Information Security Standards: ISO (ISO/IEC 27001) and the IT Act 2000
To ensure that banks, IT companies, hospitals, and government portals follow world-class security practices and obey the law, two major frameworks are studied in Unit 5:
- ISO Information Security Standards (ISO/IEC 27001 & 27002) — International Security Standard
- The Information Technology (IT) Act, 2000 — India’s Cyber Law
Part 1: Information Security Standards — ISO (ISO/IEC 27001)
What is ISO/IEC 27001? (In Simple Words)
ISO (International Organization for Standardization) and IEC (International Electrotechnical Commission) jointly published the ISO/IEC 27000 family of standards—the world’s most respected gold standard for Information Security!
Specifically, ISO/IEC 27001 is the international standard that specifies the requirements for establishing, implementing, maintaining, and continually improving an ISMS (Information Security Management System) within an organization.
💡 Real-Life Meaning:
When an Indian IT company like TCS, Infosys, or a Cloud Data Center gets ISO 27001 Certified, an independent auditor inspects their firewalls, physical security, employee policies, and disaster backups, and issues an official certificate proving to clients worldwide: “Your data is 100% safe with this company!”
Key Members of the ISO 27000 Family:
- ISO/IEC 27001: The main Certification Standard that defines the mandatory requirements for an ISMS.
- ISO/IEC 27002: Provides the detailed Code of Practice (Best-Practice Security Controls)—covering access control, cryptography, physical security, HR security, and incident management.
- ISO/IEC 27005: Dedicated standard for Information Security Risk Management.
- ISO/IEC 27017 & 27018: Specialized standards for Cloud Computing Security & Privacy.
The PDCA Cycle Used in ISO 27001 (Plan-Do-Check-Act)
ISO 27001 builds an ISMS using a continuous 4-step loop called the PDCA Cycle:
Part 2: The Information Technology (IT) Act, 2000 (India)
What is the IT Act, 2000?
Enacted by the Parliament of India on 17th October 2000 (and majorly updated via the IT Amendment Act, 2008 after the 26/11 attacks), the Information Technology (IT) Act, 2000 is the primary cyber law of India that deals with cybercrime, electronic commerce, digital signatures, and data protection.
Key Objectives of the Indian IT Act, 2000:
- Legal Recognition to Electronic Records (E-Commerce): Gives emails, digital contracts, and online agreements the same legal validity as paper documents signed with ink.
- Legal Recognition to Digital Signatures: Recognizes cryptographic Digital Signatures and Electronic Signatures (like Aadhaar e-Sign) as legally binding in court.
- Establishing Controller of Certifying Authorities (CCA): Regulates Certifying Authorities (CAs) (like eMudhra, NIC) that issue Digital Signature Certificates in India.
- Defining and Punishing Cyber Crimes: Defines hacking, identity theft, phishing, child pornography, and cyber terrorism as criminal offenses with strict fines and jail terms.
- Enabling E-Governance: Allows citizens to file taxes (Income Tax), apply for passports, and pay government fees online.
- Establishing CERT-In (Section 70B): Designates the Indian Computer Emergency Response Team (CERT-In) as the national agency for responding to cyber attacks in India.
Most Important Sections of the IT Act, 2000 (Must Write in Exams!)
Writing 5–6 of these section numbers in your DAVV answer sheet will immediately impress the examiner:
| Section of IT Act | Offense / Provision | Punishment / Penalty |
|---|---|---|
| Section 43 | Unauthorized access, downloading data, or introducing a virus into a computer | Compensation/Damages to the affected victim |
| Section 43A | Corporate negligence in protecting sensitive personal data of customers | Liable to pay financial compensation to victims |
| Section 65 | Tampering with computer source code documents | Up to 3 years imprisonment or fine up to ₹2 Lakhs, or both |
| Section 66 | Computer-related offenses (Hacking / Dishonestly destroying or altering data) | Up to 3 years imprisonment or fine up to ₹5 Lakhs, or both |
| Section 66C | Identity Theft (Fraudulently using someone else’s password, OTP, or digital signature) | Up to 3 years imprisonment and fine up to ₹1 Lakh |
| Section 66D | Cheating by Personation using a computer (Phishing, fake KYC calls, online scams) | Up to 3 years imprisonment and fine up to ₹1 Lakh |
| Section 66E | Violation of Privacy (Capturing or publishing private images without consent) | Up to 3 years imprisonment or fine up to ₹2 Lakhs, or both |
| Section 66F | Cyber Terrorism (Attacking critical national infrastructure or threatening national unity) | Up to Life Imprisonment |
| Section 67 | Publishing or transmitting obscene/explicit material in electronic form | Up to 3–5 years imprisonment and fine up to ₹5–10 Lakhs |
| Section 70B | Establishes CERT-In as India’s national agency for cyber incident response | National nodal agency under MeitY |
💡 DAVV Exam Preparation Tips
10-Mark Question: “Explain Information Security Standards with special reference to ISO 27001 and the Indian IT Act 2000.”
- Define ISO/IEC 27001 and ISMS, and draw the PDCA (Plan-Do-Check-Act) diagram.
- Explain the 6 main objectives of the Indian IT Act, 2000.
- Draw the table of Important Sections of the IT Act (especially Sections 43, 65, 66, 66C, 66D, 66F, and 70B).