Information Security Management System ISO/IEC 27001:2005 ISMS A Copyright JIPDEC ISMS,

Information Security Management System ISMS ISO/IEC 27001 ISMS () ISMS ISMS 200512 Copyright JIPDEC ISMS, 2005 1

Information Security Management System ISO/IEC 27001:2005 ISMS A Copyright JIPDEC ISMS, 2005 2

Information Security Management System ISO/IEC 27001:2005 ISMS (Ver.2.0) ISO/IEC 27001:2005 ISMS (Ver.2.0) : A B OECD C ISO9001:2000 ISO14001:2004 ISO/IEC 27001:2005 JIPDEC ISMS URLhttp://www.isms.jipdec.jp Copyright JIPDEC ISMS, 2005 3

Copyright JIPDEC ISMS, 2005 4 Information Security Management System

Copyright JIPDEC ISMS, 2005 5 Information Security Management System

Information Security Management System Copyright JIPDEC ISMS, 2005 6

Copyright JIPDEC ISMS, 2005 7 Information Security Management System

Copyright JIPDEC ISMS, 2005 8 Information Security Management System

Copyright JIPDEC ISMS, 2005 9 Information Security Management System

A Information Security Management System A.5 A.6 A.7 A.8 A.9 A.10 A.11 3. 4. 5. 6. 7. 8. 9. A.12 A.13 A.14 10. 6.3 8.1.3 12.1.7 11. A.15 12. Copyright JIPDEC ISMS, 2005 10

Information Security Management System A ISO/IEC 27001:2005 133 ISMS Ver.2.0 127 +7 A.8.1 A.8.2 A.8.3 A.10.2 A.10.9 A.12.6 A.13.2-4 4. 3 6. 1 6. 2 7. 3 +17-11 A.6.1.1 A.8.3.1 A.10.2.3 4.(1) 9.(4) A.6.1.7 A.8.3.2 A.10.4.2 4.(1) 9.(5) A.6.2.2 A.7.1.2 A.8.3.3 A.9.1.4 A.10.9.2 A.10.10.3 4.(3) 6.(3) 10.(3) 10.(3) A.7.1.3 A.8.2.1 A.10.2.1 A.10.2.2 A.12.6.1 8.(1) 9.(4) 10.(3) Copyright JIPDEC ISMS, 2005 11

Copyright JIPDEC ISMS, 2005 12 Information Security Management System 7 6 5 4 3 2 1 --- A.10.2 6.(2) A.8.2 6.(1) A.8.1 8.(7) 10.8 10.9 A.10.9 --- A.8.3 ---- A.12.6 --- A.13.2 6.(3) 6.(3) 8.(1) 12.(1) A.13 4 3 2 1 7(3) A.11.3.3 7(3) A.9.2.7 7.(3) 7.(3) 7.(3) A.8.2 6.(2) A.8.1 6.(1) A.6.2 4.(3)

Copyright JIPDEC ISMS, 2005 13 Information Security Management System 11 10 9 8 7 6 5 4 3 2 1 A.6.1.1 4.(1) A.13.1.1 9.(5) A.11.4.2 9.(4) A.12.3.1 10.(3) A.12.3.1 10.(3) A.12.3.1 10.(3) A.13.1.1 6.(3) A.6.2.3 4.(3) A.6.1.1 4.(1) 9.(4) A.10.2 8.(1) 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 4.(1) A.6.1.1 --- A.8.3.3 --- A.8.3.2 --- A.10.4.2 --- A.10.2.3 --- A.10.2.2 --- A.10.2.1 7.(1) A.9.1.3 A.9.1.4 A.9.1.4 --- A.8.2.1 --- A.7.1.3 --- A.7.1.2 --- A.6.2.2 4.(1) A.6.1.6 A.6.1.7 A.6.1.7 --- A.10.9.2 --- A.8.3.1 A.10.10.3 ---- A.12.6.1

Information Security Management System ISO/IEC 27001:2005 ISMS (Ver.2.0) Copyright JIPDEC ISMS, 2005 14

Information Security Management System Copyright JIPDEC ISMS, 2005 15

Information Security Management System 0 ISO/IEC 27001:2005- - 0.2 PDCA ISMS 4.2.1 * 4.2.3b) 4.3.1a) 5.1a) - OECD *4.2.1 ISMS Copyright JIPDEC ISMS, 2005 16

Information Security Management System 1 ISO/IEC 27001:2005- - 1.1-1.2-1.1 1 business 2 ISO/IEC 17799:2005 1.2 MS Copyright JIPDEC ISMS, 2005 17

Information Security Management System 2 ISO/IEC 27001:2005- Copyright JIPDEC ISMS, 2005 18

3 Information Security Management System 3.1 NEW ISO/IEC 13335-1:2004 ISO/IEC 17799:2005 3.2 3.3 3.8 3.4 CIA 3.1 3.2 3.5 3.3 ISO/IEC 17799:2000 JIS X 5080-2002 ISO/IEC TR 18044:2004 3.5 3.6 NEW NEW 3.7 3.4 ISO/IEC Guide 73:2002 3.9 3.10 3.11 3.12 3.13 3.14 3.15 3.16 NEW 3.6 3.7 3.8 3.9 3.10 3.11 3.12 ISO/IEC Guide 73:2002 TR Q 0008:2003 Copyright JIPDEC ISMS, 2005 19

Information Security Management System 4 4.1 1 2 ISMS ISMS ISMS 3.7 3.7 information security management system, ISMS 0.1 5.1e) 5.2.1a) Copyright JIPDEC ISMS, 2005 20

Copyright JIPDEC ISMS, 2005 21 Information Security Management System e)2) vulnerabilities, para1 e) 2) 4 2.(1) 4.2.1c)2) f) ISO/IEC Guide 73 *ISO/IEC Guide 73:2002 TR 0008:2003 3.3.1 3.3.2 3.3.6 1) 4) 4 2.(1) 4.2.1c)2) para1 Ver.2.0 para2 4.2.1b) para2 c)1)ver.2.0 para2 c)2)ver.2.0 para2 ISO/IEC 13335-3 para2 c) 3) ISMS 4)Ver.2.0 4.2.1c) ISMS b) 1) owner d) 1.2 ISMS a) 4.2.1 ISMS 1/2

Information Security Management System 4.2.1 ISMS 2/2 g) para2 para2 para3 A para4 Ver.2.0 A i) j) Ver.2.0 4 2.(1) 2) 3) )1)j)3) j)1) Ver.2.0 j)3) Ver.2.0 h) i) i) Copyright JIPDEC ISMS, 2005 22

Copyright JIPDEC ISMS, 2005 23 Information Security Management System 4.2.2 ISMS (4.2.3a) ) h) assess 4.2.3c) d) ISMS g) ISMS f) b) c) e) a)

Copyright JIPDEC ISMS, 2005 24 Information Security Management System 4.2.3 ISMS ( 5) ISMS ISMS 5) 6) d) Ver.2.0 1 7.1 6 7.1 f) h) g) 6 e) b) c) 4) a)

Information Security Management System 4.2.4 ISMS a) b) c) d) Copyright JIPDEC ISMS, 2005 25

Copyright JIPDEC ISMS, 2005 26 Information Security Management System 4.3.1 * (4 2.(1) ) Ver.2.0para2 4.3.2 i) e) f) h) c) b) Ver.2.0 4 3.(1) b) c) d) 4.2.3c) g) 13 ISMS 4.2.1b) a) para1 para2 ISMS Para1 para3

Copyright JIPDEC ISMS, 2005 27 Information Security Management System 4.3.2 4.3.3 d) f) g) h) i) j) 4.3.3 para1 para2 para3 e) 4.3.2 para1 a) b) c)

Copyright JIPDEC ISMS, 2005 28 Information Security Management System 5.1 5.2 ISMS ISMS b) f) h) ISMS ISMS ISMS a) ISMS ISMS 3.7 ISMS e) a) 5.2.2 para1 Ver.2.0 b) c) ISO 9001 b) b) c) d) e) f) 5.2.1 para1 ISMS ISMS a) ISMS 6 g) d) para2 c) d) 5.1 para1 5

Information Security Management System 6 ISMS ISMS Ver.2.0 6.4 ISMS para1 para2 para3 para4 ISO 19011:2002 Copyright JIPDEC ISMS, 2005 29

Information Security Management System 7 ISMS 7.1 7.2 7.3 7.1 1 Ver.2.04 2.(3) 6 1.7.1 the security policy and security objectives information security policy and information security objectives 7.3 para1 a) b) 6 3.7.3 7.2 para1 a) b) c) d) e) 6 2.7.2 c) 4) 5) 6) f) g) h) i) e) d) Copyright JIPDEC ISMS, 2005 30

8 ISMS Information Security Management System 8.1 8.2 8.3 8.1 7 7 1.8.1 security objectives information security objectives Ver.2.0 8.3 para1 ISMS 7.8.3 a) 8.2 para1 ISMS ( ISMS 7 2.8.2 b) a) Ver.2.0 ISMS c) d) e) Ver.2.0 7.3 para2 b) c) d) e) f) para2 para3 Ver.2.07.3 Ver.2.0para1 Copyright JIPDEC ISMS, 2005 31

Information Security Management System ISMS () ISMS Tel: 03-3432-9386 FAX: 03-3432-6200 E-mail: info@isms.jipdec.jp Web: http://www.isms.jipdec.jp/ Copyright JIPDEC ISMS, 2005 32