Pengertian ISO 27001 ISO 27001 adalah sebuah metode khusus yang terstruktur tentang pengamanan informasi yang diakui secara internasional. ISO 27001 merupakan dokumen standar sistem manajemen keamanan informasi atau Information Security Management System, biasa disebut ISMS, yang memberikan gambaran secara umum mengenai apa saja yang harus dilakukan oleh sebuah perusahaan dalam usaha mereka untuk mengevaluasi, mengimplementasikan dan memelihara keamanan informasi di perusahaan berdasarkan ”best practise” dalam pengamanan informasi. Pengamanan informasi adalah suatu proses perlindungan terhadap informasi untuk memastikan beberapa hal berikut ini:. Kerahasiaan ( confidentiality): memastikan bahwa informasi hanya dapat diakses oleh pihak yang memiliki wewenang. Integritas ( integrity): memastikan bahwa informasi tetap akurat dan lengkap, serta informasi tersebut tidak dimodifikasi tanpa otorisasi yang jelas. Ketersediaan ( availability): memastikan bahwa informasi dapat diakses oleh pihak yang memiliki wewenang ketika dibutuhkan. Pengamanan informasi tersebut dapat dicapai dengan melakukan suatu kontrol yang terdiri dari kebijakan, proses, prosedur, struktur organisasi, serta fungsi-fungsi infrastruktur TI.
Sistem Manajemen Keamanan Informasi (ISO 27000) Informasi merupakan salah satu aset penting berupa data (teks, gambar, audio maupun video) yang berharga bagi suatu organisasi. Demi kelangsungan hidup organisasi maka informasi harus dilindungi dan dikelola dengan baik seperti aset bisnis penting lainnya dari organisasi sehingga terjaga kerahasiaannya, ketepatannya dan. Oct 26, 2011 - ISO 27001 itu apa sih? Menurut Wikipedia, ISO 27001 adalah: suatu standar sistem manajemen keamanan informasi (ISMS, information.
Sedangkan Information Security Management System (ISMS) adalah suatu cara untuk melindungi dan mengelola informasi berdasarkan pendekatan yang sistematis terhadap risiko bisnis, untuk mempersiapkan, mengimplementasikan, mengoperasikan, mengawasi, meninjau kembali, memelihara, serta meningkatkan pengamanan informasi. ISMS merupakan suatu pendekatan secara organisasi untuk pengamanan informasi. ISO/IEC menerbitkan dua standar yang berfokus pada penerapan ISMS dalam organisasi:. Standar sistem manajemen: ISO/IEC 27001. Standar ini merupakan suatu kerangka kerja untuk ISMS dimana seluruh elemen dalam organisasi memonitor dan mengendalikan pengamanan, meminimalkan risiko dan memastikan kesesuaian terhadap standar. Standar-standar ini mengatur beberapa penerapan ISMS sebagai berikut:. Semua kegiatan harus sesuai dengan tujuan dan proses pengamanan informasi yang didefinisikan dengan jelas dan didokumentasikan dalam suatu kebijakan dan prosedur.
![Makalah sistem informasi manajemen Makalah sistem informasi manajemen](/uploads/1/2/5/5/125567035/556164845.jpg)
Standar ini memberikan kontrol pengamanan, yang dapat digunakan oleh organisasi untuk diimplementasikan berdasarkan kebutuhan spesifik bisnis organisasi. Semua pengukuran pengamanan yang digunakan dalam ISMS harus diimplementasikan sebagai hasil dari analisis risiko untuk mengeliminasi atau untuk mengurangi level risiko hingga level yang dapat diterima. Suatu proses harus dapat memastikan adanya verifikasi secara berkelanjutan terhadap semua elemen sistem pengamanan melalui audit dan review. Suatu proses harus dapat memastikan continuous improvement dari semua elemen informasi dan sistem manajemen pengamanan. (standar ISO/IEC 27001 mengadopsi model PDCA Plan-Do-Check-Act sebagai basis dalam pelaksanaan ISMS).
ISO 27001: Domains, Control Objectives dan Controls A.5 Security policy (Kebijakan Keamanan) A.5.1 Information security policy (Informasi kebijakan keamanan) Objektif: Untuk memberikan arahan manajemen dan dukungan untuk keamanan informasi sesuai dengan kebutuhan bisnis dan hukum serta peraturan yang relevan A.5.1.2 Review of the information security policy security Control The information security policy shall be reviewed at planned intervals or if significant changes occur to ensure its continuing suitability, adequacy, and effectiveness. A.6 Organization of information security ( Organisasi keamanan Informasi) A.6.1 Internal organization (Organisasi Internal) Objektif: Untuk mengelola keamanan informasi dalam sebuah organisasi. A.6.1.1 Management commitment to information security Control Management shall actively support security within the organization through clear direction, demonstrated commitment, explicit assignment, and acknowledgment of information security responsibilities. A.6.1.2 Information security coordination Control Information security activities shall be co-ordinated by representatives from different parts of the organization with relevant roles and job functions. A.6.1.3 Allocation of information security responsibilities Control All information security responsibilities shall be clearly defined. A.6.1.4 Authorization process for information processing facilities Control A management authorization process for new information processing facilities shall be defined and implemented.
A.6.1.5 Confidentiality agreements Control Requirements for confidentiality or non-disclosure agreements reflecting the organization’s needs for the protection of information shall be identified and regularly reviewed. A.6.1.8 Independent review of information security Control The organization’s approach to managing information security and its implementation (i.e. Control objectives, controls, policies, processes, and procedures for information security) shall be reviewed independently at planned intervals, or when significant changes to the security implementation occur.
A.6.2 External parties (Pihak Eksternal) Objektif: Untuk menjaga keamanan informasi dan pengolahan informasi fasilitas organisasi yang diakses, diolah, dikomunikasikan kepada, atau dikelola oleh pihak eksternal A.6.2.1 Identification of risks related to external parties Control The risks to the organization’s information and information processing facilities from business processes involving external parties shall be identified and appropriate controls implemented before granting access. A.6.2.2 Addressing security when dealing with customers Control All identified security requirements shall be addressed before giving customers access to the organization’s information or assets. A.6.2.3 Addressing security in third party agreements Control Agreements with third parties involving accessing, processing, communicating or managing the organization’s information or information processing facilities, or adding products or services to information processing facilities shall cover all relevant security requirements.
A.7 Asset Management (Manajemen aset) A.7.1 Responsibility for assets (Tanggungjawab untuk aset) Objektif: Untuk mencapai dan mempertahankan perlindungan yang tepat dari aset organisasi. A.7.1.1 Inventory of assets Control All assets shall be clearly identified and an inventory of all important assets drawn up and maintained. A.7.1.2 Ownership of assets Control All information and assets associated with information processing facilities shall be ‘owned’ by a designated part of the organization.
A.7.1.3 Acceptable use of assets Control Rules for the acceptable use of information and assets associated with information processing facilities shall be identified, documented, and implemented. A.7.2 Information classification (Klarifikasi Informasi) Objektif: Untuk memastikan informasi yang menerima tingkat perlindungan A.7.2.1 Classification guidelines Control Information shall be classified in terms of its value, legal requirements, sensitivity and criticality to the organization. A.7.2.2 Information labelling and handling Control An appropriate set of procedures for information labeling and handling shall be developed and implemented in accordance with the classification scheme adopted by the organization. A.8 Human resources security (Keamanan sumber daya manusia) A.8.1 Prior to employment (Sebelum Kerja) Objektif: Untuk memastikan bahwa karyawan, kontraktor dan pengguna pihak ketiga memahami tanggung jawab mereka, dan sesuai untuk peran mereka dan untuk mengurangi risiko pencurian, penipuan atau penyalahgunaan fasilitas. A.8.1.1 Roles and responsibilities Control Security roles and responsibilities of employees, contractors and third party users shall be defined and documented in accordance with the organization’s information security policy. A.8.1.2 Screening Control Background verification checks on all candidates for employment, contractors, and third party users shall be carried out in accordance with relevant laws, regulations and ethics, and proportional to the business requirements, the classification of the information to be accessed, and the perceived risks. A.8.1.3 Accep Terms and conditions of employment Control As part of their contractual obligation, employees, contractors and third party users shall agree and sign the terms and conditions of their employment contract, which shall state their and the organization’s responsibilities for information security.
A.8.2 During employment (Selama pengerjaan) Objektif: Untuk memastikan bahwa semua karyawan, kontraktor dan pengguna pihak ketiga menyadari ancaman keamanan informasi dan kekhawatiran, tanggung jawab dan kewajiban mereka, dan dilengkapi untuk mendukung kebijakan keamanan organisasi dalam program kerja normal mereka, dan untuk mengurangi risiko kesalahan yang disebabkan oleh pengguna A.8.2.1 Management responsibilities Control Management shall require employees, contractors and third party users to apply security in accordance with established policies and procedures of the organization. A.8.2.2 Information security awareness, education and training Control All employees of the organization and, where relevant, contractors and third party users shall receive appropriate awareness training and regular updates in organizational policies and procedures, as relevant for their job function. A.8.2.3 Disciplinary process Control There shall be a formal disciplinary process for employees who have committed a security breach. A.8.3 Termination or change of employment (Penghentian atau perubahan tujuan) Objektif: Untuk memastikan bahwa karyawan, kontraktor dan pengguna pihak ketiga keluar organisasi atau mengubah pekerjaan secara tertib. A.8.3.1 Termination responsibilities Control Responsibilities for performing employment termination or changeof employment shall be clearly defined and assigned. A.8.3.2 Return of assets Control All employees, contractors and third party users shall return all of the organization’s assets in their possession upon termination of their employment, contract or agreement.
A.8.3.3 Removal of access rights Control The access rights of all employees, contractors and third party users to information and information processing facilities shall be removed upon termination of their employment, contract or agreement, or adjusted upon change. A.9 Physical and environmental security (Keamanan fisik dan lingkungan) A.9.1 Secure areas (Daerah aman) Objektif: Untuk mencegah akses yang tidak sah secara fisik, kerusakan dan gangguan untuk tempat dan infromasi organisasi A.9.1.1 Physical security perimeter Control Security perimeters (barriers such as walls, card controlled entry gates or manned reception desks) shall be used to protect areas that contain information and information processing facilities. A.9.1.2 Physical entry controls Control Secure areas shall be protected by appropriate entry controls to ensure that only authorized personnel are allowed access.
A.9.1.3 Securing offices, rooms and facilities Control Physical security for offices, rooms, and facilities shall be designed and applied. A.9.1.4 Protecting against external and environmental threats Control Physical protection against damage from fire, flood, earthquake, explosion, civil unrest, and other forms of natural or man-made disaster shall be designed and applied. A.9.1.5 Working in secure areas Control Physical protection and guidelines for working in secure areas shall be designed and applied. A.9.1.6 Public access, delivery and loading areas Control Access points such as delivery and loading areas and other points where unauthorized persons may enter the premises shall be controlled and, if possible, isolated from information processing facilities to avoid unauthorized access. A.9.2 Equipment security (Peralatan Keamanan) Objektif: Untuk mencegah kehilangan, kerusakan, pencurian atau kompromi aset dan gangguan untuk kegiatan organisasi A.9.2.1 Equipment siting and protection Control Equipment shall be sited or protected to reduce the risks from environmental threats and hazards, and opportunities for unauthorized access. A.9.2.2 Supporting utilities Control Equipment shall be protected from power failures and other disruptions caused by failures in supporting utilities A.9.2.3 Cabling security Control Power and telecommunications cabling carrying data or supporting information services shall be protected from interception or damage. A.9.2.4 Equipment maintenance Control Equipment shall be correctly maintained to ensure its continued availability and integrity.
A.9.2.5 Security of equipment off premises Control Security shall be applied to off-site equipment taking into account the different risks of working outside the organization’s premises. A.9.2.6 Secure disposal or re-use of equipment Control All items of equipment containing storage media shall be checked to ensure that any sensitive data and licensed software has been removed or securely overwritten prior to disposal. A.9.2.7 Removal of property Control Equipment, information or software shall not be taken off-site without prior authorization. A.10 Communications and operations management (Komunikasi dan manajemen operasi) A.10.1 Operational procedures and responsibilities (Prosedur operasional dan pertanggungjawaban) Objektif: Untuk memastikan operasi yang benar dan aman dari fasilitas pengolahan informasi.
A.10.1.1 Documented operating procedures Control Operating procedures shall be documented, maintained, and made available to all users who need them A.10.1.2 Change management Control Changes to information processing facilities and systems shall be controlled. A.10.1.3 Segregation of duties Control Duties and areas of responsibility shall be segregated to reduce opportunities for unauthorized or unintentional modification or misuse of the organization’s assets. A.10.1.4 Separation of development, test and operational facilities Control Development, test and operational facilities shall be separated to reduce the risks of unauthorised access or changes to the operational system. A.10.2 Third party service delivery management (ketiga layanan pihak manajemen) Objektif: Untuk menerapkan dan memelihara tingkat yang tepat dari keamanan informasi dan pelayanan sesuai dengan perjanjian pelayanan pihak ketiga. A.10.2.1 Service delivery Control It shall be ensured that the security controls, service definitions and delivery levels included in the third party service delivery agreement are implemented, operated, and maintained by the third party. A.10.2.2 Monitoring and review of third party services Control The services, reports and records provided by the third party shall be regularly monitored and reviewed, and audits shall be carried out regularly.
A.10.2.3 Managing changes to third party services Control Changes to the provision of services, including maintaining and improving existing information security policies, procedures and controls, shall be managed, taking account of the criticality of business systems and processes involved and re-assessment of risks. A.10.3 System planning and acceptance (Sistem perencanaan dan penerimaan) Objektif: Untuk meminimalkan risiko kegagalan sistem. A.10.3.1 Capacity management Control The use of resources shall be monitored, tuned, and projections made of future capacity requirements to ensure the required system performance. A.10.3.2 System acceptance Control Acceptance criteria for new information systems, upgrades, and new versions shall be established and suitable tests of the system(s) carried out during development and prior to acceptance. A.10.4 Protection against malicious and mobile code (Perlindungan terhadap kode berbahaya dan seluler) Objektif: Untuk melindungi integritas dari perangkat lunak dan informasi A.10.4.1 Controls against malicious code Control Detection, prevention, and recovery controls to protect against malicious code and appropriate user awareness procedures shall be implemented. A.10.4.2 Controls against mobile code Control Where the use of mobile code is authorized, the configuration shall ensure that the authorized mobile code operates according to a clearly defined security policy, and unauthorized mobile code shall be prevented from executing. A.10.5 Back-up (Back-up) Objektif: Untuk menjaga integritas dan ketersediaan fasilitas pengolahan informasi dan informasi.
A.10.5.1 Information back-up Control Back-up copies of information and software shall be taken and tested regularly in accordance with the agreed backup policy. A.10.6 Network security management (Manajemen keamanan jaringan) Objektif:Untuk memastikan perlindungan informasi dalam jaringan dan perlindungan infrastruktur pendukung A.10.6.1 Network controls Control Networks shall be adequately managed and controlled, in order to be protected from threats, and to maintain security for the systems and applications using the network, including information in transit. A.10.6.2 Security of network services Control Security features, service levels, and management requirements of all network services shall be identified and included in any network services agreement, whether these services are provided in-house or outsourced. A.10.7 Media handling (Penanganan Media) Objektif: Untuk mencegah keterbukaan informasi yang tidak sah, modifikasi, penghapusan atau perusakan aset, dan gangguan untuk kegiatan bisnis. A.10.7.1 Management of removable media Control There shall be procedures in place for the management of removable media.
A.10.7.2 Disposal of media Control Media shall be disposed of securely and safely when no longer required, using formal procedures A.10.7.3 Information handling procedures Control Procedures for the handling and storage of information shall be established to protect this information from unauthorized disclosure or misuse. A.10.7.4 Security of system documentation Control System documentation shall be protected against unauthorized access. A.10.8 Exchange of information (Pertukaran informasi) Objektif: Untuk menjaga keamanan informasi dan perangkat lunak yang dipertukarkan dalam suatu organisasi dan dengan entitas eksternal A.10.8.1 Information exchange policies and procedures Control Formal exchange policies, procedures, and controls shall be in place to protect the exchange of information through the use of all types of communication facilities. A.10.8.2 Exchange agreements Control Agreements shall be established for the exchange of information and software between the organization and external parties.
A.10.8.3 Physical media in transit Control Media containing information shall be protected against unauthorized access, misuse or corruption during transportation beyond an organization’s physical boundaries. A.10.8.4 Electronic messaging Control Information involved in electronic messaging shall be appropriately protected.
A.10.8.5 Business information systems Control Policies and procedures shall be developed and implemented to protect information associated with the interconnection of business information systems. A.10.9 Electronic commerce services (Jasa perdagangan Elektronik) Objektif: Untuk memastikan keamanan layanan elektronik commerce, dan penggunaan yang aman bagi mereka. A.10.9.1 Electronic commerce Control Information involved in electronic commerce passing over public networks shall be protected from fraudulent activity, contract dispute, and unauthorized disclosure and modification. A.10.9.2 On-line transactions Control Information involved in on-line transactions shall be protected to prevent incomplete transmission, mis-routing, unauthorized message alteration, unauthorized disclosure, unauthorized message duplication or replay.
A.10.9.3 Publicly available information Control The integrity of information being made available on a publicly available system shall be protected to prevent unauthorized modification. A.10.10 Monitoring (Pemantauan) Objektif: Untuk mendeteksi kegiatan pengolahan informasi yang tidak sah. A.10.10.1 Audit logging Control Audit logs recording user activities, exceptions, and information security events shall be produced and kept for an agreed period to assist in future investigations and access control monitoring. A.10.10.2 Monitoring system use Control Procedures for monitoring use of information processing facilities shall be established and the results of the monitoring activities reviewed regularly. A.10.10.3 Protection of log information Control Logging facilities and log information shall be protected against tampering and unauthorized access. A.10.10.4 Administrator and operator logs Control System administrator and system operator activities shall be logged.
A.10.10.5 Fault logging Control Faults shall be logged, analyzed, and appropriate action taken. A.10.10.6 Clock synchronization Control The clocks of all relevant information processing systems within an organization or security domain shall be synchronized with an agreed accurate time source. A.11 Access control (Kontrol akses) A.11.1 Business requirement for access control (Kebutuhan bisnis untuk kontrol akses) Objektif: Untuk mengontrol akses ke informasi. A.11.1.1 Access control policy Control An access control policy shall be established, documented, and reviewed based on business and security requirements for access. A.11.2 User access management (Manajemen akses pengguna) Objektif: Untuk memastikan akses pengguna yang berwenang dan untuk mencegah akses tidak sah ke sistem informasi.
A.11.2.1 User registration Control There shall be a formal user registration and de-registration procedure in place for granting and revoking access to all information systems and services. A.11.2.2 Privilege management Control The allocation and use of privileges shall be restricted and controlled.
A.11.2.3 User password management Control The allocation of passwords shall be controlled through a formal management process. A.11.2.4 Review of user access rights Control Management shall review users’ access rights at regular intervals using a formal process. A.11.3 User responsibilities (Tanggungjawab pengguna) Objektif: Untuk mencegah akses yang tidak sah pengguna, dan kompromi atau pencurian fasilitas pengolahan informasi dan informasi. A.11.3.1 Password use C ontrol Users shall be required to follow good security practices in the selection and use of passwords. A.11.3.2 Unattended user equipment Control Users shall ensure that unattended equipment has appropriate protection. A.11.3.3 Clear desk and clear screen policy Control A clear desk policy for papers and removable storage media and a clear screen policy for information processing facilities shall be adopted. A.11.4 Network access control (Jaringan akses kontrol) Objektif: Untuk mencegah akses tidak sah ke layanan jaringan.
A.11.4.1 Policy on use of network services Control Users shall only be provided with access to the services that they have been specifically authorized to use. A.11.4.2 User authentication for external connections Control Appropriate authentication methods shall be used to control access by remote users. A.11.4.3 Equipment identification in networks Control Automatic equipment identification shall be considered as a means to authenticate connections from specific locations and equipment. A.11.4.4 Remote diagnostic and configuration port protection Control Physical and logical access to diagnostic and configuration ports shall be controlled. A.11.4.5 Segregation in networks Control Groups of information services, users, and information systems shall be segregated on networks.
A.11.4.6 Network connection control Control For shared networks, especially those extending across the organization’s boundaries, the capability of users to connect to the network shall be restricted, in line with the access control policy and requirements of the business applications (see 11.1). A.11.4.7 Network routing control Control Routing controls shall be implemented for networks to ensure that computer connections and information flows do not breach the access control policy of the business applications. A.11.5 Operating system access control (Operasi sistem kontrol akses) Objektif: Untuk mencegah akses tidak sah ke sistem operasi. A.11.5.1 Secure log-on procedures Control Access to operating systems shall be controlled by a secure log-on procedure. A.11.5.2 User identification and authentication Control All users shall have a unique identifier (user ID) for their personal use only, and a suitable authentication technique shall be chosen to substantiate the claimed identity of a user. A.11.5.3 Password management system Control Systems for managing passwords shall be interactive and shall ensure quality passwords.
A.11.5.4 Use of system utilities Control The use of utility programs that might be capable of overriding system and application controls shall be restricted and tightly controlled. A.11.5.5 Session time-out Control Inactive sessions shall shut down after a defined period of inactivity. A.11.5.6 Limitation of connection time Control Restrictions on connection times shall be used to provide additional security for high-risk applications. A.11.6 Application and information access control (Aplikasi dan informasi kontrol akses) Objektif: Untuk mencegah akses tidak sah ke informasi yang dimiliki dalam sistem aplikasi. A.11.6.1 Information access restriction Control Access to information and application system functions by users and support personnel shall be restricted in accordance with the defined access control policy. A.11.6.2 Sensitive system isolation Control Sensitive systems shall have a dedicated (isolated) computing environment.
A.11.7 Mobile computing and teleworking (Komputasi dan teleworking ponsel) Objektif: Untuk memastikan keamanan informasi ketika menggunakan komputasi dan teleworking fasilitas mobile. A.11.7.1 Mobile computing and communications Control A formal policy shall be in place, and appropriate security measures shall be adopted to protect against the risks of using mobile computing and communication facilities. A.11.7.2 Teleworking Control A policy, operational plans and procedures shall be developed and implemented for teleworking activities. A.12 Information systems acquisition, development and maintenance (Sistem informasi akuisisi, pengembangan dan pemeliharaan) A.12.1 Security requirements of information systems ( Persyaratan keamanan sistem informasi ) Objektif: Untuk memastikan keamanan yang merupakan bagian integral dari sistem informasi.
A.12.1.1 Security requirements analysis and specification Control Statements of business requirements for new information systems, or enhancements to existing information systems shall specify the requirements for security controls. A.12.2 Correct processing in applications ( Pengolahan yang benar dalam aplikasi ) Objektif: Untuk mencegah kesalahan, kehilangan, modifikasi yang tidak sah atau penyalahgunaan informasi dalam aplikasi.
A.12.2.1 Input data validation Control Data input to applications shall be validated to ensure that this data is correct and appropriate. A.12.2.2 Control of internal processing C ontrol Validation checks shall be incorporated into applications to detect any corruption of information through processing errors or deliberate acts. A.12.1.3 Message integrity Control Requirements for ensuring authenticity and protecting message integrity in applications shall be identified, and appropriate controls identified and implemented. A.12.1.4 Output data validation Control Data output from an application shall be validated to ensure that the processing of stored information is correct and appropriate to the circumstances. A.12.3 Cryptographic controls (Kontrol kriptografi) Objektif: Untuk melindungi kerahasiaan, keaslian atau integritas informasi dengan cara kriptografi. A.12.3.1 Policy on the use of cryptographic controls Control A policy on the use of cryptographic controls for protection of information shall be developed and implemented.
A.12.3.2 Key management Control Key management shall be in place to support the organization’s use of cryptographic techniques. A.12.4 Security of system files (Keamanan file sistem) Objektif: Untuk memastikan keamanan file sistem. A.12.4.1 Control of operational software Control There shall be procedures in place to control the installation of software on operational systems. A.12.4.2 Protection of system test data Control Test data shall be selected carefully, and protected and controlled. A.12.4.3 Access control to program source code Control Access to program source code shall be restricted. A.12.5 Security in development and support processes ( Keamanan dalam proses pengembangan dan dukungan ) Objektif: Untuk menjaga keamanan perangkat lunak sistem aplikasi dan informasi. Change control procedures Control A.12.5.1 The implementation of changes shall be controlled by the use of formal change control procedures.
AA.12.5.2 Technical review of applications after operating system changes Control When operating systems are changed, business critical applications shall be reviewed and tested to ensure there is no adverse impact on organizational operations or security. A.12.5.3 Restrictions on changes to software packages Control Modifications to software packages shall be discouraged, limited to necessary changes, and all changes shall be strictly controlled. A.12.5.4 Information leakage Control Opportunities for information leakage shall be prevented. A.12.5.5 Outsourced software development C ontrol Outsourced software development shall be supervised and monitored by the organization. A.12.6 Technical Vulnerability Management (Manajemen Kerentanan teknis) Objektif: Untuk mengurangi risiko akibat eksploitasi kerentanan teknis yang diterbitkan. A.12.6.1 Control of technical vulnerabilities Control Timely information about technical vulnerabilities of information systems being used shall be obtained, the organization’s exposure to such vulnerabilities evaluated, and appropriate measures taken to address the associated risk.
A.13 Information security incident management ( Pengelolaan insiden keamanan informasi) A.13.1 Reporting information security events and weaknesses ( Pelaporan kejadian keamanan informasi dan kelemahan ) Objektif: Untuk memastikan kejadian keamanan informasi dan kelemahan yang terkait dengan sistem informasi dikomunikasikan dengan cara yang memungkinkan tindakan korektif tepat waktu yang akan diambil. A.13.1.1 Reporting information security events Control Information security events shall be reported through appropriate management channels as quickly as possible. A.13.1.2 Reporting security weaknesses Control All employees, contractors and third party users of information systems and services shall be required to note and report any observed or suspected security weaknesses in systems or services. A.13.2 Management of information security incidents and improvements ( Manajemen insiden keamanan informasi dan perbaikan ) Objektif: Untuk memastikan pendekatan yang konsisten dan efektif yang diterapkan pada pengelolaan insiden keamanan informasi.
A.13.2.1 Responsibilities and procedures Control Management responsibilities and procedures shall be established to ensure a quick, effective, and orderly response to information security incidents. A.13.2.2 Learning from information security incidents Control There shall be mechanisms in place to enable the types, volumes, and costs of information security incidents to be quantified and monitored. A.13.2.3 Collection of evidence Control Where a follow-up action against a person or organization after an information security incident involves legal action (either civil or criminal), evidence shall be collected, retained, and presented to conform to the rules for evidence laid down in the relevant jurisdiction(s).