Normes ISO/IEC 27000 sur la sécurité de l’information

Les normes ISO/IEC 27000 sur la sécurité de l’information (également connues sous le nom de ISO 27000 séries) sont développées et publiées par l’International Organization for Standardization (ISO) et l’International Electrotechnical Commission (IEC) afin de fournir un cadre reconnu au niveau international pour les bonnes pratiques liées à la gestion de la sécurité de l’information.

Cette page vous fournit des informations concernant les normes ISO 27000 et leurs bénéfices, une liste des normes publiées et en cours de développement ainsi que les liens vers notre boutique en ligne.

Pourquoi utiliser les normes ISO/IEC 27000 ?

Les entreprises alignant leurs pratiques de sécurité de l’information avec les normes de la série ISO/IEC 27000 peuvent :

Sécuriser leurs actifs critiques.
Gérer les risques de manière plus efficace.
Améliorer et maintenir la confiance de leurs clients.
Démontrer leur conformité avec les bonnes pratiques internationales.
Eviter les atteintes à l’image de marque, les pertes de revenu ou les amendes liées aux infractions règlementaires.
Développer leur sécurité de l’information ainsi que leurs technologies.

Les normes ISO 27000 sont vastes et peuvent concerner les entreprises de toute taille et de tout secteur. Alors que les technologies ne cessent d’évoluer, de nouvelles normes sont développées afin de répondre aux exigences changeantes liées à la sécurité de l’information.

Vous trouverez plus bas une liste des normes ISO 27000 en cours de développement.

Qu’est-ce que la norme ISO/IEC 27001 ?

Le pilier de la série de norme ISO 27001 est la norme ISO/IEC 27001:2013 (ou ISO 27001), mettant en avant les exigences d’audit et de certification pour l’ISMS (Système de Gestion de la Sécurité de l’Information) d’une entreprise. Toutes les autres normes de la série ISO 27000 sont des codes de pratique non-itératifs, fournissant les bonnes pratiques à suivre afin de supporter la norme ISO 27001.

Normes ISO 27000 publiées

Les normes publiées de la famille ISO 27000 :

ISO/IEC 27000

ISO/IEC 27000:2018 (ISO 27000) Information technology – Security techniques – Information security management systems – Overview and vocabulary.

ISO/IEC 27001

ISO/IEC 27001:2013 (ISO27001) Information technology – Security techniques – Information security management systems – Requirements. The latest version of the ISO 27001 Standard.
ISO/IEC 27001:2013/Cor 1:2014 (ISO27001) (ISO27001) Information technology – Security techniques – Information security management.
ISO/IEC 27001:2013/Cor 2:2015 (ISO27001) Information technology – Security techniques – Information security management systems – Requirements. The latest version of the ISO 27001 Standard.

ISO/IEC 27002

ISO/IEC 27002:2013 (ISO 27002) Information technology – Security techniques – Code of practice for information security controls. The latest version of the code of practice for information security controls.
ISO/IEC 27002:2013/Cor 1:2014 (ISO 27002) Information technology – Security techniques – Code of practice for information security controls. The latest version of the code of practice for information security controls.
ISO/IEC 27002:2013/Cor 2:2015 (ISO 27002) Information technology – Security techniques – Code of practice for information security controls. The latest version of the code of practice for information security controls.

ISO/IEC 27003

ISO/IEC 27003:2017 (ISO 27003) Information technology – Security techniques – Information security management system implementation guidance.

ISO/IEC 27004

ISO/IEC 27004:2016 (ISO 27004) Information technology – Security techniques – Information security management – Monitoring, measurement, analysis and evaluation.

ISO/IEC 27005

ISO/IEC 27005:2011 (ISO 27005) Information technology - Security techniques - Information security risk management.

ISO/IEC 27006

ISO/IEC 27006:2015 (ISO 27006) Information technology – Security techniques – Requirements for bodies providing audit and certification of information security management systems.

ISO/IEC 27007

ISO/IEC 27007:2017 (ISO 27007) Information technology – Security techniques – Guidelines for information security management systems auditing.

ISO/IEC 27008

ISO/IEC TR 27008:2011 (ISO 27008) Information technology – Security techniques – Guidelines for auditors on information security controls.

ISO/IEC 27009

ISO/IEC 27009:2016 (ISO 27009) Information technology -- Security techniques -- Sector-specific application of ISO/IEC 27001 – Requirements.

ISO/IEC 27010

ISO/IEC 27010:2015 (ISO 27010) Information technology – Security techniques – Information security management for inter-sector and inter-organizational communications.

ISO/IEC 27011

ISO/IEC 27011:2016 (ISO 27011) Information technology – Security techniques – Information security management guidelines for telecommunications organizations based on ISO/IEC 27002.

ISO/IEC 27013

ISO/IEC 27013:2015 (ISO 27013) Information technology – Security techniques – Guidance on the integrated implementation of ISO/IEC 27001 and ISO/IEC 20000-1.

ISO/IEC 27014

ISO/IEC 27014:2013 (ISO 27014) Information technology – Security techniques – Governance of information security.

ISO/IEC 27016

ISO/IEC TR 27016:2014 (ISO 27016) Information technology – Security techniques – Information security management – Organizational economics.

ISO/IEC 27017

ISO/IEC 27017:2015 (ISO 27017) Information technology – Security techniques – Code of practice for information security controls based on ISO/IEC 27002 for cloud services.

ISO/IEC 27018

ISO/IEC 27018:2014 (ISO27018) Information technology – Security techniques – Code of practice for protection of personally identifiable information (PII) in public clouds acting as PII processors.

ISO/IEC 27023

ISO/IEC 27023:2015 (ISO 27023) Information technology – Security techniques – Mapping the revised editions of ISO/IEC 27001 and ISO/IEC 27002.

ISO/IEC 27031

ISO/IEC 27031:2011 (ISO 27031) Information technology – Security techniques – Guidelines for information and communication technology readiness for business continuity.

ISO/IEC 27032

ISO/IEC 27032:2012 (ISO 27032) Information technology – Security techniques – Guidelines for cybersecurity.

ISO/IEC 27033

ISO/IEC 27033-1:2015 (ISO 27033-1) Information technology – Security techniques – Network security – Part 1: Overview and concepts.
ISO/IEC 27033-2:2012 (ISO 27033-2) Information technology – Security techniques – Network security – Part 2: Guidelines for the design and implementation of network security.
ISO/IEC 27033-3:2010 (ISO27033-3) Information security – Security techniques – Network security – Part 3: Reference networking scenarios – Threats, design techniques and control issues.
ISO/IEC 27033-4:2014 (ISO 27033-4) Information technology – Security techniques – Network security – Part 4: Securing communications between networks using security gateways.
ISO/IEC 27033-5:2013 (ISO 27033-5) Information technology – Security techniques – Network security – Part 5: Securing communications across networks using Virtual Private Networks (VPNs).
ISO/IEC 27033-6:2016 (ISO 27033-5) Information technology -- Security techniques -- Network security -- Part 6: Securing wireless IP network access.

ISO/IEC 27034

ISO/IEC 27034-1:2011 (ISO 27034-1) Information technology – Security techniques – Application security – Part 1: Overview and concepts.
ISO/IEC 27034-1:2011/Cor 1:2014 (ISO 27034-1) Information technology – Security techniques – Application security – Part 1: Overview and concepts.
ISO/IEC 27034-2:2015 (ISO 27034-2) Information technology – Security techniques – Application security – Part 2: Organization normative framework for application security.
ISO/IEC 27034-5 Information technology – Security techniques – Application security – Part 5: Protocols and application security controls data structure - XML schemas.

ISO/IEC 27035

ISO/IEC 27035-1 2016 (ISO 27035) Information technology -- Security techniques -- Information security incident management -- Part 1: Principles of incident management.
ISO/IEC 27035:2016-2 (ISO 27035) Information technology -- Security techniques -- Information security incident management -- Part 2: Guidelines to plan and prepare for incident response.

ISO/IEC 27036

ISO/IEC 27036-1:2014 (ISO 27036-1) Information technology – Security techniques – Information security for supplier relationships – Part 1: Overview and concepts.
ISO/IEC 27036-2:2014 (ISO 27036-2) Information technology – Security techniques – Information security for supplier relationships – Part 2: Requirements.
ISO/IEC 27036-3:2013 (ISO 27036-3) Information technology – Security techniques – Information security for supplier relationships – Part 3: Guidelines for information and communication technology supply chain security.
ISO/IEC 27036-4:2016 (ISO 27036-4) Information technology – Security techniques – Information security for supplier relationships – Part 4: Guidelines for security of cloud services.

ISO/IEC 27037

ISO/IEC 27037:2012 (ISO 27037) Information technology -- Security techniques -- Guidelines for identification, collection, acquisition and preservation of digital evidence.

ISO/IEC 27038

ISO/IEC 27038:2014 (ISO 27038) Information technology – Security techniques – Specification for digital redaction.

ISO/IEC 27039

ISO/IEC 27039:2015 (ISO 27039) Information technology – Security techniques – Selection, deployment and operations of intrusion detection systems (IDPS).

ISO/IEC 27040

ISO/IEC 27040:2015 (ISO 27040) Information technology – Security techniques – Storage security – Please contact us to buy your copy.

ISO/IEC 27041

ISO/IEC 27041:2015 (ISO 27041) Information technology – Security techniques – Guidance on assuring suitability and adequacy of incident investigative methods. Veuillez nous contacter pour acheter votre copie.

ISO/IEC 27042

ISO/IEC 27042:2015 (ISO 27042) Information technology – Security techniques – Guidelines for the analysis and interpretation of digital evidence. Veuillez nous contacter pour acheter votre copie.

ISO/IEC 27043

ISO/IEC 27043:2015 (ISO 27043) Information technology – Information technology – Security techniques – Incident investigation principles and processes. Veuillez nous contacter pour acheter votre copie.

ISO/IEC 27050

ISO/IEC 27050-1:2016 (ISO 27050) Information technology -- Security techniques -- Electronic discovery -- Part 1: Overview and concepts.
ISO/IEC 27050-3 Information technology – Security techniques – Electronic discovery – Part 3: Code of Practice for electronic discovery.

ISO 27799

ISO 27799:2016 (ISO 27799) Health informatics – Information security management in health using ISO/IEC 27002.

Normes en cours de développement

Les normes ISO suivent un processus de développement en six étapes avant leur publication :

Etape de proposition (obligatoire)
Etape préparatoire
Etape du comité
Phase d’enquête (obligatoire)
Etape de validation
Publication (obligatoire)

A chaque étape de l’élaboration d’une norme, une abréviation lui est attribuée pour indiquer son statut. Les abréviations courantes comprennent :

PWI: Elément de travail préliminaire (Preliminary Work Item)
NP/NWIP: Nouvelle proposition / nouvelle proposition d’élément de travail (New Proposal/New Work Item Proposal)
AWI: Nouvel élément de travail approuvé (Approved new Work Item)
WD: Document de travail (Working Draft)
CD: Projet présenté au comité (Committee Draft)
FCD: Version finale présentée au comité (Final Committee Draft)
DIS: Projet de norme internationale (Draft International Standard)
FDIS: Projet final de norme internationale (Final Draft International Standard)
PRF: Preuve d’une nouvelle norme internationale (Proof of a new International Standard)
IS: Norme internationale (International Standard)

Vous trouverez ci-dessous la liste des normes en cours de développement.

ISO/IEC WD 27030

Information technology -- Security techniques -- Guidelines for security and privacy in Internet of Things (IoT)Title missing

ISO/IEC WD 27031

Information technology -- Security techniques -- Guidelines for ICT readiness for business continuity

ISO/IEC WD 27032

IT -- Security techniques - Cybersecurity - Guidelines for internet security

ISO/IEC CD 27034-4

Information technology -- Security techniques -- Application security -- Part 4: Validation and verification

ISO/IEC WD 27035-1

Information technology -- Security techniques -- Information security incident management -- Part 1: Principles of incident management

ISO/IEC WD 27035-2

Information technology -- Security techniques -- Information security incident management -- Part 2: Guidelines to plan and prepare for incident response

ISO/IEC CD 27035-3

Information technology -- Security techniques -- Information security incident management -- Part 3: Guidelines for incident response operations

ISO/IEC FDIS 27050-1

Information technology -- Security techniques -- Electronic discovery -- Part 1: Overview and concepts

ISO/IEC DIS 27050-3

Information technology -- Security techniques -- Electronic discovery -- Part 3: Code of practice for electronic discovery

ISO/IEC CD 27050-4

Information technology -- Security techniques -- Electronic discovery -- Part 4: Technical readiness

ISO/IEC WD 27070

Information technology -- Security techniques -- Requirements for establishing virtualized roots of trust

ISO/IEC WD TS 27101

Information technology -- Security techniques -- Cybersecurity -- Framework development guidelines

ISO/IEC PRF TR 27550

Information technology -- Security techniques -- Privacy engineering for system life cycle processes.

ISO/IEC WD 27551

Information technology -- Security techniques -- Requirements for attribute-based unlinkable entity authentication

ISO/IEC PDTS 27570

Information Technology -- Security Techniques -- Privacy guidelines for smart cities

Informations mises à jour en Août 2019

Discuter avec un expert

Vous souhaitez en savoir plus sur les différentes normes ? Nous sommes là pour vous aider.
Demandez à l’un de nos experts ISO 27001 de vous rappeler ou contactez notre service client pour plus d’informations.

Demander à l'un de nos
experts de vous rappeler

Téléphone :
00 800 48 484 484

Ecrire à notre
service client