ISO 22342:2023 セキュリティと復元力 — 保護セキュリティ — 組織のセキュリティ計画の策定に関するガイドライン | ページ 2

Foreword

ISO (the International Organization for Standardization) is a worldwide federation of national standards bodies (ISO member bodies). The work of preparing International Standards is normally carried out through ISO technical committees. Each member body interested in a subject for which a technical committee has been established has the right to be represented on that committee. International organizations, governmental and non-governmental, in liaison with ISO, also take part in the work. ISO collaborates closely with the International Electrotechnical Commission (IEC) on all matters of electrotechnical standardization.

The procedures used to develop this document and those intended for its further maintenance are described in the ISO/IEC Directives, Part 1. In particular, the different approval criteria needed for the different types of ISO document should be noted. This document was drafted in accordance with the editorial rules of the ISO/IEC Directives, Part 2 (see www.iso.org/directives ).

ISO draws attention to the possibility that the implementation of this document may involve the use of (a) patent(s). ISO takes no position concerning the evidence, validity or applicability of any claimed patent rights in respect thereof. As of the date of publication of this document, ISO had not received notice of (a) patent(s) which may be required to implement this document. However, implementers are cautioned that this may not represent the latest information, which may be obtained from the patent database available at www.iso.org/patents . ISO shall not be held responsible for identifying any or all such patent rights.

Any trade name used in this document is information given for the convenience of users and does not constitute an endorsement.

For an explanation of the voluntary nature of standards, the meaning of ISO specific terms and expressions related to conformity assessment, as well as information about ISO's adherence to the World Trade Organization (WTO) principles in the Technical Barriers to Trade (TBT), see www.iso.org/iso/foreword.html .

This document was prepared by Technical Committee ISO/TC 292, Security and resilience.

Introduction

All organizations seek to manage security risks in their environment to ensure appropriate protection levels of their assets, to preserve the interests of interested parties and to achieve their objectives.

Organizations sometimes need to establish and maintain a structured approach to security.

The purpose of a security plan is to ensure that all the appropriate actions and controls are in place to protect the organization from threats to its security.

This document gives guidance on the implementation of a security plan whose structure includes the guidance for protective security architecture. Thus, the security plan can be effectively integrated into an existing management system.

Integrating the organization’s risk management processes into the security plan model supports proper management of security. The security plan is designed to allocate accountability and responsibility, and to guide the application of controls to protect the organization from security risks.

A planned approach that is adaptive and agile makes it possible to provide solutions to unplanned situations. Security threats are dynamic and often unforeseen; therefore, this document introduces both technical and human-related elements for an adaptive and agile planned approach.

The intent of the document is to provide the fundamental elements necessary to improve and sustain the protection of an organization.

1 Scope

This document gives guidance on developing and maintaining security plans. The security plan describes how an organization establishes effective security planning and how it can integrate security within organizational risk management practices.

This document is applicable to all organizations regardless of type, size and nature, whether in the private, public or not-for-profit sectors, that wish to develop effective security plans in a consistent manner.

This document is applicable to any organization intending to implement measures designed to protect their assets against malicious acts and mitigate their associated risks.

This document does not provide specific criteria for identifying the need to implement or enhance prevention and protection measures against malicious acts. It does not apply to services and operations delivered by private security companies.

2 Normative references

The following documents are referred to in the text in such a way that some or all of their content constitutes requirements of this document. For dated references, only the edition cited applies. For undated references, the latest edition of the referenced document (including any amendments) applies.

3 Terms and definitions

For the purposes of this document, the terms and definitions given in ISO 22300, ISO 31000 and the following apply.

ISO and IEC maintain terminology databases for use in standardization at the following addresses:

Bibliography