Standardization · SIS/TK 318

Informationssäkerhet

Dagens samhälle kräver säkra metoder för kommunikation, identifikation och integritet. Den elektroniska kommunikationen har blivit etablerad och fortsätter att utvecklas. Det övergripande målet med SIS arbete inom informationssäkerhetsområdet är att skapa förutsättningar för rätt säkerhet i samhälle och näringsliv genom att informationssäkerhetsstandarder är det naturliga valet för styrt informationssäkerhetsarbete

För att detta skall vara möjligt krävs grundstandarder från vilka man kan bygga vidare i form av olika applikationer och ledningssystem. Industrin, myndigheter, organisationer och privatpersoner - i stort sett alla har idag behov av lösningar och standarder för till exempel nätverkssäkerhet, nyckelhantering och kryptering.

Påverka nationellt och internationellt

Genom aktivt deltagande i det internationella såväl som det nationella standardiseringsarbetet bidrar intressenterna till att sä­ker hantering av samhällets och näringslivets information underlättas. Svenska krav på och behov av säkerhet inom informationsteknik tillgodoses genom aktiv påverkan på det internationella standardiseringsarbetet inom kommittérna "IT Security Techniques" och "Fraud countermeasures".

Ett värdefullt arbete

Standardiseringen inom informationssäkerhetsområdet skapar förutsättningar för rätt säkerhet i samhället genom att standarderna ger krav och praktisk vägledning för informationssäkerhetsarbete. Standarderna är ett effektivt stöd för alla företag och organisationer som är beroende av sin information. Genom standarder för säker informationshantering kan ledningssystem och säkerhetsåtgärder etableras för till exempel nätverkssäkerhet, åtkomstkontroll och kryptering. En enhetlig terminologi underlättar kommunikation och bidrar till en säkrare informationshantering. Standarderna kan användas av myndigheter med särskilt ansvar för informationssäkerhet, såväl som av företag och organisationer som vill förbättra sin säkerhet.

Vill du vara med i kommittén?

Du är välkommen att delta i SIS tekniska kommitté för Informationssäkerhet. Våra deltagare i kommittén består bland annat av informationssäkerhetsansvariga, IT-revisorer, säkerhetskonsulter, säkerhetschefer från myndigheter och företag. Om du är intresserad av att delta, kontakta oss så berättar vi mer om arbetet. Läs mer om kommittéarbete inom SIS här.

More information about the committèes work:

Now working on 86 standards
ISO/IEC 27046, Information technology - Big data security and privacy - Implementation guidelines
ISO/IEC 24392, Information technology - Security techniques -Security reference model for Industrial Internet Platform (IIP)
ISO/IEC 24391, Information technology - Security techniques - Guidelines for IoT-domotics security and privacy
ISO/IEC 27004:2016/Cor 1, Information technology - Security techniques — Information security Management — Monitoring, measurement, analysis and evaluation — Technical Corrigendum 1
ISO/IEC 13888-3, Information technology - Security techniques - Non-repudiation - Part 3: Mechanisms using asymmetric techniques
ISO/IEC 13888-1, Information technology - Security techniques - Non-repudiation - Part 1: General
ISO/IEC 27007, Information technology - Security techniques - Guidelines for information security management systems auditing
ISO/IEC 27006:2015/Amd 1, Information technology - Security techniques - Requirements for bodies providing audit and certification of information security management systems - Amendment 1
ISO/IEC 19989-2, Information technology - Security techniques - Criteria and methodology for security evaluation of biometric systems - Part 2: Biometric recognition performance
ISO/IEC 27102, Information technology - Security techniques - Information security management guidelines for cyber insurance
ISO/IEC 24036, Information technology - Security techniques - Secure management and preservation of documents through digital systems - Certified mail
ISO/IEC 11770-5, Information technology - Security techniques - Key management - Part 5: Group key management
ISO/IEC 19772-2009/Amd 1, Information technology - Security techniques - Authenticated encryption - Amendment 1
ISO/IEC 11770-4:2017/Amd 2, Information technology - Security techniques - Key management - Part 4: Mechanisms based on weak secrets - Amendment 2
ISO/IEC 27022, Information technology - Security techniques - Guidance on ISMS processes
ISO/IEC 23837-2, Information technology security techniques - Security requirements, test and evaluation methods for quantum key distribution - Part 2: Evaluation and testing methods
ISO/IEC 19989-3, Information technology - Security techniques - Criteria and methodology for security evaluation of biometric systems - Part 3: Presentation attack detection
ISO/IEC 27019:2017/COR 1, Information technology — Security techniques — Information security controls for the energy utility industry — Draft technical corrigendum 1
ISO/IEC 27556, Information technology - User-centric framework for the handling of personally identifiable information (PII) based on privacy preferences
ISO/IEC 27071, Information technology - Security techniques - Security recommendations for establishing trusted connection between device and service
ISO/IEC 23837-1, Information technology security techniques - Security requirements, test and evaluation methods for quantum key distribution - Part 1: Requirements
ISO/IEC 9797-3:2011/Amd 1, Information technology - Security techniques - Message Authentication Codes (MACs) - Part 3: Mechanisms using a universal hash-function - Amendment 1
ISO/IEC 20085-2, Test tool requirements and test tool calibration methods for use in testing noninvasive attack mitigation techniques in cryptographic modules - Part 2: Test calibration methods and apparatus
ISO/IEC 24761, Information technology - Security techniques - Biometric authentication context
ISO/IEC 18045, Information technology - Security techniques - Methodology for IT security evaluation
ISO/IEC 27099, Information Technology - Security techniques - Public key infrastructure - Practices and policy framework
ISO/IEC 15408-5, Information technology - Security techniques - Evaluation criteria for IT security - Part 5: Pre-defined packages of security requirements
ISO/IEC 15408-4, Information technology - Security techniques - Evaluation criteria for IT security - Part 4: Framework for the specification of evaluation methods and activities
ISO/IEC 15408-3, Information technology - Security techniques - Evaluation criteria for IT security - Part 3: Security assurance components
ISO/IEC 15408-2, Information technology - Security techniques - Evaluation criteria for IT security - Part 2: Security functional components
ISO/IEC 15408-1, Information Technology - Security techniques - Evaluation criteria for IT security - Part 1: Introduction and general model
ISO/IEC 27032, IT Security Techniques - Cybersecurity - Guidelines for Internet Security
ISO/IEC 27009, Information technology - Security techniques - Sector-specific application of ISO/IEC 27001 - Requirements
ISO/IEC 27555, Establishing a PII deletion concept in organizations
ISO/IEC 27554, Application of ISO 31000 for assessment of identity management-related risk
ISO/IEC 27553, Information technology - Security techniques - Security requirements for authentication using biometrics on mobile devices
ISO/IEC TS 27100, Information technology - Cybersecurity - Overview and concepts
ISO/IEC 27045, Big data security and privacy - Processes
ISO/IEC 23532-2, IT Security Techniques - Requirements for the competence of IT security testing and evaluation laboratories - Part 2: Part 1: Testing and evaluation for ISO/IEC 15408Part 2: Testing for ISO/IEC 19790
ISO/IEC 19989-1, Information technology - Security techniques - Criteria and methodology for security evaluation of biometric systems - Part 1: Framework
ISO/IEC 11770-4:2017/Amd 1, Information technology — Security techniques — Key management — Part 4: Mechanisms based on weak secrets AMENDMENT 1: Unbalanced Password-Authenticated Key Agreement with Identity-Based Cryptosystems (UPAKA-IBC)
ISO/IEC 18033-3:2010/Amd 1, Information technology - Security techniques - Encryption algorithms - Part 3: Block ciphers - Amendment 1: Kuznyechik
EN ISO 29134, Information technology - Privacy impact assessment - Guidelines
ISO/IEC 20897-1, Security requirements and test methods for physically unclonable functions for generating non-stored security parameters - Part 1: Security requirements for PUFs
ISO/IEC 20085-1, Test tool requirements and test tool calibration methods for use in testing noninvasive attack mitigation techniques in cryptographic modules - Part 1: Test tools and techniques
ISO/IEC 29192-7, Information technology - Security techniques - Lightweight cryptography - Part 7: Broadcast authentication protocols
ISO/IEC 29192-2/Amd 2, Information technology - Security techniques - Lightweight cryptography - Part 2: Block ciphers - Amendment 2: LEA
ISO/IEC TS 27570, Information Technology - Security Techniques - Privacy guidelines for Smart Cities
ISO/IEC TS 27101, Information technology - Security techniques - Cybersecurity - Framework development guidelines
ISO/IEC 27030, Information technology - Security techniques - Guidelines for security and privacy in Internet of Things (IoT)Title missing
ISO/IEC 23264, Information Technology - Security Techniques - Redaction of Authentic Data
ISO/IEC 30111, Information technology - Security techniques - Vulnerability handling processes
ISO/IEC 27031, Information technology — Security techniques — Guidelines for information and communication technology resilience for business continuity
ISO/IEC 9798-2, Information technology - Security techniques - Entity authentication - Part 2: Mechanisms using authenticated encryption
ISO/IEC 18032, Information technology - Security techniques - Prime number generation
ISO/IEC 27034-4, Information technology - Security techniques - Application security - Part 4: Validation and verification
ISO/IEC 27070, Information technology - Security techniques - Security requirements for establishing virtualized roots of trust
ISO/IEC 27014, Information technology - Security techniques - Governance of information security
ISO/IEC 27050-4, Information technology - Security techniques - Electronic discovery - Part 4: Technical readiness for electronic discovery
ISO/IEC 27035-3, Information technology - Security techniques - Information security incident management - Part 3: Part 3: Guidelines for incident response operations
ISO/IEC 18033-3:2010/Amd 2, Information technology - Security techniques - Encryption algorithms - Part 3: Block ciphers - Amendment 2
ISO/IEC 27552, Information technology - Security techniques - Enhancement to ISO/IEC 27001 for privacy management - Requirements
ISO/IEC 20543, Information technology - Security techniques - Test and analysis methods for random bit generators within ISO/IEC 19790 and ISO/IEC 15408
ISO/IEC 18014-2:2009/Cor 1, Information technology - Security techniques - Time stamping services - Part 2: Mechanisms producing independent tokens
ISO/IEC 20009-3, Information technology - Security techniques - Anonymous entity authentication - Part 3: Mechanisms based on blind signatures concepts
ISO/IEC 29192-6, Information technology - Security techniques - Lightweight cryptography - Part 6: Message authentication codes (MACs)
ISO/IEC 29192-2:2012/Amd 1, Information technology - Security techniques - Lightweight cryptography - Part 2: Block ciphers - Amendment 1
ISO/IEC 20008-2:2013/Cor 1, Information technology - Security techniques - Anonymous digital signature - Part 2: Mechanisms using a group public key
ISO/IEC 14888-3:2016/Cor 1, Information technology - Security techniques - Digital signatures with appendix - Part 3: Discrete logarithm based mechanisms
ISO/IEC 27009:2016/Cor 1, Information technology - Security techniques - Sector-specific application of ISO/IEC 27001 - Requirements
ISO/IEC DIS 27102, Information technology - Security techniques - Information security management guidelines for cyber insurance
ISO/IEC 27005:2011/Cor 1, Information technology - Security techniques - Information security risk management - Technical Corrigendum 1
ISO/IEC 20547-4, Information technology - Big data reference architecture - Part 4: Security and privacy
ISO/IEC DIS 24761, Information technology - Security techniques - Authentication context for biometrics
ISO/IEC DIS 10116.2, Information technology - Security techniques - Modes of operation for an n-bit block cipher
ISO/IEC FDIS 27050-2, Information technology - Electronic discovery - Part 2: Guidance for governance and management of electronic discovery
ISO/IEC 29115:2013/Amd 1, Information technology - Security techniques - Entity authentication assurance framework - Amdendment 1
ISO/IEC DIS 27050-3, Information technology - Security techniques - Electronic discovery - Part 3: Code of Practice for electronic discovery
ISO/IEC 27001, Information technology - Security techniques - Enhancement to ISO/IEC 27001 for privacy management - Requirements
ISO/IEC DIS 21878, Information technology - Security techniques - Security guidelines for design and implementation of virtualized servers
ISO/IEC 27551, Information technology - Security techniques - Requirements for attribute-based unlinkable entity authentication
ISO/IEC TR 27550, Information technology - Security techniques - Privacy engineering
ISO/IEC 29184, Guidelines for online privacy notices and consent
ISO/IEC 20897, Information·technology·-·Security·techniques·- Security requirements, test and evaluation methods for physically unclonable functions for generating nonstored security parameters
ISO/IEC 19989, Evaluation of presentation attack detection for biometrics
ISO/IEC FDIS 19896-1, IT security techniques - Competence requirements for information security testers and evaluators - Part 1: Introduction, concepts and general requirements
Show more Show less
Published 44 standards
Show more Show less
Working group 7 workgroups
SIS/TK 318/AG 01, Strategi
SIS/TK 318/AG 04, Terminologi
SIS/TK 318/AG 11, LIS
SIS/TK 318/AG 21, Kryptografi
SIS/TK 318/AG 31, Kravställning och verifiering
SIS/TK 318/AG 41, Säkerhetsåtgärder och tjänster
SIS/TK 318/AG 51, Integritetsskydd och ID-hantering
Show more Show less
Participants 64 companies and organizations
Advenica AB, Malmö
AdviceU AB, Sundsvall
ÅF-Technology AB, Göteborg
ÅF-Technology AB, Uppsala
Atea Sverige AB, Kista
Atea Sverige AB, Mölndal
C2Solutions AB, Bromma
Caverion Sverige AB, Stckholm
Centiro Solutions AB, Borås
Certezza AB, Stockholm
Cirio Advokatbyrå AB, Stockholm
Combitech AB, Växjö
DNV GL Business Assurance Sweden AB, Solna
E-Legitimationsnämnden, Solna
Equinix (Sweden) AB, Sköndal
Ericsson AB, Stockholm
Ericsson AB (EAB), Stockholm
European Institute for Cyber Security AB, Sigtuna
Folksam Ömsesidig Sakförsäkring, Stockholm
Försvarets Materielverk FMV, Stockholm
Försvarsmakten, Stockholm
Gemalto AB, Älvsjö
Högskolan i Skövde, Skövde
ICA Sverige AB, Solna
Internationella Engelska Skolan i Sverige AB, Täby
Intertek Certification AB, Kista
Karlstads universitet, Karlstad
Länsförsäkringar AB, Stockholm
LGY Konsult AB, Täby
Livförsäkringsbolaget Skandia, ömsesidigt, Stockholm
Microsoft AB, Kista
Myndigheten för digital förvaltning, Sundsvall
Myndigheten För Samhällsskydd och Beredskap (MSB), Stockholm
Nixu AB, Uppsala
Nordea Bank Abp, filial i Sverige, Årsta
Omegapoint AB, Stockholm
Örebro kommun, Örebro
Örebro Universitet, Örebro
Oscarson Security AB, Vedevåg
Parabellum CyberSecurityGroup, Stockholm
Post- och telestyrelsen (PTS), Stockholm
Ragn-Sells Aktiebolag, Sollentuna
Rise Research Institutes of Sweden, Borås
Rise Research Institutes of Sweden, Stockholm
RISE Research Institutes of Sweden, Borås
Rote Consulting AB, Stockholm
Scania CV AB, Södertälje
Simovits Consulting AB, Stockholm
Stiftelsen för Internetinfrastruktur, Stockholm
Stöttepelarna AB, Solna
Styrelsen för Ackreditering & Teknisk Kontroll, Bromma
Svenska Bankföreningen, Stockholm
Svenska Konsult Kammaren AB, Norrtälje
Svenskt Näringsliv Service AB, Stockholm
Sveriges Kommuner och Landsting, Stockholm
Sveriges Television AB, SVT, Stockholm
Telefonaktiebolaget L M Ericsson, Stockholm
Tieto Sweden AB, Karlstad
Trafikverket, Borlänge
Uppsala kommun, Uppsala
Uppsec AB, Uppsala
Västra Götalandsregionen IT enheten, Mölndal
Vattenfall AB, Stockholm
Veriscan Security AB, Karlstad
Show more Show less
International participation 8 international committees
ISO/IEC JTC 1/SC 27/SG 3, Concepts and Terminology
ISO/IEC JTC 1/SC 27/WG 1, Information security management systems
ISO/IEC JTC 1/SC 27/WG 2, Cryptography and security mechanisms
ISO/IEC JTC 1/SC 27/WG 3, Security evaluation criteria
ISO/IEC JTC 1/SC 27/WG 4, Security controls and services
ISO/IEC JTC 1/SC 27/WG 5, Identity management and privacy technologies
CEN/CLC/JTC 13, Cybersecurity & data protection
CEN/CLC/JTC 8, Privacy management in products and services
Show more Show less
Financing
Arbetet styrs och finansieras av de organisationer som deltar i kommittén. Projektavgiften beror på arbetsform och omfattning, samt antal deltagare.
Aktuella remisser Att kommentera

Subjects

Information sequrity management systems Information sequrity management systems Management system IT Security


SS-ISO/IEC 27003:2018

Contact

If you have questions or want to know more about the SIS standardization activities? Please contact us.

Anders Lindberg

Anders Lindberg
Project manager
+46855552284
anders.lindberg@sis.se

Fredrik Stenberg

Fredrik Stenberg
Project assistant
08-55552304
fredrik.stenberg@sis.se