4 Information security management system
4.1 General requirements
The organization shall establish, implement, operate, monitor, review, maintain and improve a documented ISMS within the context of the organization’s overall business activities and the risks it faces. For the purposes of this International Standard the process used is based on the PDCA model shown in Figure 1.
再次強調(diào)建立ISMS是需要在業(yè)務(wù)活動以及其面臨的風險范圍內(nèi)者甲。
4.2 Establishing and managing the ISMS
4.2.1 Establish the ISMS
標準為企業(yè)在建立ISMS列出了一些要求：
- Define the scope and boundaries of the ISMS in terms of the characteristics of the business, the organization, its location, assets and technology, and including details of and justification for any exclusions from the scope.
有理可依的定義ISMS的邊界和范圍灶似。
看到這里
看到這里，我發(fā)現(xiàn)我的積累并不能支持我去看27001，或者我的經(jīng)驗不夠，不夠支撐我能夠跳出一個技術(shù)人員的角度去看一個信息安全管理體系的建設(shè)。甚至都不能說明白ISMS是啥，更別說去梳理，了解ISMS的邊界和范圍钠怯。所以，這個暫時停更曙聂。
