I'm doing research into ISO 17799:2005, more specifically its policies related to risk management and its involvement on risk management in the wider IT sector, but I can't find out the answer to:

Was ISO 17799:2005 the first standard to introduce risk management? If not, when and how does this iteration of risk management relate in comparison to the other standards?

The actual ISO document itself: https://www.sans.org/media/score/checklists/ISO-17799-2005.pdf

  • 1
    Hi, it would help people answering your question to know what you've found in your own research so far so that we can better frame our answers inside your existing knowledge. – Adonalsium Jan 31 at 15:27
  • @Adonalsium Sure, basically I've only found out that 17799 introduced (as far as I know) the underlying need for a risk assesment which you would then base the IT security controls upon. informationshield.com/papers/SecurityPolicyAndIso17799.pdf en.wikipedia.org/wiki/ISO/IEC_27002#Access_control – College Ameteur Jan 31 at 16:08
  • 1
    When you ask "the first standard" - what kind of standards are included here? There exist a lot of standards or best practices. Risk analysis is way older than information technology and has always been there since electronic processing of data has existed. In the end risk analysis is just another form of fortune telling: en.wikipedia.org/wiki/A%C5%A1ipu – Tom K. Jan 31 at 16:29
  • @TomK. I mean only in relation to IT standards, the first ISO standard to introduce risk management or if it wasn't; what was the first one? – College Ameteur Jan 31 at 16:44
  • Did you mean ISO 17799 or ISO 17799:2005? Because there was a 17799:2000 that came out 5 years earlier ... – schroeder Jan 31 at 17:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.