Reading time: ~ 3 min.

If we reflect on the others ISO standards we can put in relation with this ISO/IEC 27035-2, we can easily find out these ones:

• ISO 27001 Information Security Standards (in particular Appendix A);
• ISO 20000-1 Services (clause 8.6.1 incident management)
• ISO 22301 Business continuity.

Reading time: ~ 3 min.

If you think about information security incident management, you can of course immediately put it in direct correlation with the data breaches requirements set by the law on data protection as the European General Data Protection Regulation or the Swiss Federal Act on Data Protection.

Reading time: ~ 3 min.

L'objectif de l'informatique à haute vélocité peut être atteint en adoptant les pratiques ITIL4, telles que:

• la gestion de la stratégie : cette pratique assure une approche globale des besoins futurs de l'entreprise en matière de services.
• L'analyse de l'activité : cette pratique garantit une approche globale des besoins actuels de l'entreprise en matière de services, ainsi que de l'utilisation actuelle des services.
• Développement et gestion de logiciels : cette pratique permet de réduire au maximum les délais de mise sur le marché de services logiciels informatiques nouveaux ou modifiés.
• Validation et test des services : cette pratique protège le niveau de qualité des services informatiques en garantissant que ces services fonctionnent correctement et répondent aux besoins des clients.
• Gestion des versions : cette pratique garantit les environnements pour une collaboration efficace entre l'informatique et l'entreprise dans toutes les phases du cycle de vie des services.
• Gestion du déploiement : cette pratique garantit que les services informatiques sont bien déployés quand et où les utilisateurs en ont besoin.
• Amélioration continue : cette pratique garantit que cet objectif est continuellement atteint.

L'objectif des programmes/projets OTIFOB peut être atteint en adoptant les pratiques ITIL4 :

Reading time: ~ 3 min.

The ISO/IEC 27013:2021 standard on «Information security, cybersecurity and privacy protection— Guidance on the integrated implementation of ISO/IEC 27001 and ISO/IEC 20000-1» provides a guide for all the organizations that try to:

• manage the implementation of ISO/IEC 27001 after the one of the ISO/IEC 20000-1 standard (or vice versa);
• lead the implementation of the two standards (27001 and 20000-1) together;
• organize the integration of management systems (already implemented according to ISO/IEC 27001 and ISO/IEC 20000-1.
  

If we take a closer look at the both of the ISO/IEC standards, we can notice that the relationship between information security management (according to ISO/IEC 27001 standard) and the IT service management (accordin to ISO 20000-1 standard) is very close indeed.

As we can easily figure out, many organizations choose to integrate these management systems.

If we focus on the documentation, we can underline that there are also a lof of correlations with the management of compliance with personal data protection requirements as set by GDPR (General Data Protection Regulation, in the EU context) and the FADP (Federal Act on Data Protection - LPD, «Loi fédérale sur la Protection des données» or «Legge sulla protezione dei dati» | DSG, Bundesgesetz über den Datenschutz, in Switzerland).

We could also identify along the main benefits of an integration implementation of the information security management and service management the following:

• more credibility to the internal and external customers, and other stakeholders;
• lower cost of implementing, maintaining and auditing an integrated management system;
• substantial reduction in implementation time due to the integrated development of processes;
• last but not least: an organization certified for ISO/IEC 27001 can more easily fulfil the requirements for information security specified in ISO/IEC 20000-1:2018, 8.7.3, as ISO/IEC 27001 and ISO/IEC 20000-1 are complementary in requirements.

As we use to better focus on things with the help of our infographic, we're going to use one of them also in this case...

Reading time: ~ 3 min.

The ISO/IEC 27557:2022 standard on «information security, cybersecurity and privacy protection– application of ISO 31000:2018 for organizationl privacy risk management» provides a framework for assessing organizational privacy risk.

It is important to note that this framework takes into consideration the privacy impact as a component of the overall organizational risk and particularly in the way that follows:

• the organizational consequences of adverse privacy impacts on individuals;
• the organizational consequences of privacy events that damage the organization itself (e.g. by harming its reputation) without causing any kind of privacy impacts to individuals.

It is useful to remember that ISO/IEC 27557:2002 standard is based on the «ISO 31000:2018 – Risk Management – Guidelines».

This standard includes some specific considerations for organizational privacy risk and to support the organizations on the implementation of a Privacy Information Management System (PIMS), according to the «ISO/IEC 27701:2019 Security  techniques– Extension to ISO/IEC 27001 and ISO/IEC 27002 for privacy information management – Requirements and guidelines» standard.

The ISO/IEC 27557 standard therefore can be used for integrating risk management and compliance between the privacy requirements set by the EU GPDR and the Swiss FADP (known as LDP and DSG).

It sounds quite interesting but it is a little bit confusing to figure out just considering our brief recap? Let's try to look at things from a different perspective with the help of our steady infographic.

Temps de lecture: ~ 3 min.

En effet, même les entreprises non-TIC dépendent de plus en plus du soutien des services TIC pour fournir des produits et des services qui répondent aux besoins de leurs clients.

Il existe donc une relation de plus en plus directe entre la norme ISO 20000-1 et la norme ISO 9001 pour les systèmes de management de la qualité.

Voici ce qu'ils sont les systèmes de management les plus étroitement liés aux systèmes de gestion des services informatiques selon la norme ISO 20000-1:

• systèmes de management de la qualité selon la norme ISO 9001;
• systèmes de gestion de la sécurité de l'information selon la norme ISO 27001;
• systèmes de gestion de la continuité des activités selon la norme ISO 22301.

Reading time: ~ 4 min.

1. Organization Controls (aspects related to the organization)
2. People Controls (details on single individual)
3. Physical Controls (objects and aspects related to physical & environmental matters)
4. Technological Controls (aspects related to the technology)
   

The first ISO 27002:2022 standard control attribute we are going to analyse - according to our infographic - is the «Control Type» one.

This one sets the way you can look at the controls from a perspective of «when and how the control modifies the risk» with regard to the occurence of an information security incident.

• Preventive (the control that is intended to prevent the occurrence of an information security incident);
• Detective (the control acts when an information security incident occurs);
• Corrective (the control acts after an information security incident occurs).

The second of the controls attributes set by the ISO 27002:2022 standard we take into consideration is the «Information Security Properties» one.

In this case, the attribute set a point of view of the controls according to the perspective of

• Confidentiality;

• Integrity;

• Availability.
  

The third of all the controls attributes recognised by the ISO 27002:2022 standard we are considering is the «Cybersecurity concepts» one.

The fourth attribute of the updated version of ISO 27002:2022 standard we are going to consider is the «operational capabilities» one.

This attribute helps us to view the controls from a «practioner's perspective of information security capabilities».

In this case, the attribute values are:

The last of all the ISO 27002:2022 standard controls attributes we are going to mention is the one known as «Security domains».

This attribute provides us a controls view according to the «perspective of four information security domains», which are:

If you want to download our breakdown document, subscribe to our newsletter. Every month we update you with all the most relevant topics for our ICT Service Management professional community and we give you some preview of «what is happening behind the scenes».

Temps de lecture: ~ 4 min.

1. Votre organisation est-elle prête à une gestion agile des services ? (C’est-à-dire : La question du «quand»).
2. ITIL^®4 est adapté à un contexte de type «waterfall» ainsi qu’à un contexte agile. Comment ? (La question du «comment»).
3. Pourquoi le principe directeur «avancer par itération avec des retours» n’est-il pas limité à l’agilité ? (La question du «pourquoi»).

• Domaine 1: Flexibilité du périmètre => Au niveau 5 : les parties prenantes n’ont aucun problème avec le fait que tout changement de périmètre est inévitable et est un facteur clef de succès d’un produit.

• Domaine 2 : Niveau de collaboration => Au niveau 5 : il y a un niveau très élevé de collaboration entre les parties prenantes.

• Domaine 3 : facilité de communication => Au niveau 5 : la communication est très aisée entre les parties prenantes.
• Domaine 4 : Capacité à travailler en mode itératif et incrémental => Au niveau 5 : il est aisé de fournit de la Valeur au client sous la forme d'incréments réguliers d'un produit.
• Domaine 5 : environnement propice à l’agilité => Au niveau 5 : l’environnement de l'organisation supporte les techniques agiles.
• Domaine 6 : Acceptance de l’agilité => Au niveau 5 : toutes les parties prenantes connaissent les comportements, concepts et techniques agiles.

Reading time: ~ 3 min.

• organizational controls (organizational aspects);
• people controls (single individual);
• physical controls (physical & environmental objects and aspects);
• technological controls (technological aspects).

• Control type (perspective of when and how control changes risk);
• Information security properties (integrity, availability and confidentiality perspective);
• Cybersecurity concepts (perspective of the association of controls to information security);
• Operational capabilities (perspective of operations for information security);
• Security domains (perspective of governance, protection, defense and resilience).

Reading time: ~ 3 min.

• corporate governance;
• quality requirements;
• IT infrastructure;
• business continuity;
• data protection.
  

• ISO 38500 for the ICT Governance;
• ISO 31000 for the Risk Management;
  
• ISO 37301 for the Compliance Management.