What is ISO/IEC TS 27008:2017 ?

ISO/IEC TS 27008:2017, also known as Information technology - Security techniques - Guidelines for the assessment of information security controls, is an international standard that provides guidance on information security control assessments. The purpose of this standard is to establish guidelines for conducting information security control assessments and to help organizations identify areas where improvements are needed.

ISO/IEC TS 27008:2017 is a technical specification developed by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) that focuses specifically on managing the financial aspects of information security management systems (ISMS). The standard provides guidance on how to measure the effectiveness of existing controls, determine new investments, and evaluate the return on investment (ROI).

ISO/IEC TS 27008:2017 aims to assist organizations in aligning their information security expenditures with their risk management strategies and business objectives. It helps organizations make informed decisions about information security controls and ensures that resources are allocated and utilized effectively.

ISO/IEC TS 27008:2017 provides guidance on the implementation of information security controls based on ISO/IEC 27001, which is a standard that outlines a framework for implementing an information security management system (ISMS). By following the guidelines provided in ISO/IEC TS 27008:2017, organizations can identify areas where improvements are needed and take appropriate actions to enhance their security controls.

In conclusion, ISO/IEC TS 27008:2017 is an important standard that provides guidance on information security control assessments and helps organizations align their information security expenditures with their risk management strategies and business objectives. By following the guidelines provided in this standard, organizations can identify areas where improvements are needed and take appropriate actions to enhance their security controls.