|
International
Standard
ISO/IEC 27011
Third edition
Information security, cybersecurity
2024-03
and privacy protection —
Information security controls
based on ISO/IEC 27002 for
telecommunications organizations
Sécurité de l'information, cybersécurité et protection de la
vie privée — Mesures de sécurité de l'information pour les
organismes de télécommunications sur la base de l'ISO/IEC 27002
Reference number
© ISO/IEC 2024
All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may
be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting on
the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address below
or ISO’s member body in the country of the requester.
ISO copyright office
CP 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Geneva
Phone: +41 22 749 01 11
Email: [email protected]
Website: www.iso.org
Published in Switzerland
© ISO/IEC 2024 – All rights reserved
ii
Foreword
ISO (the International Organization for Standardization) and IEC (the International Electrotechnical
Commission) form the specialized system for worldwide standardization. National bodies that are
members of ISO or IEC participate in the development of International Standards through technical
committees established by the respective organization to deal with particular fields of technical activity.
ISO and IEC technical committees collaborate in fields of mutual interest. Other international
organizations, governmental and non-governmental, in liaison with ISO and IEC, also take part in the
work.
The procedures used to develop this document and those intended for its further maintenance
are described in the ISO/IEC Directives, Part 1. In particular, the different approval criteria needed
for the different types of document should be noted (see www.iso.org/directives or
/members_experts/refdocs).
ISO and IEC draw attention to the possibility that the implementation of this document may involve the
use of (a) patent(s). ISO and IEC take no position concerning the evidence, validity or applicability of any
claimed patent rights in respect thereof. As of the date of publication of this document, ISO and IEC had
not received notice of (a) patent(s) which may be required to implement this document. However,
implementers are cautioned that this may not represent the latest information, which may be obtained
from the patent database available at www.iso.org/patents and https://patents.iec.ch. ISO and IEC shall
not be held responsible for identifying any or all such patent rights.
Any trade name used in this document is information given for the convenience of users and does not
constitute an endorsement.
For an explanation of the voluntary nature of standards, the meaning of ISO specific terms
and expressions related to conformity assessment, as well as information about ISO's adherence
to the World Trade Organization (WTO) principles in the Technical Barriers to Trade (TBT)
see www.iso.org/iso/foreword.html. In the IEC, see /understanding-standards.
This document was prepared by ITU-T (as ITU-T Recommendation X.1051) and drafted in accordance
with its editorial rules, in collaboration with Joint Technical Committee ISO/IEC JTC 1, Information
technology, Subcommittee SC 27, Information security, cybersecurity and privacy protection.
This third edition cancels and replaces the second edition (ISO/IEC 27011-1:2016), which has been
technically revised. It also incorporates the Technical Corrigendum ISO/IEC 27011-1:2016/Cor 1:2018.
Any feedback or questions on this document should be directed to the user’s national standards body. A
complete listing of these bodies can be found at www.iso.org/members.html and /national-
committees.
© ISO/IEC 2024 – All rights reserved
iii
INTERNATIONAL STANDARD ISO/IEC 27011
RECOMMENDATION ITU-T X.1051
Information security, cybersecurity and privacy protection – Information security controls
based on ISO/IEC 27002 for telecommunications organizations
Summary
This Recommendation | International Standard:
a) establishes guidelines and general principles for initiating, implementing, maintaining and improving
information security controls in telecommunications organizations based on ISO/IEC 27002;
b) provides an implementation baseline of information security controls within telecommunications
organizations to ensure the confidentiality, integrity and availability of telecommunications facilities,
services and information handled, processed or stored by the facilities and services.
As a result of implementing this Recommendation | International Standard, telecommunications organizations, both within
and between jurisdictions, will:
a) be able to ensure the confidentiality, integrity and availability of global telecommunications facilities,
services and the information handled, processed or stored within global facilities and services;
b) have adopted secure collaborative processes and controls ensuring the lowering of risks in the delivery of
telecommunications services;
c) be able to deliver information security in an effective and efficient manner;
d) have adopted a consistent holistic approach to information security;
e) be able to improve the security culture of organizations, raise staff awareness and increase public trust.
*
History
Edition Recommendation Approval Study Group Unique ID
1.0 ITU-T X.1051 2004-07-29 17 11.1002/1000/7286
2.0 ITU-T X.1051 2008-02-13 17 11.1002/1000/9332
3.0 ITU-T X.1051 2016-04-29 17 11.1002/1000/12845
3.1 ITU-T X.1051 (2016) Cor. 1 2017-09-06 17 11.1002/1000/13407
4.0 ITU-T X.1051 2023-06-13 17 11.1002/1000/15559
Keywords
Information security controls and telecommunications extended controls, information security management, information
security risk assessment, information security risk treatment, ISO/IEC 27002.
*
To access the Recommendation, type the URL https://handle.itu.int/ in the address field of your web
browser, followed by the Recommendation's unique ID.
© ISO/IEC 2024 – All rights reserved
Rec. ITU-T X.1051 (06/2023) v
FOREWORD
The International Telecommunication Union (ITU) is the United Nations specialized agency in the field of
telecommunications, information and communication technologies (ICTs). The ITU Telecommunication
Standardization Sector (ITU-T) is a permanent organ of ITU. ITU-T is responsible for studying technical,
operating and tariff questions and issuing Recommendations on them with a view to standardizing
telecommunications on a worldwide basis.
The World Telecommunication Standardization Assembly (WTSA), which meets every four years, establishes
the topics for study by the ITU-T study groups which, in turn, produce Recommendations on these topics.
The approval of ITU-T Recommendations is covered by the procedure laid down in WTSA Resolution 1.
In some areas of information technology which fall within ITU-T's purview, the necessary standards are
prepared on a collaborative basis with ISO and IEC.
NOTE
In this Recommendation, the expression "Administration" is used for conciseness to indicate both a
telecommunication administration and a recognized operating agency.
Compliance with this Recommendation is voluntary. However, the Recommendation may contain certain
mandatory provisions (to ensure, e.g., interoperability or applicability) and compliance with the
Recommendation is achieved when all of these mandatory provisions are met. The words "shall" or some other
obligatory language such as "must" and the negative equivalents are used to express requirements. The use of
such words does not suggest that compliance with the Recommendation is required of any party.
INTELLECTUAL PROPERTY RIGHTS
ITU draws attention to the possibility that the practice or implementation of this Recommendation may involve
the use of a claimed Intellectual Property Right. ITU takes no position concerning the evidence, validity or
applicability of claimed Intellectual Property Rights, whether asserted by ITU members or others outside of
the Recommendation development process.
As of the date of approval of this Recommendation, ITU had not received notice of intellectual property,
protected by patents/software copyrights, which may be required to implement this Recommendation.
However, implementers are cautioned that this may not represent the latest information and are therefore
strongly urged to consult the appropriate ITU-T databases available via the ITU-T website at
http://www.itu.int/ITU-T/ipr/.
© ITU 2024
All rights reserved. No part of this publication may be reproduced, by any means whatsoever, without the prior
written permission of ITU.
vi Rec. ITU-T X.1051 (06/2023)
© ISO/IEC 2024 – All rights reserved
CONTENTS
Page
1 Scope . 1
2 Normative references . 1
3 Definitions and abbreviations . 1
3.1 Definitions . 1
3.2 Abbreviations . 2
4 Overview . 2
4.1 Structure of this Recommendation | International Standard . 2
4.2 Information security management systems in telecommunications organizations . 3
5 Organizational controls . 5
5.1 Policies for information security . 5
5.2 Information security roles and responsibilities . 5
5.3 Segregation of duties . 6
5.4 Management responsibilities . 6
5.5 Contact with authorities . 6
5.6 Contact with special interest groups . 6
5.7 Threat intelligence . 6
5.8 Information security in project management . 6
5.9 Inventory of information and other associated assets . 6
5.10 Acceptable use of information and other associated assets . 6
5.11 Return of assets . 6
5.12 Classification of information . 7
5.13 Labelling of information . 7
5.14 Information transfer. 7
5.15 Access control . 7
5.16 Identity management . 7
5.17 Authentication information . 7
5.18 Access rights . 7
5.19 Information security in supplier relationships . 7
5.20 Addressing information security within supplier agreements . 8
5.21 Managing information security in the ICT supply chain . 8
5.22 Monitoring, review and change management of supplier services . 8
5.23 Information security for use of cloud services . 8
5.24 Information security incident management planning and preparation . 8
5.25 Assessment and decision on information security events. 9
5.26 Response to information security incidents . 9
5.27 Learning from information security incidents . 9
5.28 Collection of evidence . 9
5.29 Information security during disruption . 9
5.30 ICT readiness for business continuity . 10
5.31 Legal, statutory, regulatory and contractual requirements . 10
...