Detail

ISO 27001 provides only an outline of each aspect of ISMS. Specific advice can be found in additional standards. ISO 27002 is one of the additional standards. An example can be found below.

From ISO 27001

A.6.2.1 Mobile Device Policy in ISO 27001:2013

Control

A policy and supporting security measures should be adopted to manage the risks introduced by using mobile devices.

From ISO 27002

A.6.2.1 Mobile Device Policy in ISO 27001:2013

Control

A policy and supporting security measures should be adopted to manage the risks introduced by using mobile devices.

Implementation Guidance

When using mobile devices, special care should be taken to ensure that business information is not compromised. The mobile device policy should take into account the risks of working with mobile devices in unprotected environments.

The mobile device policy should consider:

1. a) registration of mobile devices;
2. b) requirements for physical protection;
3. c) restriction for software installation;
4. d) requirements for mobile device software versions and for applying patches;
5. e) restriction of connection to information services;
6. f) access controls;
7. g) cryptographic techniques;
8. h) malware protection;
9. i) remote disabling, erasure or lockout;
10. j) backups;
11. k) usage of web services and web apps.

Care should be taken when using mobile devices in public places, meeting rooms and other unprotected areas. Protection should be in place to avoid the unauthorized access to or disclosure of the information stored and processed by these devices, e.g. using cryptographic techniques and enforcing the use of secret authentication information.

Mobile devices should also be physically protected against theft especially when left, for example, in cars and other forms of transport, hotel rooms, conference centres and meeting places. A specific procedure taking into account legal, insurance and other security requirements of the organization should be established for cases of theft or loss of mobile devices. Devices carrying important, sensitive or critical business information should not be left unattended and, where possible, should be physically locked away, or special locks should be used to secure the devices.

Training should be arranged for personnel using mobile devices to raise their awareness of the additional risks resulting from this way of working and the controls that should be implemented.

Where the mobile device policy allows the use of privately owned mobile devices, the policy and related security measures should also consider:

1. 1. a) separation of private and business use of the devices, including using software to support such separation and protect business data on a private device;
   2. b) providing access to business information only after users have signed an end user agreement acknowledging their duties (physical protection, software updating etc.), waiving ownership of business data, allowing remote wiping of data by the organization in case of theft or loss of the device or when no longer authorized to use the service. This policy needs to take account of privacy legislation.

Certification

You can only certify to ISO 27001 and not to ISO 27002. This is because ISO 27001 is the management standard providing a complete list of compliance requirements. ISO 27002, as a supplementary standard, addresses only one specific aspect of an ISMS.

Applicability

When implementing an ISMS, it is important to understand that not all security controls will be applied to your organization.

That is clearly mentioned in ISO 27001 where it specifies that organizations must conduct a risk assessment in order to identify and then prioritize information security threats.

ISO 27002 does not mention this part so if you were to only use this standard, it would be extremely difficult to figure out what controls an organization would need to adopt.