This Standard should be read in conjunction with AS/NZSISO/IEC 17799:2001, Information technology - Code of practice forinformation security management, which provides guidance on best practice insupport of the requirements of this Standard.

Application
Information is a vital asset in any organization.The protection and security of information is of prime importance to manyaspects of an organization's business. It is therefore important that anorganization implements a suitable set of controls and procedures to achieveinformation security and manages them to retain that level of security once itis achieved.

This Standard is intended for use by managers andemployees who are responsible for initiating, implementing and maintaininginformation security within their organization and it may be considered as abasis for developing organizational security standards.

With increasing electronic networking betweenorganizations there is a clear benefit in having a common reference document forinformation security management. It enables mutual trust to be establishedbetween networked information systems and trading partners and provides a basisfor the management of these systems between users and service providers.

A comprehensive set of controls comprising the bestinformation security practices currently in use is provided in this Standard.This guidance is intended to be as comprehensive as possible. It is intended toserve as a single reference point for identifying the range of controls neededfor most situations where information systems are used in industry and commerceand can therefore be applied by large, medium and small organizations.

Not all the controls will be relevant to every situation.Organizations need to undertake a risk assessment to identify the mostappropriate control objectives and controls to be implemented which areapplicable to their own needs. Once identified, these need to be recorded in astatement of applicability

The control objectives and controls recorded in thestatement of applicability, together with the policy and procedure documents andall other relevant records, are known as the organization's ISMS.