【正文】 中國最大管理資源中心 第 1 頁 共 109 頁 BS7799 信息安全管理標(biāo)準(zhǔn) 中國最大管理資源中心 第 2 頁 共 109 頁 Worldwide Standards Having trouble locating an overseas standard? BSI has the solution… WITH BSI, YOUR SEARCH IS OVER BEFORE IT’S EVEN BEGUN Worldwide Standards Direct is the fast, costeffective standards service. Contact us on: Tel +44(0)20 8996 9001 Fax +44(0)20 8996 7001 中國最大管理資源中心 第 3 頁 共 109 頁 Information security management— Part 1: Code of practice for information security management 信息安全管理 第一部分：信息安全管理慣例 中國最大管理資源中心 第 4 頁 共 109 頁 目錄 Worldwide Standards ....................................................................................... 2 Having trouble locating an overseas standard? BSI has the solution… .................... 2 WITH BSI, YOUR SEARCH IS OVER BEFORE IT’S EVEN BEGUN ................. 2 第一部分：信息安全管理慣例 .......................................................................................... 3 序 ........................................................................................................................... 19 簡介 ........................................................................................................................ 20 什么是信息安全？ ............................................................................................ 20 為什么需要信息安全 ........................................................................................ 20 如何制定安全需求 ............................................................................................ 21 評估信息風(fēng)險 ................................................................................................... 21 安全控制的選擇 ............................................................................................... 21 信息安全的出發(fā)點(diǎn) ............................................................................................ 22 重要的成功因素 ............................................................................................... 22 開發(fā)你自己的指導(dǎo)方針 ..................................................................................... 22 ..................................................................................................................... 24 .......................................................................................................... 25 信息安全 .................................................................................................... 25 風(fēng)險評估 .................................................................................................... 25 風(fēng)險管理 .................................................................................................... 25 .............................................................................................................. 26 信息安全策略 ............................................................................................. 26 信息安全策略文件 ................................................................................ 26 復(fù)審及評估 .......................................................................................... 26 .............................................................................................................. 27 息安全架構(gòu) ................................................................................................. 27 管理信息安全論壇 ................................................................................ 27 信息安全的協(xié)調(diào) ................................................................................... 27 信息安全責(zé)任的分配 ............................................................................ 28 息處理設(shè)備的授權(quán)步驟 ......................................................................... 28 信息安全專家的意見 ............................................................................ 28 組織之間的合作 ................................................................................... 29 信息安全的獨(dú)立復(fù)審 ............................................................................ 29 第三方訪問的安全 ...................................................................................... 29 確認(rèn)第三方訪問的風(fēng)險 ......................................................................... 30 附錄 . ....................................................... .1 訪問的種類 ................................................................................................... 30 附錄 . ....................................................... .2 訪問的原因 ................................................................................................... 30 中國最大管理資源中心 第 5 頁 共 109 頁 附錄 . ....................................................... .3 現(xiàn)場合同方 ................................................................................................... 30 第三方合同的安全要求 ......................................................................... 30 外包服務(wù) .................................................................................................... 31 外包合同的安全要求 ............................................................................ 31 ...........................................................