1

Sorry to ask this, I am quite new to Security area. Recently I am trying to introduce some security standards.

After some searching I found this out in this doc

Among them, ISO is the best-known standard for ISMS, which helps to establish and maintain an effective information management system via a continuous improvement approach.

And this statement in this site

One of the most in-demand IT certification is CISSP®, for Certified Information Systems Security Professionals.

I want to check the domains one by one to try my best to ensure the security management is well established based on worldwide sophisticated standards.

But as you can see, there are different domains in these standards.

Here are the domain comparisons among them I just drafted up based on ISO/IEC 27002 and CBK.

enter image description here

Which one should I turn to? To persuade my boss to apply?

By the way, to me the CBK is more like a examination stuff and quite unpractical.

Improve this question
4
  • 1
    The CISSP is not a standard at all. It's a personal professional certification. If you are looking for standards, remove the CISSP from consideration.
    – schroeder ♦
    Jul 2, 2018 at 10:49
  • 1
    Oh, yeah ~ You should be right. Thank you, @schroeder. I think I get the point: one for company certificate while CISSP for personal resume. Is it correct?
    – Hearen
    Jul 2, 2018 at 10:59
  • 1
    You are correct
    – schroeder ♦
    Jul 2, 2018 at 11:00
  • @schroeder Thank you, indeed. So confused I was, thank you
    – Hearen
    Jul 2, 2018 at 11:05

1 Answer 1

Reset to default
-1

I can see your confusion surrounding this topic.

To start off, the reason why you have the dilemma is because ISO 27001, ISO 27002 and CISSP CBK are all different from each other.

ISO 27001 is an organization-focused standard and provides requirements for your company's ISMS that can be audited.

ISO 27002 focuses on best practices on an individual level (code of practice for use by individuals within a company).

CISSP CBK is a comprehensive framework of all the relevant subjects a security professional should be familiar with (it's not a company standard you can certify your ISMS with).

That being said, if you want official recognition (certification) for your company's ISMS, then choose ISO 27001. ISO 27002 and CISSP CBK relate to security best practices for INDIVIDUALS within the company.

Improve this answer
3
  • 1
    While this answer is mostly correct, there is a major mistake here. ISO/IEC 27002 is not focused on individuals like CISSP CBK. While CISSP CBK is a personnel certification for individuals, ISO/IEC 27002 is an international standard for security controls within an organization. These security controls include for instance Human Resource Security but also a wide range of other topics. Also note, that an organization or an individual cannot be certified with ISO/IEC 27002.
    – Tom K.
    Jul 2, 2018 at 8:48
  • @stahinja Please review that ISO 27002 is: iso.org/standard/54533.html
    – schroeder ♦
    Jul 2, 2018 at 10:51
  • 1
    ISO 27001, ISO 27002 are not different from each other (one guides the other). CISSP is not even comparable to the others. Your ISO 27002 statement is factually incorrect.
    – schroeder ♦
    Jul 2, 2018 at 10:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .