Ulster University Policy Cover Sheet Document Title Electronic Information Assurance and Information Security Management System Policy 2.2 Custodian Chief Operating Officer Approving Committee IT Strategy Group, then Deputy Director of Finance and Information Services (Information Services) Policy approved date IT Strategy Group 2017-03-29 Policy effective from date Policy review date Changes to previous version Page 1 needs” changed to concerns need” – “these “these Page 1 which is more generally referred to as Information Assurance” “, changed to referred to as Information Assurance or Cyber Security)” “(also Page 2 " all of” changed to “all” Page 3 removed order” “in Page 4 27001:2005 - Information Security Management “ISO/IEC – Requirements” changed to 27001:2013 - Information technology “ISO/IEC – Security techniques Information security management systems - – Requirements” Page 4 27002:2005 - Code of Practice for Information Security “ISO/IEC Management” changed to 27002:2013 - Information technology “ISO/IEC – Security techniques Code of practice for information security controls” – Page 4 27005:2011 - Information Security Risk Management” “ISO/IEC changed to 27005:2011 - Information technology Security “ISO/IEC – techniques Information security risk management” – Page 5 27001:2005” changed to 27005:2011” “ISO/IEC “ISO/IEC Page 6 Added:
Document Title Electronic Information Assurance and Information Security Management System Policy 2.2 Custodian Chief Operating Officer Approving Committee IT Strategy Group, then Deputy Director of Finance and Information Services (Information Services) Policy approved date IT Strategy Group 2017-03-29 Policy effective from date Policy review date Ulster University Policy Cover Sheet Changes to previous version Page 1 – “these needs” changed to “these concerns need” Page 1 “, which is more generally referred to as Information Assurance” changed to “(also referred to as Information Assurance or Cyber Security)” Page 2 " all of” changed to “all” Page 3 removed “in order” Page 4 “ISO/IEC 27001:2005 - Information Security Management – Requirements” changed to “ISO/IEC 27001:2013 - Information technology – Security techniques – Information security management systems - Requirements” Page 4 “ISO/IEC 27002:2005 - Code of Practice for Information Security Management” changed to “ISO/IEC 27002:2013 - Information technology – Security techniques – Code of practice for information security controls” Page 4 “ISO/IEC 27005:2011 - Information Security Risk Management” changed to “ISO/IEC 27005:2011 - Information technology – Security techniques – Information security risk management” Page 5 “ISO/IEC 27001:2005” changed to “ISO/IEC 27005:2011” Page 6 Added: