View source for BS 7799

{{More citations needed|date=November 2010}}
'''BS 7799''' was a British standard "Code of Practice for Information Security Management", first published as such by the British Standards Institution (BSI) in February 1995. Read about the origins of BS 7799 [[ISO/IEC 27000-series|here]].
Subsequently, two further parts to BS 7799 were also published (the first becoming '''BS 7799 Part 1'''), by which time BSI had become [[BSI Group]].
The original BS 7799 outlined a structured approach to the management of information security but was primarily a description of some 127 information security controls in 10 sections or categories.  Each control was designed to address a specified control objective.
Some of the controls considered particularly important at the time were identified as 'key controls' indicated with a key icon in the margin.<ref name="Computer Bulletin article (1995)">{{cite web |last1=List |first1=William |title=BS 7799 The Code of Practice for information security management |url=https://academic.oup.com/itnow/article-abstract/37/6/8/502175 |website=academic.oup.com |access-date=30 November 2023}}</ref> Following pushback from the user and academic communities, however, the 'key control' concept was dropped when BS 7799 was revised in 1998. Users were encouraged to determine their own risks and objectives in order to select whichever controls were appropriate to their needs - a more fundamental and flexible approach applicable to organisations of all types, sizes and industries.
After a lengthy discussion by standards bodies through [[International Organization for Standardization|ISO]]/[[International Electrotechnical Commission|IEC]], BS 7799-1 was eventually fast-tracked and adopted as [[ISO/IEC 17799]], "Information Technology - Code of practice for information security management." in 2000.  [[ISO/IEC 17799]] was revised in June 2005, and renumbered [[ISO/IEC 27002]] in July 2007 when it was incorporated into the growing [[ISO/IEC 27000-series|ISO/IEC 27000 family of standards]].
'''BS 7799 Part 2''' "Information Security Management Systems - Specification with guidance for use." was first published by BSI Group in 1999 as a formal specification supporting conformity assessment and certification. BS 7799-2 explained how to design and implement an [[information security management system]] (ISMS) - a systematic approach to the governance and management of information security within an organisation. The 2002 version of BS 7799-2 introduced the Plan-Do-Check-Act ([[PDCA]]) (Deming cycle), aligning it with quality standards such as [[ISO 9000]].  BS 7799 Part 2 was adopted by ISO/IEC as [[ISO/IEC 27001]] in November 2005.
'''BS 7799 Part 3''' "Information security management systems - Guidelines for information security risk management" was first published by BSI Group in 2005. BS 7799-3 focuses on the identification, analysis, treatment and monitoring of information risks. It was adapted and adopted by ISO/IEC as [[ISO/IEC 27005]] in 2008. Meanwhile, BS 7799-3 continues to evolve in parallel.  It was revised in 2017 and a project was proposed in 2023 to simplify the guidance specifically for smaller organisations.<ref>{{cite web |last1=BSI |title=British Standards Institution - Project |url=https://standardsdevelopment.bsigroup.com/projects/9023-09086#/section |website=standardsdevelopment.bsigroup.com |access-date=30 November 2023}}</ref>
==See also==
*[[Cyber security standards]]
* [[ISO/IEC 27000-series]]
* [[ISO/IEC 27001]]
* [[ISO/IEC 27002]] (formerly [[ISO/IEC 17799]])
== References ==
{{Reflist}}
==External links==
* [http://www.bsi-global.com/ British Standards Institution] -> BSI Shop
* [http://www.17799central.com/cert.htm Certificate register] {{Webarchive|url=https://web.archive.org/web/20080509075707/http://www.17799central.com/cert.htm |date=2008-05-09 }}
* [https://web.archive.org/web/20050630074800/http://www.induction.to/bs7799/ BS 7799 Part 2 PDCA Methodology]
[[Category:British Standards|07799]]
[[Category:Computer security in the United Kingdom]]
[[Category:Computer security standards]]