Reference no: EM133423878

Question: Select a section of the ISO 27002:2013 standard at the control level from section 12 (Operations Security).  The control level is at the 3rd layer down, for example: '12.2.1 Controls against malware' has control as its primary feature.  We are trying to get a reasonable spread of these controls throughout the class so try to do them at random from section 12.  [See the week 4 tutorial work if you need to know how to get a copy of the ISO 27002 standard.]

With respect to the control, consider the following issues (and include in your submission):

• should it be generally accepted (or generic, in that it should apply to all organisations using the standard), or company-specific (in that it should only apply to some organisations, based on the local circumstances)? (Justify your answer).
• can you find evidence from academic literature supporting the need for the control that you have selected (you may need to have a quick google scholar search)? One or two articles should be sufficient for this question.
• if this evidence is not apparent in the literature, how could this evidence be obtained to validate the need for such controls, as distinct from just relying on 'best practice'?

Note that these questions are exploring the differences between 'best practice' (an expert consensus model) and academic evidence.  Typically, standards like ISO 27002 are best practice models and are usually derived by groups of experts meeting to discuss the contents, and subsequently reaching some form of consensus about what should go into the standard and how it should be structured.  This is quite different from academic literature where empirical evidence is used to substantiate claims.