Cissp: Security Frameworks

Front 1

British Standard 7799 (BS7799)

Back 1

was developed in 1995 by the United Kingdom government’s Department of Trade and Industry and published by the British Standards Institution. The standard outlines how an information security management system (ISMS) (aka security program) should be built and maintained. The goal was to provide guidance to organizations on how to design, implement, and maintain policies, processes, and technologies to manage risks to its sensitive information assets.

Front 2

ISO/IEC 27000

Back 2

Overview and vocabulary (ISO/IEC)

Front 3

ISO/IEC 27001

Back 3

ISMS requirements (ISO/IEC)

Front 4

ISO/IEC 27002

Back 4

Code of practice for information security management (ISO/IEC)

Front 5

ISO/IEC 27003

Back 5

Guideline for ISMS implementation (ISO/IEC)

Front 6

ISO/IEC 27004

Back 6

Guideline for information security management
measurement and metrics framework (ISO/IEC)

Front 7

ISO/IEC 27005

Back 7

Guideline for information security risk management (ISO/IEC)

Front 8

ISO/IEC 27006

Back 8

Guidelines for bodies providing audit and certification of
information security management systems (ISO/IEC)

Front 9

ISO/IEC 27011

Back 9

Information security management guidelines for
telecommunications organizations (ISO/IEC)

Front 10

ISO/IEC 27031

Back 10

Guideline for information and communications technology readiness for business continuity (ISO/IEC)

Front 11

ISO/IEC 27033-1

Back 11

Guideline for network security (ISO/IEC)

Front 12

ISO 27799

Back 12

Guideline for information security management in health
organizations (ISO/IEC)

Front 13

Zachman framework

Back 13

is a two-dimensional model that uses six basic communication interrogatives (What, How, Where, Who, When, and Why) intersecting with different
viewpoints (Planner, Owner, Designer, Builder, Implementer, and Worker) to give a holistic understanding of the enterprise.

Front 14

The Open Group Architecture Framework
(TOGAF)

Back 14

a framework that can be used to develop the following architecture types:
Business Architecture, Data Architecture Applications Architecture, Technology Architecture
Uses Architecture Development Method (ADM), which is an iterative and cyclic process that allows requirements to be continuously reviewed and the
individual architectures updated as needed.

Front 15

Department of Defense Architecture Framework (DoDAF)

Back 15

focus of this architecture framework is on command, control, communications, computers,
intelligence, surveillance, and reconnaissance systems and processes. Emphasis on interoperability

Front 16

British Ministry of Defence Architecture Framework (MODAF)

Back 16

The crux of the framework
is to be able to get data in the right format to the right people as soon as possible.
Modern warfare is complex, and activities happen fast, which requires personnel and systems to be more adaptable than ever before. Data needs to be captured and properly presented so that decision makers understand complex issues quickly, which allows for
fast and hopefully accurate decisions.

Front 17

Sherwood Applied Business Security Architecture (SABSA)

Back 17

Similar to the Zachman model.
Layered model with its first layer defining business requirements from a security perspective. Each layer
of the model decreases in abstraction and increases in detail so it builds upon the others and moves from policy to practical implementation of technology and solutions. The idea is to provide a chain of traceability through the strategic, conceptual, design, implementation, and metric and auditing levels.