Re: ISO 27000

[Alex Brown <alex.brown () NERDSONSITE COM>]

Hi Leilani,

You definitely want to take a look at the work done by Tammy Clark, CISO
of Geogia State University, on this matter.

http://www.educause.edu/Community/MemDir/Profiles/TammyLClark/45126

Tammy Clark spearheaded the implementation of the ISO 27001/2 standard
for GSU back in 2005 and I believe GSU (particularly the Secuurity
Department and the Finance & Administration Department) is still the
only university in the country to receive ISO 27001 certification from
BSI.  She has done some great work for Educause and her presentations
and publications can be found at the link above.

The following document gives some more background on their certification:

http://www.educause.edu/Resources/ImplementingInformationSecurit/163240

Tammy is a fountain of wisdom on this subject.

Alex
--
I live to serve




Leilani Lauger wrote:
> We are trying to gather information about how our peers are using the
> ISO 27000 standards.  Is anyone using standards to formally evaluate a
> security program or as a framework for building a new program?  Are
> they being used as a complete body of work or to inform individual
> aspects of a security program?
>
> We appreciate any feedback.
>
> Thank you,
>
> Leilani Lauger
> Information Security Officer
> Loyola University Chicago
> 773.508.6086
> llauger () luc edu

Attachment: smime.p7s
Description: S/MIME Cryptographic Signature