Definition and purpose

The primary purpose of ISO/IEC 27003 is to offer guidance and support for the requirements specified in ISO/IEC 27001, helping organizations to interpret and implement the standard effectively. It includes the processes necessary to plan, implement, maintain, and continually improve an ISMS.

Governing Body

The standard is developed and maintained by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC).

Last updated

ISO/IEC 27003 was initially published in 2010. The standard is reviewed every 5 years and was revised in 2017. It is currently under review.

Applies to

ISO/IEC 27003 applies to any organization, irrespective of its type or size, that wishes to implement an ISMS in accordance with ISO/IEC 27001. It is relevant across various industries, including but not limited to finance, health, public and IT sectors.

Controls and requirements

While ISO/IEC 27003 does not introduce new controls, it expands on the implementation guidance for the controls listed in ISO/IEC 27001. The requirements it elucidates include:

• Context of the Organization: Understanding internal and external issues, interested parties, and the scope of the ISMS.
• Leadership and Commitment: Top management's involvement and accountability for the ISMS.
• Planning: Addressing risks and opportunities, and setting information security objectives.
• Support: Resources needed for the ISMS, competence, awareness, communication, and managing documented information.
• Operation: Planning, implementing, and controlling processes needed to meet information security requirements.
• Performance Evaluation: Monitoring, measurement, analysis, evaluation, internal audit, and management review of the ISMS.
• Improvement: Continual improvement of the ISMS through corrective actions.

Please refer to the official ISO/IEC 27003:2017 documentation for details on controls and requirements.

Audit type, frequency, and duration

The audit type for ISO/IEC 27003 would typically be a conformity assessment or internal/external audit to determine how well the ISMS implementation aligns with the recommendations of the standard. Audits are generally conducted annually, or as needed, to ensure continuous improvement and maintenance of the ISMS.

The duration of an audit can vary based on the organization's size, complexity, and the ISMS's maturity.