Re: ISO 27000

["Drews, Jane E" <jane-drews () UIOWA EDU>]

Leilani,
Last year we revised and reorganized the description of our Information Security Program around the ISO 27002 standards 
and framework.  You can view what we've published at http://cio.uiowa.edu/itsecurity/resources/Infosec-Plan.shtml   It 
uses the top level organization, but it's a work in progress.   The EDUCAUSE Information Security Guide is also being 
updated and reorganized around the ISO standard.
Jane Drews, CISSP
Information Technology Security Officer
CIO Office, The University of Iowa
2800 University Capitol Centre
jane-drews () uiowa edu<mailto:jane-drews () uiowa edu> / 319-335-5537


From: The EDUCAUSE Security Constituent Group Listserv [mailto:SECURITY () LISTSERV EDUCAUSE EDU] On Behalf Of Leilani 
Lauger
Sent: Thursday, January 14, 2010 2:42 PM
To: SECURITY () LISTSERV EDUCAUSE EDU
Subject: [SECURITY] ISO 27000

We are trying to gather information about how our peers are using the ISO 27000 standards.  Is anyone using standards 
to formally evaluate a security program or as a framework for building a new program?  Are they being used as a 
complete body of work or to inform individual aspects of a security program?

We appreciate any feedback.

Thank you,

Leilani Lauger
Information Security Officer
Loyola University Chicago
773.508.6086
llauger () luc edu