ISO IEC TR 27008

What are Information Security Controls?

Information security controls are steps taken to mitigate information security vulnerabilities such as device failures, data theft, system breaches and unintended modifications to digital information or processes.

These security controls are usually applied in response to an information security risk evaluation in order to better secure the availability, confidentiality, and privacy of data and networks.

These controls safeguard the confidentiality, integrity, and availability of information in the field of information security.

Types of Information Security Controls

Security protocols, procedures, schedules, devices, and applications all fall into the category of information security controls.

1. Preventive security controls, security protocols that are intended to avert cybersecurity accidents
2. Detective security controls aimed at identifying and alerting cybersecurity staff to a cybersecurity intrusion attempt or potential security breach.
3. Corrective security controls are used after a cybersecurity event to help mitigate data loss and device or network disruption and to easily recover sensitive business systems and operations.

Additionally, security measures can be categorised according to their purpose, as follows:

Access controls:

These include physical entry monitors such as armed guards at building exits, locks, and perimeter fences.

Procedural controls:

Threat awareness instruction, security framework enforcement training, and incident response processes and procedures.

Technical controls:

These include multi-factor account authentication at the point of entry (login) and logical access controls, antivirus applications, and firewalls.

Compliance controls:

These include privacy rules, frameworks, and requirements, as well as cybersecurity approaches and standards.

What is the Purpose of ISO 27008?

ISO 27008 was created to:

• Assists in the preparation and implementation of ISMS audits and the method of information risk management;
• Provide guidelines for auditing information security controls in accordance with ISO/IEC 27002’s controls guidance;
• Enhances ISMS audits by optimising the relationships between ISMS processes and necessary controls;
• Assures the audit resources are used effectively and efficiently.
• Add value and improves the consistency and benefit of the ISO 27k specifications by bridging the difference between updating the ISMS in principle and, where necessary, checking proof of applied ISMS controls (e.g., evaluating security elements of business operations, IT structures, and IT operating environments in ISO27k user organisations);

What is the Scope of ISO 27008?

ISO 27008 provides guidance to all auditors on information security management systems controls. It guides the information risk management process as well as internal, external, and third-party assessments of an ISMS by demonstrating the association between the ISMS and its accompanying controls.

It includes guidelines on how to test the extent to which necessary “information security management system controls” are applied. Additionally, it assists organisations that are implementing ISO/IEC 27001 or ISO/IEC 27002 in meeting compliance criteria and serving as a technical platform for information technology governance.

How does ISO 27008 Work?

ISO 27008 defines general procedures, not techniques for any particular control or forms of controls.

It defines systematic reviews and then outlines the various approaches and forms of reviews that are applicable to information security controls. Finally, it discusses the practices required for a successful review process.

Relationship with ISO 27001 and ISO 27002

ISO 27008 is closely similar to the ISO 27007 audit specification for information security management systems.

However, unlike ISO 27007, which focuses on reviewing the management system components of an ISMS as defined in ISO 27001, ISO 27008 focuses on auditing specific information security controls, such as those listed in ISO 27002 and detailed in ISO 27001’s Annex A.

ISO 27008 “focuses on evaluations of information security controls, including regulatory compliance, against an organisation-established information security implementation standard.

It is, however, not intended to provide detailed guidelines on compliance testing with respect to the calculation, risk evaluation, or audit of an ISMS, as specified in ISO 27004, ISO 27005, or 27007, respectively.

Who Should Implement ISO 27008?

ISO 27008 is intended for internal and external auditors charged with the responsibility of reviewing information management controls that are part of an ISMS. It would, however, be beneficial to anyone doing an analysis or assessment of an ISMS’s controls, whether as part of a structured audit procedure or otherwise. The document is primarily intended for information security auditors who are responsible for verifying that an organisation’s information security controls are technically compliant with ISO/IEC 27002 and all other control requirements used by the organisation.

ISO 27008 will assist them in the following ways:

• Recognise and comprehend the scope of possible issues and weaknesses in information security controls.
• Identify and comprehend the possible consequences of inadequately mitigated computer technology risks and weaknesses for the company.
• Prioritise risk control practices related to information management.
• Ascertain that previously found or newly discovered vulnerabilities or defects have been resolved sufficiently.

ISO 27008 is applicable to a broad range of organisations, including public and private businesses, government agencies, and not-for-profit organisations.