LITD 17 (10673) IS /ISO/IEC 27010 : 2015 भ रत य म नक न र य ग क सर ष तकन क अ तष र य एव अ त-स ठन मक स र षण क ल ए न सर ष रब धन Indian Standard INFORMATION TECHNOLOGY SECURITY TECHNIQUES INFORMATION SECURITY MANAGEMENT FOR INTER-SECTOR AND INTERORGANIZATIONAL COMMUNICATIONS ICS 35.040 BIS 2016 BUREAU OF INDIAN STANDARDS MANAK BHAVAN, 9 BAHADUR SHAH ZAFAR MARG NEW DELHI 110002 Sep 2016 Price Group
Information Systems Security and Biometrics Sectional Committee, LITD 17 NATIONAL FOREWORD This Indian Standard which is identical with ISO/IEC 27010 : 2015 Information technology Security ttechniques for inter-sector and interorganizational communications issued by the International Organization for Standardization (ISO) and International Electrotechnical Commission (IEC) jointly was adopted by the Bureau of Indian Standards on the recommendations of the Information Systems Security and Biometrics Sectional Committee and approval of the Electronics and Information Technology Division Council. The text of ISO/IEC Standard has been approved as suitable for publication as an Indian Standard without deviations. Certain conventions are however not identical to those used in Indian Standards. Attention is particularly drawn to the following: a) Wherever the words International Standard appear referring to this standard, they should be read as Indian Standard. b) Comma (,) has been used as a decimal marker while in Indian Standards, the current practice is to use a point (.) as the decimal marker. In this adopted standard, reference appears to certain International Standards for which Indian Standards also exist. The corresponding Indian Standards, which is to be substituted in its places is, listed below along with their degree of equivalence for the editions indicated: International Standard ISO/IEC 27000 : 2014, Information systems Overview and vocabulary ISO/IEC 27001:2013, Information systems Requirements Corresponding Indian Standard Degree of Equivalence IS/ISO/IEC 27000:2014 Information technology security techniques systems Overview and vocabulary(first Revision) Identical IS/ISO/IEC 27001:2013, Information systems Requirements -do-
ISO/IEC 27002:2013, Information Code of practice for information security controls IS/ISO/IEC 27002:2013, Information Code of practice for information security controls -do- For the purpose of whether deciding a particular requirement of this standard is complied with, the final value, observed or calculated, expressing the result of a test or analysis, shall be rounded off in accordance with IS 2 : 1960 Rules for rounding off numerical values (revised). The number of significant places retained in the rounded off value should be same as that of the specified value in this standard.
Doc No.: LITD 17 (10674) IS /ISO/IEC 27018 : 2014 भ रत य म नक न र य ग क सर ष तकन क प आईआई र स सर क प म प ल क उड ए ट अभभ य य न (प आईआई) क सर ष र तत स ह त Indian Standard INFORMATION TECHNOLOGY SECURITY TECHNIQUES CODE OF PRACTICE FOR PROTECTION OF PERSONALLY IDENTIFIABLE INFORMATION (PII) IN PUBLIC CLOUDS ACTING AS PII PROCESSORS ICS 35.040 BIS 2016 BUREAU OF INDIAN STANDARDS MANAK BHAVAN, 9 BAHADUR SHAH ZAFAR MARG NEW DELHI 110002 Sep 2016 Price Group
Information Systems Security and Biometrics Sectional Committee, LITD 17 NATIONAL FOREWORD This Indian Standard which is identical with ISO/IEC 27018 : 2014 Information technology Security Techniques Code of practice for protection of personally identifiable information (PII) in public clouds acting as PII processors issued by the International Organization for Standardization (ISO) and International Electrotechnical Commission (IEC) jointly was adopted by the Bureau of Indian Standards on the recommendations of the Information Systems Security and Biometrics Sectional Committee and approval of the Electronics and Information Technology Division Council. The text of ISO/IEC Standard has been approved as suitable for publication as an Indian Standard without deviations. Certain conventions are however not identical to those used in Indian Standards. Attention is particularly drawn to the following: a) Wherever the words International Standard appear referring to this standard, they should be read as Indian Standard. b) Comma (,) has been used as a decimal marker while in Indian Standards, the current practice is to use a point (.) as the decimal marker. In this adopted standard, reference appears to certain International Standards for which Indian Standards also exist. The corresponding Indian Standards, which are to be substituted in their places are, listed below along with their degree of equivalence for the editions indicated: International Standard ISO/IEC 27000 : 2014, Information systems Overview and vocabulary ISO/IEC 27001:2013, Information systems Requirements Corresponding Indian Standard Degree of Equivalence IS/ISO/IEC 27000:2014 Information technology security techniques systems Overview and vocabulary(first Revision) Identical IS/ISO/IEC 27001:2013, Information systems Requirements -do-
ISO/IEC 27002:2013, Information Code of practice for information security controls IS/ISO/IEC 27002:2013, Information Code of practice for information security controls -do- The technical committee has reviewed the provisions of following International Standard referred in this adopted standard and has decided that it is acceptable for use in conjunction with this standard: International Standard Title ISO/IEC 17788 Rec. ITU-T Y.3500 Information technology Cloud computing Overview and vocabulary1) ISO/IEC 29100:2011 Information Privacy framework For the purpose of whether deciding a particular requirement of this standard is complied with, the final value, observed or calculated, expressing the result of a test or analysis, shall be rounded off in accordance with IS 2 : 1960 Rules for rounding off numerical values (revised). The number of significant places retained in the rounded off value should be same as that of the specified value in this standard.
Doc No.: LITD 17 (10675) IS /ISO/IEC TR 27008 : 2011 भ रत य म नक न र य ग क सर ष तकन क आड टर क ल ए आईएसएमएस क र स ब ध द श नन श ( न सर ष क र पर क द त) Indian Standard INFORMATION TECHNOLOGY SECURITY TECHNIQUES GUIDANCE FOR AUDITORS ON ISMS CONTROLS (FOCUSED ON THE INFORMATION SECURITY CONTROLS) ICS 35.040 BIS 2016 BUREAU OF INDIAN STANDARDS MANAK BHAVAN, 9 BAHADUR SHAH ZAFAR MARG NEW DELHI 110002 Sep 2016 Price Group
Information Systems Security and Biometrics Sectional Committee, LITD 17 NATIONAL FOREWORD This Indian Standard which is identical with ISO/IEC TR 27008 : 2011 Information Guidance for auditors on ISMS controls (focused on the information security controls issued by the International Organization for Standardization (ISO) and International Electrotechnical Commission (IEC) jointly was adopted by the Bureau of Indian Standards on the recommendations of the Information Systems Security and Biometrics Sectional Committee and approval of the Electronics and Information Technology Division Council. The text of ISO/IEC Standard has been approved as suitable for publication as an Indian Standard without deviations. Certain conventions are however not identical to those used in Indian Standards. Attention is particularly drawn to the following: a) Wherever the words International Standard appear referring to this standard, they should be read as Indian Standard. b) Comma (,) has been used as a decimal marker while in Indian Standards, the current practice is to use a point (.) as the decimal marker. In this adopted standard, reference appears to certain International Standards for which Indian Standards also exist. The corresponding Indian Standards, which is to be substituted in its places is, listed below along with their degree of equivalence for the editions indicated: International Standard ISO/IEC 27000: 2009, Information systems Overview and vocabulary Corresponding Indian Standard IS/ISO/IEC 27000:2009 Information technology security techniques systems Overview and vocabulary Degree of Equivalence Identical For the purpose of whether deciding a particular requirement of this standard is complied with, the final value, observed or calculated, expressing the result of a test or analysis, shall be rounded off in accordance with IS 2 : 1960 Rules for rounding off numerical values (revised). The number of significant places retained in the rounded off value should be same as that of the specified value in this standard.
Doc No.: LITD 17 (10676) IS /ISO/IEC TR 27039 : 2015 भ रत य म नक न र य ग क सर ष तकन क अनग चत स तषप स न प यततय (आईड प एस) क चयन तन त एव रच लन Indian Standard INFORMATION TECHNOLOGY SECURITY TECHNIQUES SELECTION, DEPLOYMENT AND OPERATIONS OF INTRUSION DETECTION SYSTEMS (IDPS) ICS 35.040 BIS 2016 BUREAU OF INDIAN STANDARDS MANAK BHAVAN, 9 BAHADUR SHAH ZAFAR MARG NEW DELHI 110002 Sep 2016 Price Group
Information Systems Security and Biometrics Sectional Committee, LITD 17 NATIONAL FOREWORD This Indian Standard which is identical with ISO/IEC 27039 : 2015 Information technology Security techniques Selection, deployment and operations of intrusion detection systems (IDPS) issued by the International Organization for Standardization (ISO) and International Electrotechnical Commission (IEC) jointly was adopted by the Bureau of Indian Standards on the recommendations of the Information Systems Security and Biometrics Sectional Committee and approval of the Electronics and Information Technology Division Council. The text of ISO/IEC Standard has been approved as suitable for publication as an Indian Standard without deviations. Certain conventions are however not identical to those used in Indian Standards. Attention is particularly drawn to the following: a) Wherever the words International Standard appear referring to this standard, they should be read as Indian Standard. b) Comma (,) has been used as a decimal marker while in Indian Standards, the current practice is to use a point (.) as the decimal marker. For the purpose of whether deciding a particular requirement of this standard is complied with, the final value, observed or calculated, expressing the result of a test or analysis, shall be rounded off in accordance with IS 2 : 1960 Rules for rounding off numerical values (revised). The number of significant places retained in the rounded off value should be same as that of the specified value in this standard.
Doc No.: LITD 17 (10677) IS /ISO/IEC 27040 : 2015 भ रत य म नक न र य ग क सर ष तकन क भ ड रण सर ष Indian Standard INFORMATION TECHNOLOGY SECURITY TECHNIQUES STORAGE SECURITY ICS 35.040 BIS 2016 BUREAU OF INDIAN STANDARDS MANAK BHAVAN, 9 BAHADUR SHAH ZAFAR MARG NEW DELHI 110002 Sep 2016 Price Group
Information Systems Security and Biometrics Sectional Committee, LITD 17 NATIONAL FOREWORD This Indian Standard which is identical with ISO/IEC 27040 : 2015 Information technology Security Techniques Storage security issued by the International Organization for Standardization (ISO) and International Electrotechnical Commission (IEC) jointly was adopted by the Bureau of Indian Standards on the recommendations of the Information Systems Security and Biometrics Sectional Committee and approval of the Electronics and Information Technology Division Council. The text of ISO/IEC Standard has been approved as suitable for publication as an Indian Standard without deviations. Certain conventions are however not identical to those used in Indian Standards. Attention is particularly drawn to the following: a) Wherever the words International Standard appear referring to this standard, they should be read as Indian Standard. b) Comma (,) has been used as a decimal marker while in Indian Standards, the current practice is to use a point (.) as the decimal marker. In this adopted standard, reference appears to certain International Standards for which Indian Standards also exist. The corresponding Indian Standards, which are to be substituted in their places are, listed below along with their degree of equivalence for the editions indicated: International Standard ISO/IEC 27000, Information systems Overview and vocabulary ISO/IEC 27001:2013, Information systems Requirements ISO/IEC 27005 Information technology Security techniques Information security risk management Corresponding Indian Standard Degree of Equivalence IS/ISO/IEC 27000 Information technology security techniques systems Overview and vocabulary(first Revision) Identical IS/ISO/IEC 27001:2013, Information systems Requirements -do- IS/ISO/IEC 27005, Information Code of practice for information -do-
security controls The technical committee has reviewed the provisions of following International Standard referred in this adopted standard and has decided that it is acceptable for use in conjunction with this standard: International Standard ISO/IEC 17788 Rec. ITU-T Y.3500 ISO/IEC 29100:2011 Title Information technology Cloud computing Overview and vocabulary1) Information Privacy framework For the purpose of whether deciding a particular requirement of this standard is complied with, the final value, observed or calculated, expressing the result of a test or analysis, shall be rounded off in accordance with IS 2 : 1960 Rules for rounding off numerical values (revised). The number of significant places retained in the rounded off value should be same as that of the specified value in this standard.
Doc No.: LITD 17 (10678) IS /ISO/IEC 27006 : 2015 भ रत य म नक न र य ग क सर ष तकन क न सर ष रब धन प यततय क आड टर एव रम णन उपल ध कर न क ललए तनक य क अप ष ए Indian Standard INFORMATION TECHNOLOGY SECURITY TECHNIQUES REQUIREMENTS FOR BODIES PROVIDING AUDIT AND CERTIFICATION OF INFORMATION SECURITY MANAGEMENT SYSTEMS ICS 35.040 BIS 2016 BUREAU OF INDIAN STANDARDS MANAK BHAVAN, 9 BAHADUR SHAH ZAFAR MARG NEW DELHI 110002 Sep 2016 Price Group
Information Systems Security and Biometrics Sectional Committee, LITD 17 NATIONAL FOREWORD This Indian Standard which is identical with ISO/IEC 27006 : 2015 Information Requirements for bodies providing audit and certification of information security management systems issued by the International Organization for Standardization (ISO) and International Electrotechnical Commission (IEC) jointly was adopted by the Bureau of Indian Standards on the recommendations of the Information Systems Security and Biometrics Sectional Committee and approval of the Electronics and Information Technology Division Council. The text of ISO/IEC Standard has been approved as suitable for publication as an Indian Standard without deviations. Certain conventions are however not identical to those used in Indian Standards. Attention is particularly drawn to the following: a) Wherever the words International Standard appear referring to this standard, they should be read as Indian Standard. b) Comma (,) has been used as a decimal marker while in Indian Standards, the current practice is to use a point (.) as the decimal marker. In this adopted standard, reference appears to certain International Standards for which Indian Standards also exist. The corresponding Indian Standards, which are to be substituted in their places are, listed below along with their degree of equivalence for the editions indicated: International Standard ISO/IEC 27000, Information systems Overview and vocabulary ISO/IEC 27001:2013, Information systems Requirements Corresponding Indian Standard Degree of Equivalence IS/ISO/IEC 27000, Information technology security techniques systems Overview and vocabulary(first Revision) Identical IS/ISO/IEC 27001:2013, Information systems Requirements -do-
The technical committee has reviewed the provisions of following International Standard referred in this adopted standard and has decided that it is acceptable for use in conjunction with this standard: International Standard ISO/IEC 17021-1:2015, Title Conformity assessment Requirements for bodies providing audit and certification of management systems Part 1: Requirements For the purpose of whether deciding a particular requirement of this standard is complied with, the final value, observed or calculated, expressing the result of a test or analysis, shall be rounded off in accordance with IS 2 : 1960 Rules for rounding off numerical values (revised). The number of significant places retained in the rounded off value should be same as that of the specified value in this standard.
Doc No.: LITD 17 (10679) IS /ISO/IEC 27017 : 2015 भ रत य म नक न र य ग क सर ष तकन क ल उड स व ओ क न सर ष क र ल क र तत स ह त Indian Standard INFORMATION TECHNOLOGY SECURITY TECHNIQUES CODE OF PRACTICE FOR INFORMATION SECURITY CONTROLS BASED ON ISO/IEC 27002 FOR CLOUD SERVICES ICS 35.040 BIS 2016 BUREAU OF INDIAN STANDARDS MANAK BHAVAN, 9 BAHADUR SHAH ZAFAR MARG NEW DELHI 110002 Sep 2016 Price Group
Information Systems Security and Biometrics Sectional Committee, LITD 17 NATIONAL FOREWORD This Indian Standard which is identical with ISO/IEC 27017 : 2015 Information Code of practice for information security controls based on ISO/IEC 27002 for cloud services issued by the International Organization for Standardization (ISO) and International Electrotechnical Commission (IEC) jointly was adopted by the Bureau of Indian Standards on the recommendations of the Information Systems Security and Biometrics Sectional Committee and approval of the Electronics and Information Technology Division Council. The text of ISO/IEC Standard has been approved as suitable for publication as an Indian Standard without deviations. Certain conventions are however not identical to those used in Indian Standards. Attention is particularly drawn to the following: a) Wherever the words International Standard appear referring to this standard, they should be read as Indian Standard. b) Comma (,) has been used as a decimal marker while in Indian Standards, the current practice is to use a point (.) as the decimal marker. In this adopted standard, reference appears to certain International Standards for which Indian Standards also exist. The corresponding Indian Standards, which are to be substituted in their places are, listed below along with their degree of equivalence for the editions indicated: International Standard ISO/IEC 27000, Information systems Overview and vocabulary ISO/IEC 27002:2013, Information Code of practice for information security controls Corresponding Indian Standard Degree of Equivalence IS/ISO/IEC 27000, Information technology security techniques systems Overview and vocabulary(first Revision) Identical IS/ISO/IEC 27002:2013, Information Code of practice for information security controls -do-
The technical committee has reviewed the provisions of following International Standard referred in this adopted standard and has decided that it is acceptable for use in conjunction with this standard: International Standard Recommendation ITU-T Y.3500 (in force) ISO/IEC 17788: (in force) Recommendation ITU-T Y.3502 (in force) ISO/IEC 17789: (in force) Title Information technology Cloud computing Overview and vocabulary. Information technology Cloud computing Reference architecture For the purpose of whether deciding a particular requirement of this standard is complied with, the final value, observed or calculated, expressing the result of a test or analysis, shall be rounded off in accordance with IS 2 : 1960 Rules for rounding off numerical values (revised). The number of significant places retained in the rounded off value should be same as that of the specified value in this standard.
Doc No.: LITD 17 (10680) IS /ISO/IEC 27033-1 : 2015 भ रत य म नक न र ध ग क सर ष तकन क न टवकक सर ष भ 1 सस ह वल कन एव अवध रण ए ( पहल प नर षण ) Indian Standard INFORMATION TECHNOLOGY SECURITY TECHNIQUES NETWORK SECURITY PART 1 OVERVIEW AND CONCEPTS (First Revision) ICS 35.040 BIS 2016 BUREAU OF INDIAN STANDARDS MANAK BHAVAN, 9 BAHADUR SHAH ZAFAR MARG NEW DELHI 110002 Sep 2016 Price Group
Information Systems Security and Biometrics Sectional Committee, LITD 17 NATIONAL FOREWORD This Indian Standard (Part 1) which is identical with ISO/IEC 27033-1 : 2015 Information network security Part 1 overview and concepts issued by the International Organization for Standardization (ISO) and International Electrotechnical Commission (IEC) jointly was adopted by the Bureau of Indian Standards on the recommendations of the Information Systems Security and Biometrics Sectional Committee and approval of the Electronics and Information Technology Division Council. This standard was originally published in 2013 and was identical with 27033-1 : 2009 and has now been revised to align it with the latest version of ISO/IEC 27033-1. The text of ISO/IEC Standard has been approved as suitable for publication as an Indian Standard without deviations. Certain conventions are however not identical to those used in Indian Standards. Attention is particularly drawn to the following: a) Wherever the words International Standard appear referring to this standard, they should be read as Indian Standard. b) Comma (,) has been used as a decimal marker while in Indian Standards, the current practice is to use a point (.) as the decimal marker. In this adopted standard, reference appears to certain International Standards for which Indian Standards also exist. The corresponding Indian Standards, which are to be substituted in their places are, listed below along with their degree of equivalence for the editions indicated: International Standard ISO/IEC 27000, Information systems Overview and vocabulary ISO/IEC 27002:2013, Information Code of practice for information security controls Corresponding Indian Standard Degree of Equivalence IS/ISO/IEC 27000, Information technology security techniques systems Overview and vocabulary(first Revision) Identical IS/ISO/IEC 27002:2013, Information Code of practice for information security controls -do-
The technical committee has reviewed the provisions of following International Standard referred in this adopted standard and has decided that it is acceptable for use in conjunction with this standard: International Standard Recommendation ITU-T Y.3500 (in force) ISO/IEC 17788: (in force) Recommendation ITU-T Y.3502 (in force) ISO/IEC 17789: (in force) Title Information technology Cloud computing Overview and vocabulary. Information technology Cloud computing Reference architecture For the purpose of whether deciding a particular requirement of this standard is complied with, the final value, observed or calculated, expressing the result of a test or analysis, shall be rounded off in accordance with IS 2 : 1960 Rules for rounding off numerical values (revised). The number of significant places retained in the rounded off value should be same as that of the specified value in this standard.