Applying the ISO 27005 risk management standard
ISO 27005, issued in 2008, filled a noticeable gap in the ISO 27000 series of standards. The standard is officially titled ISO/IEC 27005.2008, “Information technology — Security techniques — Information security risk management.”
It took the International Organization for Standardization three years to document the standards for the risk management methodology. Now, just as ISO 27005 is gaining traction, the same organization has issued a new standard, ISO 31000.2009, “Risk management — Principles and guidelines.” As a result, some bewilderment has been re-introduced to an already confusing topic.
See Applying the ISO 27005 risk management standard by Steven J. Ross for SearchCompliance.com.
=============================================
The relationship between Business Continuity and Risk Management are addressed in the book A Risk Management Approach to Business Continuity: Aligning Business Continuity with Corporate Governance, by David Kaye and Julia Graham.
Tags: Information security risk management, ISO 27005, risk management standard
