What is the difference between ISO 27000:2018 and ISO 27001:2013?

Simply put, ISO 27000:2018 establishes goals to be achieved, while ISO 27001:2013 outlines the steps that need to be taken to reach those goals.

ISO 27000 sets out the following core principles for an organization's security program:

• Information Security Awareness
• Allocation of responsibility
• Management Commitment
• Improving social value
• Risk assessment and risk tolerance considerations
• Implementing security as an integral part of networks and systems
• Actively detect and prevent security incidents
• A comprehensive approach to information security management

ISO 27001 places emphasis on best practice, requires the establishment of an Information Security Management System (ISMS) consisting of policies and procedures, and sets out five processes to achieve the basic elements of security.

• Establishment
• Implementation
• operation
• surveillance
• evaluation
• improvement

The 10 clauses of ISO 27000:2013

Many of the clauses appear quite vague at first glance, and they are. ISO has adopted a risk-based approach to establishing an ISMS, but this does not mean that companies can just do as they please.

The first three clauses provide basic terminology and scope, while clauses 4 to 10 provide more detailed provisions, including:

• Article 4: Organizational Status
• Article 5: Leadership
• Article 6: Planning
• Article 7: Support
• Article 8: Operation
• Article 9: Performance Evaluation
• Article 10: Improvement

ISO provides detailed definitions within the clauses, but at a fairly high level. The meat of how to achieve ISO compliance is in Annex A, which lists 114 control points aligned to 10 clauses.

Position of SaaS security in ISO compliance

The problem with understanding the importance of SaaS security within the context of ISO is that it doesn't specifically mention SaaS applications. Because ISO works as a risk-based framework, security teams must start by identifying the risks that SaaS applications pose and then bring those risks under control.

It would take too long for this article to cover all of the controls outlined in ISO 27001, but we will provide a few examples to give you a sense of where SaaS security and SaaS Security Posture Management (SSPM) fit into your ISO compliance plan.

access control

Access control involves ensuring that all users are assigned the appropriate access rights necessary to perform their job functions.

Ensuring SaaS security based on this requirement is not easy, as you need to ensure that the following sub-requirements are met:

• Access Control Policy: Establish, document, and review access requirements
• Privileged Access Management: Restrict and allocate privileged access
• Review user access rights: Regularly review access rights to ensure compliance with access control policies
• Remove or adjust access: Remove access for all employees and external users
• Information access restriction: Restrict access based on access control policies

Operational Security

Operational security is the process of ensuring correct and secure operations at any information processing facility. In cloud environments, the lack of visibility often makes operational security difficult to manage.

Ensuring SaaS security based on this requirement is not easy, as you need to ensure that the following sub-requirements are met:

• Document operational procedures: Document operational procedures and make them available to all users who need them.
• Change Management: Managing all changes to the organization, business processes, and information processing facilities and systems that affect information security.
• Capacity Management: Monitor and adjust to ensure system performance requirements are maintained while resources are utilized
• Malware Controls: Strengthening malware protection through proper detection, prevention and remediation
• Event logging: Records user activity, anomalies, failures, and events
• Technical vulnerability management: monitoring systems for exposure to threats and taking steps to address risks
• Audit control of information systems: Plan activities to minimize disruption to business operations

compliance

This requirement focuses on complying with legal, statutory, regulatory or contractual obligations.

Ensuring SaaS security based on this requirement is not easy, as you need to ensure that the following sub-requirements are met:

• Privacy and Personally Identifiable Information (PII) Protection: Protecting personal information as required by relevant laws and regulations
• Third-party audits of information security: External audits are conducted at scheduled intervals to check the implementation of the ISMS
• Compliance with security policies and standards: Periodic reviews by administrators or application owners to ensure that appropriate security policies, standards, or other security requirements are being applied.
• Technical compliance review: Regularly reviewing information systems to ensure they comply with the organization's information security policies and standards