| Date post: | 17-Feb-2018 |
| Category: |
Documents |
| Upload: | vananphanthuy |
| View: | 232 times |
| Download: | 0 times |
of 59
7/23/2019 TCVN ISO-IEC 27004-2009
1/59
TCVN xxxx:xxxx
TCVN T I U C H U N Q U C G I A
TCVN xxxx:2014
ISO/IEC 27004:2009Xut b! "#! $$$$
C%NG NGH& TH%NG TIN ' C(C )* THU+T AN TO,N 'QU-N . AN TO,N TH%NG TIN ' O .NG
Information technology Security techniques Information security management
Measurement
H, N3I 2014
7/23/2019 TCVN ISO-IEC 27004-2009
2/59
2
7/23/2019 TCVN ISO-IEC 27004-2009
3/59
TCVN xxxx:2014
56 "6.8 ! ;#u
1 ? @ B 6!D$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$2 TFu =u! @! !$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ J T=uKt !DL @M ;!= !D=P$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$4 Cu tR tFu =u!$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ T!D uP! @ ;W "8!D P! tWM! t=Y!D t!$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
5.1 Cc mc tiu ca o lng an ton thng tin................................................................................85. Ch!ng t"#nh o lng an ton thng tin....................................................................................1$5.% Cc &'u t( gi)* thnh cng.........................................................................................................1$5.+ , h#nh o lng an ton thng tin.............................................................................................11
Z T= !=? [P bP! u! "\$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$17-.1 Tng /uan 0 t"ch nhi2m ca 3an /u4n l.................................................................................16-. 7u4n l ngun l9c....................................................................................................................... 18-.% T* hu;n< nhn th=c 0 n>ng l9c 0 o lng............................................................................18
7 .]P =^! _` ;W @M a=P t! bM ;W$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$16.1 Tng /uan 0 l9a ch?n cc @( o 0 Ahai t"iBn 3i o.................................................................18
6. c Dnh *hEm 0i 3i o...............................................................................................................1F6.% c Dnh cc thng tin cGn thi't...................................................................................................1F6.+ H9a ch?n (i tIng 0 thuJc tKnh................................................................................................$6.5 Lht t"iBn c;u t")c 3i o.............................................................................................................1
7.5.1 Tng quan v pht trin cu trc bi o..............................................................................217.5.2 La chn !" o...................................................................................................................217.5.# $h%&ng php o.................................................................................................................227.5.' () o *%+ng.....................................................................................................................2#7.5.5 ,- hnh ph/n t0ch...............................................................................................................2#7.5. h3 bo...............................................................................................................................2#7.5.7 Ti4u ch0 qu6t nh.............................................................................................................2#7.5.8 c b4n *i4n quan...............................................................................................................2'
6.- C;u t")c 3i o............................................................................................................................+6.6 Thu th*< *hMn tKch O li2u 0 l* h @! o.................................................................................56.8 T"iBn Ahai o lng 0 xM& 9ng ti li2u o.................................................................................-
HW>t ;c!D ;W "8!D$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$2Z8.1 Tng /uan 0 hoEt Jng o lng...............................................................................................-8. Vi2c tKch hI* cc th tc............................................................................................................. -8.% Vi2c thu th*< lu t"O 0 xc minh O li2u...................................................................................6
9
7/23/2019 TCVN ISO-IEC 27004-2009
4/59
TCVN xxxx:2014
.8 ! ;#u
4
TCVN xxxx:$1+ hon ton t!ng !ng 0Ri SUSWC 6$$+:$$F.
TCVN xxxx:$1+ o Vi2n Xhoa h?c XY thut Zu i2n 3in @oEn< ZJ Thng tin 0
T"u&n thng nghD< Tng cc Tiu chu[n \o lng Ch;t lIng th[m Dnh< ZJ
Xhoa h?c 0 Cng ngh2 cng 3(.
7/23/2019 TCVN ISO-IEC 27004-2009
5/59
TCVN xxxx:2014
T I U C H U N Q U C G I A TCVN XXXX: 2014
CY!D !D= t=Y!D t! C am t=uKt P! tWM! Qu! "\ P! tWM!t=Y!D t! W "8!D9n:or)ation t;chno*og < =;curit t;chniqu;! < 9n:or)ation !;curit )anag;);nt m cng 3( th# * ng *hin 34n Ic nu. \(i 0Ri cc ti li2u 0i2n ]n Ahng ghi n>m cng 3( th#
* ng *hin 34n mRi nh;t _3ao gm c4 cc @^a i< 3 @ung`.
- SUSWC 6$$$:$$F< Cng ngh2 thng tin Cc AY thut an ton d2 th(ng /u4n l an ton
thng tin Tng /uan 0 tp 09ngq
- TCVN SUSWC 6$$1:$$F< Cng ngh2 thng tin Cc AY thut an ton d2 th(ng /u4n l an
ton thng tin Cc &u cGu.
J T=uKt !DL @M ;!= !D=PJ$15Y =i!= B=d! te= _anal&tical mol`
Thut ton horc *hQ* tKnh A't hI* mJt ha& nhiu @( o c! 34n _3a@ ma@u"` horc @( o ]n xu;t
0Ri cc tiu chK /u&'t Dnh *hs hI*.
SUSWC 15F%F:$$6
J$2T=uc te!= _att"i3ut`
Cc rc tKnh horc rc iBm ca mJt (i tIng m cb thB *hMn 3i2t Dnh lIng horc Dnh tKnh 3i conngi horc thi't 3D.
5
7/23/2019 TCVN ISO-IEC 27004-2009
6/59
TCVN xxxx:2014
SUSWC 15F%F:$$6
J$JS` ;W h b! _3a@ ma@u"`
( o Ic xc Dnh tho thuJc tKnh 0 *h!ng *h* cho 0i2c Dnh lIng thuJc tKnh b.
SUSWC 15F%F:$$6
Cde TdfCd ,Jt @( o c! 34n l Jc l* 0 ch=c n>ng 0Ri cc @( o Ahc.
J$4nL "u _ata`
T* hI* cc gi t"D Ic gn cho cc @( o c! 34n< @( o ]n xu;t 0horc cc chk 3o.
SUSWC 15F%F:$$6
J$TFu =e uoft ;!= _ci@ion c"it"ia`
Cc gi t"D ngvng< cc mc tiu< horc cc m h#nh m]uIc @^ ng B /u&'t Dnh @9 cGn thi't *h4i
hnh Jng ha& @ot xQt thm< horc B m t4 m=c J tin c& ca mJt A't /u4 o Dnh.
SUSWC 15F%F:$$6
J$ZS` ;W ! xut _"i0 ma@u"`
( o Ic xc Dnh nh l mJt hm ca hai horc nhiu gi t"D ca cc @( o c! 34n.
SUSWC 15F%F:$$6
J$7C=p bW _inicato"`
( o a "a mJt nh gi ha& Dnh lIng 0 cc thuJc tKnh c thB m Ic ")t "a tp mJt m h#nh
*hMn tKch nhm * =ng nhu cGu thng tin c thB.
J$N=u #u t=Y!D t! _inwo"mation n`
9 hiBu 3i't cGn thi't B /u4n l (i tIng< mc tiu< "i "o 0 cc 0;n @9 c( Ahc.
SUSWC 15F%F:$$6
J$9S` ;W _ma@u"`
Zi'n m gi t"D Ic gn l A't /u4 ca *hQ* o.
SUSWC 15F%F:$$6
Cde TdfCd: Thut ngO cc @( oj Ic @^ ng B c* mJt cch tng thB tRi cc @( o c! 34n< cc @( o ]n xu;t< 0
cc chk 3o.
Vf y: ,Jt *hQ* @o @nh giOa tz l2 l{i o Ic 0 tz l2 l{i 9 Ai'n 0 nh gi xm @9 @ai Ahc n& cb *ht @inh "a mJt 0;n
ha& Ahng.
J$10W "8!D/ bM ;W _ma@u"mnt`
7u& t"#nh B thu th* thng tin 0 hi2u l9c ca S, 0 cc 3i2n *h* /u4n l thng /ua 0i2c @^ ng
mJt *h!ng *h* o< mJt hm o< mJt m h#nh *hMn tKch< 0 mJt tiu chK /u&'t Dnh.
-
7/23/2019 TCVN ISO-IEC 27004-2009
7/59
TCVN xxxx:2014
J$11HM? ;W _ma@u"mnt wunction`
Thut ton horc tKnh ton Ic th9c hi2n B A't hI* hai horc nhiu @( o c! 34n.
SUSWC 15F%F:$$6
J$12
7/23/2019 TCVN ISO-IEC 27004-2009
8/59
TCVN xxxx:2014
9 xc nhn< thng /ua 0i2c cung c;* cc 3ng ch=ng Ahch /uan< "ng cc &u cGu cho mJt mc
Kch @^ ng c thB horc =ng ng Ic tha mn.
J$1S] x ?!= _V"iwication`
9 xc nhn< thng /ua 0i2c cung c;* cc 3ng ch=ng Ahch /uan< "ng cc &u cGu c thB Ic
tha mn.
SUSWC F$$$:$$5
Cde TdfCd: Cng cn Ic g?i l 0i2c AiBm t"a tuMn th.
4 Cu tR tFu =u!
Tiu chu[n n& cung c;* 0i2c gi4i thKch 0 @9 cGn thi't ca cc @( o 0 cc hoEt Jng o lng t"ong
nh gi hi2u l9c ca cc &u cGu S, cho 3an /u4n l(i 0Ri cc 3i2n *h* /u4n l an ton thngtin mJt cch *hs hI* 0 t!ng x=ng tho &u cGu nu t"ong tiu chu[n TCVN SUSWC 6$$1:$$F= j
7/23/2019 TCVN ISO-IEC 27004-2009
10/59
TCVN xxxx:2014
3` Cc &u cGu ca lut *h*< /u& Dnh 0 hI* ng lin /uanq
c` C! c;u t ch=cq
` Chi *hK 0 lIi Kch ca 0i2c th9c hi2n cc 3i2n *h* an ton thng tinq
` Chk tiu ch;* nhn "i "o thng tin ca t ch=cq
w` u cGu cGn @o @nh mJt @( S, ca cc t ch=c t!ng !ng.
1$1 C=h!D ti!= ;W "8!D P! tWM! t=Y!D t!T ch=c cGn thi't l* 0 /u4n l Ch!ng t"#nh o lng an ton thng tin B Et Ic cc mc tiu o
lng thi't l* 0 thKch =ng m h#nh LC t"ong ton 3J cc hoEt Jng o lng ca t ch=c. T
ch=c cng cGn xM& 9ng 0 th9c hi2n cc c;u t")c o lng B cb thB cb Ic cc A't /u4 o Ahch
/uan 0 hOu Kch 9a t"n , h#nh o lng an ton thng tin _xm 5.+`.
Ch!ng t"#nh o lng an ton thng tin 0 c;u t")c o lng t"iBn Ahai *h4i 4m 34o gi)* t ch=c
nh gi Ic hi2u /u4 3i o mJt cch Ahch /uan< 0 cung c;* A't /u4 o cho cc 3n lin /uan B
xc Dnh nhu cGu *h4i hon thi2n S, t"iBn Ahai< 0 c4 *hEm 0i< cc chKnh @ch< cc mc tiu< cc
3i2n *h* /u4n l< cc /u& t"#nh 0 cc th tc.
Ch!ng t"#nh o lng an ton thng tin 3ao gm cc /u& t"#nh @au M&:
a` Ti'n hnh xc Dnh cc @( o 0 3i o _\iu 6`q
3` Cc hoEt Jng o lng _\iu 8`q
c` Vi2c *hMn tKch O li2u 0 l* h @! A' /u4 o _\iu F`q
` \Dnh lIng 0 hon thi2n Ch!ng t"#nh o lng an ton thng tin _\iu 1$`.
C! c;u 0 c;u t")c hoEt Jng ca Ch!ng t"#nh o lng an ton thng tin *h4i Ic Dnh " 3ng
0i2c th9c hi2n a 0o Eng h @! tho /u& m 0 @9 *h=c tE* ca S,. T"ong t;t c4 cc t"ng
hI*< 0ai t" 0 t"ch nhi2m (i 0Ri Ch!ng t"#nh o lng an ton thng tin *h4i Ic /u& " cho
ngi cb n>ng l9c _xm 6.5.8`.
Cc @( o l9a ch?n 0 th9c hi2n 3i Ch!ng t"#nh o lng an ton thng tin *h4i lin /uan t"9cti'* 'n hoEt Jng ca S,< 'n cc @( o Ahc< cng nh 'n /u& t"#nh nghi2* 0 ca t ch=c. Zi
o cb thB Ic tKch hI* 0o cc hoEt Jng thng xu&n ha& cc hoEt Jng t"iBn Ahai tEi nhOng
Aho4ng thi gian xc Dnh 3i 3an /u4n l S,.
1$2 C ofu t` DRB t=M!= Y!Dau M& l mJt @( &'u t( gb* *hGn 0o @9 thnh cng ca Ch!ng t"#nh o lng an ton thng tin
m tEo iu Ai2n thun lIi B hon thi2n S, mJt cch lin tc< cGn *h4i cb:
a` Cam A't ca 3an /u4n l h{ t"I cc ngun l9c thKch hI*q
3` 9 tn tEi ca cc /u& t"#nh 0 cc th tc ca S,q
1$
7/23/2019 TCVN ISO-IEC 27004-2009
11/59
TCVN xxxx:2014
c` Xh4 n>ng x^ l lr* i lr* lEi ca 0i2c thu th* 0 t"ao i thng tin cb Kch B cung c;* cc xu hRng
cb lin /uan t"ong mJt giai oEn thi gianq
` Cc @( o cb thB Ic Dnh lIng 9a t"n cc mc tiu ca S,q
` ng cb Ic O li2u m cb thB @^ ng Ic cho 3i oq
w` \Dnh lIng Ic cc hi2u l9c ca Ch!ng t"#nh o lng an ton thng tin 0 t"iBn Ahai hon thi2n
Dnhq
g` u& t"# 0i2c thu th*< *hMn tKch< 0 3o co O li2u o lng mJt cch Dnh A< cb nJi ung 0 cb
thng tinq
h` Vi2c @^ ng cc A't /u4 o 3i cc 3n lin /uan B xc Dnh nhu cGu cGn c4i thi2n S, t"iBn
Ahai< 3ao gm c4 0 *hEm 0i< cc chKnh @ch< cc mc tiu< cc 3i2n *h* /u4n l< cc /u& t"#nh 0 cc
th tcq
i` Vi2c ch;* nhn thng tin *h4n hi 0 A't /u4 o tp cc 3n cb lin /uanq
~` \Dnh lIng @9 hOu ng ca cc A't /u4 o 0 th9c hi2n cc c4i ti'n xc Dnh.
Nga& @au Ahi t"iBn Ahai thnh cng< Ch!ng t"#nh o lng an ton thng tin cb thB:
1` Ch=ng t @9 tuMn th ca mJt t ch=c 0Ri 0i2c tuMn th *h* lut ha& cc &u cGu iu ti't0
cc ngha 0 hI* ngq
` d{ t"I nhn i2ncc 0;n an ton thng tin t"Rc b Ahng 3D *ht hi2n horc Ahng 3i'tq
%` T"I gi)* t"ong 0i2c * =ng cc h @! /u4n l cGn thi't Ahi nu " cc @( o cho cc hnh Jng
hi2n tEi 0 tp t"Rc bq 0
+` \Ic @^ ng nh l Gu 0o cho /u& t"#nh /u4n l "i "o an ton thng tin< cc nh gi nJi 3J
S, 0 cc @ot xQt ca 3an /u4n l.
1$J 5Y =i!= ;W "8!D P! tWM! t=Y!D t!Cde TdfCd: Cc Ahi ni2m ca m h#nh o lng an ton thng tin 0 cc c;u t")c 3i o @^ ng t"ong tiu chu[n n& 9a
t"n nhOng Ahi ni2m t"ong SUSWC 15F%F. Thut ngO @4n *h[m thng tinj Ic @^ ng t"ong SUSWC 15F%F l ng
ngha 0Ri cc A't /u4 oj t"ong tiu chu[n n& 0 /u& t"#nh o lngj Ic @^ ng t"ong SUSWC 15F%F l ng ngha 0RiCh!ng t"#nh o lngj t"ong tiu chu[n n&.
$4$1 T!D uP! @ ?Y =i!=;W "8!D
, h#nh o lng an ton thng tin l mJt c;u t")c lin A't mJt nhu cGu thng tin tRi cc (i tIng cb
lin /uan ca 3i o 0 cc thuJc tKnh ca ch)ng. \(i tIng o lng cb thB 3ao gm A' hoEch
Dnh horc cc /u& t"#nh< cc th tc< cc 9 n 0 cc ngun l9c t"iBn Ahai.
, h#nh o lng an ton thng tin m t4 lm @ao B cc thuJc tKnh lin /uan Ic Dnh lIng 0
chu&Bn i thnh cc chk 3o cung c;* c! @ cho 0i2c "a /u&'t Dnh. d#nh m t4 m h#nh o lng
an ton thng tin.
11
7/23/2019 TCVN ISO-IEC 27004-2009
12/59
TCVN xxxx:2014
d#nh , h#nh o lng an ton thng tinCde TdfCd: \iu 6 cung c;* chi ti't thng tin 0 cc thnh *hGn "ing ca m h#nh o lng an ton thng tin.
Cc mc nh ti'* tho @ giRi thi2u cc thnh *hGn ca m h#nh. Ch)ng cng cung c;* cc 0K miu
t4 l o ca 0i2c @^ ng nhOng thnh *hGn Jc l* n&.
Cc thng tin cGn thi't ha& mc Kch ca o lng Ic @^ ng t"ong cc 0K t"ong cc Z4ng 1
tRi Z4ng + ca cc *hGn @au M& B nh gi t#nh h#nh nhn th=c 0 tuMn th cc chKnh @ch an ton
thng tin ca t ch=c giOa cc c nhMn cb lin /uan _,c tiu /u4n l .8.< 0 Cc 3i2n *h* /u4n l
.8..1 0 .8..ca TCVN SUSWC 6$$1:$$F`.$4$2 S` ;W h b! @M B=h!D B=B ;W
,Jt @( o c! 34n l @( o !n gi4n nh;t m cb thB cb Ic. ,Jt @( o c! 34n l cc A't /u4 0i2c =ng
ng mJt *h!ng *h* o lng tRi cc thuJc tKnh Ic l9a ch?n ca mJt (i tIng ca 3i o. \(i
tIng ca 3i o cb thB cb nhiu thuJc tKnh< chk mJt @( t"ong b cb thB cung c;* cc gi t"D hOu Kch B
Ic gn nhn cho mJt @( o c! 34n. ,Jt thuJc tKnh cho cb thB Ic @^ ng cho nhiu @( o c!
34n Ahc nhau.
1
Nhu cGu thng tin
di2u /u4
TFu =e uoft ;!=
7/23/2019 TCVN ISO-IEC 27004-2009
13/59
TCVN xxxx:2014
,Jt *h!ng *h* o l mJt t"#nh t9 logic ca cc thut ton Ic @^ ng t"ong 0i2c Dnh lIng mJt
thuJc tKnh (i tIng t!ng =ng0Ri mJt thang gi t"D xc Dnh. Thut ton cb thB 3ao gm cc hnh
Jng nh 'm @( lGn x4& "a ha& 0i2c /uan @tthi gian /ua.
Lh!ng *h* o cb thB * ng nhiu thuJc tKnh cho mJt (i tIng ca o lng. VK 0 mJt (i
tIng ca o lng 3ao gm nhng Ahng giRi hEn 3i:- Xh4 n>ng ca cc 3i2n *h* /u4n l t"iBn Ahai t"ong S,q
- T#nh t"Eng ca cc ti @4n thng tin Ic 34o 02 3i cc 3i2n *h* /u4n lq
- Xh4 n>ng ca cc /u& t"#nh t"iBn Ahai t"ong S,q
- dnh 0i ca cc c nhMn< ngi m chDu t"ch nhi2m (i 0Ri S, t"iBn Ahaiq
- Cc hnh Jng ca cc !n 0D t"ongt ch=c chDu t"ch nhi2m 0 an ton thng tinq 0
- NMng cao m=c J hi lng ca cc 3n /uan tMm.
,Jt *h!ng *h* o cb thB @^ ng cc (i tIng o lng 0 cc thuJc tKnh tp nhiu ngun Ahc
nhau< chng hEn nh:
- LhMn tKch "i "o 0 cc A't /u4 nh gi"i "oq
- Cc cMu hi 0 cc cuJc *hng 0;n c nhMnq
- Cc h @!AiBm t"anJi 3J horc tp 3n ngoiq
- Cc 34n ghi 0 cc @9 Ai2n< nh l cc lDch @^>ng nh* _logwil`
7/23/2019 TCVN ISO-IEC 27004-2009
14/59
TCVN xxxx:2014
ca nh thGu 0 3n th= 3a cGn *h4i Ic o tEo nhn th=c 0 c* nht thng xu&n nhOng
th tc< chKnh @ch 4m 34o an ton thng tin ca t ch=c nh mJt *hGn cng 0i2c 3|t 3uJc`q
Ic th9c hi2n nh @au: T;t c4 c nhMn lin /uan 'n S, *h4i Ic o tEo nMng cao
nhn th=c an ton thng tin t"Rc Ahi Ic c;* t"u& c* 0o h2 th(ng thng tin.
Cc c;u t")c 3i o t!ng =ng Ic miu t4 nh t"ong Z.1.Cde TdfCd: Z4ng 1 + 3ao gm cc cJt Ahc nhau _Z4ng 1 cb 3(n cJtq Z4ng + cb 3a cJt` Ic gn nhn tn xc
Dnh. ,{i t"ong tpng cJt Ic gn nhn mJt @( Dnh anh. Vi2c A't hI* tn 0 @( Dnh anh Ic @^ ng t"ong cc ti'*
tho B tham Ah4o 'n cc t"Rc b. Cc mi tn chk cc lung O li2u giOa cc thnh *hGn "ing 3i2t ca m h#nh o
lng an ton thng tin t"ong cc 0K c thB.
Z4ng 1 3ao gm mJt 0K 0 cc m(i /uan h2 giOa (i tIng ca 3i o< thuJc tKnh< *h!ng *h* o
0 @( o c! 34n cho 3i o cc (i tIng thi't l* cho cc 3i2n *h* /u4n l t"iBn Ahai nh
m t4 t"n.
Z4ng 1 VK 0 @( o c! 34n 0 *h!ng *h* o
\(i tIng ca 3i o_U3~ct ow
,a@u"mnt`
ThuJc tKnh_tt"i3ut`
Lh!ng *h*o _,a@u"mnt
,tho`
( o c! 34n _Za@,a@u"`
$4$J S` ;W ! xut @M =M? ;W "8!D
( o ]n xu;t l A't hI* ca hai horc nhiu @( o c! 34n. ,Jt @( o c! 34n cb thB *hc 0 nh l
Gu 0o mJt @( @( o ]n xu;t.
dm o lng l mJt @9 tKnh ton Ic @^ ng B A't hI* cc @( o c! 34n 0Ri nhau B tEo "a @( o
]n xu;t.
1+
U.1.1 X' hoEcho tEonhn th=c0 an ton thngtin
.1.1 c DnhnhMn @9 tham giat"ong A' hoEcho tEo _U.1.1`
U.1. NhMn @9 hon thnh horcang tham giaAhba o tEo
U..1 X' hoEch Atha thun ngisng
U.. NhMn @9hi2n ang A camA't 0Ri t ch=c
l! B=B u! "\ 2:
l! B=B u! "\ 1:
.1. T#nh t"Engca nhMn @9 Ahitham gia Ahba h?c_U.1.`
.1. Cc nhMn @9Ic ch?n t"ong A'hoEch A tha thun_U..1`
.. T#nh t"Engca nhMn @9 00i2c A tha thunngi sng _U..`
,.1\'m @( lIngngi Ic otEo _..1` 0 @Ic hon thnhEo tEo cho tRing& th9c hi2n o_.1.1`
,. di cc cnhMn cb t"chnhi2m 0 @( ngi honthnh nMng caonhn th=c _.1.`t"n @( ang cb A'hoEch nMng caonhn th=c _..`
,.%\'m @( lIngngi Ic lnA' hoEch @ Acam A't cho 'nng& th9c hi2n o_..1`
,.+ \'m @( nhMn@9 Ic Atha tha thunngi sng _..`
Z.1 NhMn @9 AtRi hm na&_..1ng ca
ngi "a /u&'t Dnh t"ong 0i2c u tin 0 ch) t"?ng 0o cc hnh Jng hon thi2n h2 th(ng. Cc A't/u4 o @ Ic u tin 9a t"n tGm /uan t"?ng ca cc thng tin cGn thi't t!ng =ng 0 *hs hI* 0Ri
cc (i tIng ca S,.
Cde TdfCd: LhEm 0i 3i o lin /uan tRi *hEm 0i ca S, thi't l* tho +..1 a` ca TCVN SUSWC 6$$1:$$F.
J$J X ;!= t=Y!D t! #! t=ft,{i c;u t")c 3i o nn t!ng =ng tRi Kt nh;t mJt thng tin cGn thi't. VK 0 thng tin cGn thi't< nh
miu t4 t"ong iBm Ahi Gu nh l mc Kch ca 3i o< 0 iBm cu(i 0Ri cc tiu chK /u&'t Dnh lin
/uan Ic 3iBu in t"ong *hGn Lh lc .
Cc hnh Jng @au @ Ic th9c hi2n B xc Dnh cc thng tin lin /uan cGn thi't:
1F
7/23/2019 TCVN ISO-IEC 27004-2009
20/59
TCVN xxxx:2014
a` XiBm t"a S, 0 /u& t"#nh ca nb< nh l:
1` ChKnh @ch 0 cc mc tiu ca S,< cc mc tiu /u4n l 0 cc 3i2n *h* /u4n lq
` Cc &u cGu ca lut *h*< /u& Dnh 0 hI* ng lin /uan 0 cc &u cGu t ch=c cho an
ton thng tinq
%` Cc A't /u4 ca /u t"#nh /u4n l "i "o an ton thng tin< nh Ic miu t4 t"ong TCVN
SUSWC 6$$1:$$F.
3` u tin cc thng tin cGn thi't xc Dnh9a t"n tiu chK< nh l:
1` Cc m=cu tin x^ l "i "oq
` Xh4 n>ng 0 ngun l9c ca t ch=cq
%` 9 /uan tMm ca cc 3n lin /uanq
+` ChKnh @ch an ton thng tinq
5` Thng tin Ic &u cGu B * =ng cc &u cGu ca *h* lut< /u& Dnh 0 hI* ng lin
/uanq
-` Pi t"D ca thng tin lin /uan tRi chi *hK ca 3i oq
c` Ch?n mJt nhbm thng tin &u cGu B ghi nhn t"ong cc hnh Jng o lng c>n c= 0o
anh @ch m=c u tinq 0
` H* ti li2u 0 t"ao i cc nhu cGu thng tin cGn Ic g^i cho cc 3n lin /uan.
T;t c4 cc @( o lin /uan Ic =ng ng cho S, t"iBn Ahai< cc 3i2n *h* /u4n l ha& nhbm
cc 3i2n *h* /u4n l @ Ic t"iBn Ahai 9a t"n cc thng tin cGn thi't Ic l9a ch?n.
J$4 .]P =^! ;` tg!D @M t=uc te!=,Jt (i tIng ca o lng 0 thuJc tKnh ca (i tIng @ Ic xc Dnh t"ong 3(i c4nh tng thB 0
*hEm 0i ca S,. CGn lu "ng mJt (i tIng ca o lng cb thB cb nhiu thuJc tKnh =ng ng.
\(i tIng 0 thuJc tKnh ca nb Ic @^ ng 3i @( o @ Ic ch?n 9a t"n m=c J u tin ca
cc thng tin cGn thi't t!ng =ng.
Cc gi t"D Ic gn nhn cho @( o c! 34n lin /uan cb Ic 3ng 0i2c =ng ng *h!ng *h* o
*hs hI* cho cc thuJc tKnh Ic l9a ch?n. Vi2c l9a ch?n n& @ cng Ic 4m 34o "ng:
- Cc @( o c! 34n lin /uan 0 *h!ng *h* o *hs hI* Ic xc Dnhq
- Cc A't /u4 o cb nhiu ngha Ic *ht t"iBn 9a t"n cc gi t"D thu Ic 0 cc @( o
ti'n hnh.
Cc rc tKnh ca cc thuJc tKnh Ic ch?n xc Dnh nhOng loEi *h!ng *h* o no cGn Ic @^
ng B thu Ic cc gi t"D Ic gn nhncho cc @( o c! 34n _c4 0 Dnh tKnhha& 0 Dnh lIng`.
$
7/23/2019 TCVN ISO-IEC 27004-2009
21/59
TCVN xxxx:2014
Cc (i tIng Ic l9a ch?n 0 cc thuJc tKnh ca nb @ Ic xM& 9ng thnh ti li2u< csng 0Ri 0i2c
*hMn thnh tpng *hGn B ng cho 0i2c l9a ch?n.
O li2u miu t4 (i tIng ca 3i o0 cc thuJc tKnh t!ng =ng @ Ic @^ ng nh l cc gi t"D
B Ic gn nhn thnh cc @( o c! 34n. VK 0 cc (i tIng ca 3i o3ao gm nhng Ahng
3D giRi hEn tRi:- Cc @4n *h[m 0 cc Dch 0q
- Cc /u& t"#nhq
- Cc ti @4n Ah4 ng nh l cc *h!ng ti2n< cc =ng ng< 0 cc h2 th(ng thng tin nh
Ic xc Dnh t"ong TCVN SUSWC 6$$1:$$F _XiBm A ti @4n< .6.1.1`q
- Cc 3an nghi2* 0q
- Cc chi nhnhq 0
- Cc Dch 0 3n th= 3a.
Cc thuJc tKnh @ Ic xm xQt B 4m 34o "ng:
a) Cc thuJc tKnh Ic ch?n cho 3i ol *hs hI*q 0
b) Vi2c thu th* O li2u Ic xc Dnh B 4m 34o @( lIng cc thuJc tKnh Ic l9a ch?n
l B in t4 hi2u /u4 ca 3i o.
Chk cc thuJc tKnh m cb lin /uan tRi cc @( o c! 34n t!ng =ng @ Ic l9a ch?n. ,rc s 0i2c l9a
ch?n cc thuJc tKnh @ cGn cb cMn nh|c 0 m=c J Ahb t"ong 0i2c thu Ic cc thuJc tKnh cho 3i ong tha mn t(t nh;t 0i2c thng tin cGn thi't Ic l9a ch?n @
Ic ch?n l9a. Thng tin 0 3(i c4nh l cGn thi't B in gi4i ha& !n gi4n hba cc @( o cng @
Ic xc Dnh.
Cde TdfCd: Nhiu @9 A't hI* Ahc nhau ca cc @( o _nh cc @( o c! 34n< cc @( o ]n xu;t< 0 cc chk 3o` cb thB
Ic ch?n B Dnh "a cc thng tin cGn thi't c thB.
Cc @( o Ic ch?n @ *h4n nh m=c u tin ca thng tin Ic ch?n. d!n nOa cc tiu chu[n m]u
m cb thB Ic @^ ng cho 0i2c l9a ch?n ca cc @( o 3ao gm:
- ng thu th* O li2uq
- Xh4 n>ng @n @ng ca ngun nhMn l9c B thu th* 0 /u4n l O li2uq
- Xh4 n>ng @n @ng ca cc cng c *hs hI*q
- ( cc chk 3o tim n>ng lin /uan Ic ch=ng minh 3i @( o c! 34nq
- ng in gi4iq
- ( ngi @^ ng cc A't /u4 o ti'n hnhq
- Zng ch=ng nh l mJt @9 *hs hI* ca o lng hI* mc Kch ha& cc thng tin cGn thi'tq
- Chi *hK B thu th*< /u4n l 0 *hMn tKch O li2u.
J$$J
7/23/2019 TCVN ISO-IEC 27004-2009
23/59
TCVN xxxx:2014
,Jt *h!ng *h* o @ Ic xm nh *hs hI* 'n m=c cc gi t"D Ic gn nhn tRi mJt @( o c!
34n th9c hi2n tEi nhOng thi iBm Ahc B @o @nh 0 b l cc gi t"D Ic gn nhnB t" thnh
@( o ]n xu;t 0 mJt chk 3o cng Ic @o @nh.
3.5.4 HM? ;W "8!D
VRi m{i @( o ]n xu;t "ing 3i2t< mJt hm o lng @ Ic xc Dnh 0 Ic =ng ng cho hai ha&nhiu gi t"D Ic gn nhn tRi cc @( o c! 34n. dm o lng Ic @^ ng B chu&Bn gi t"D
Ic gn nhn @ang mJt ha& nhiu @( o c! 34n 0 gi t"D B Ic xc nhn t" thnh mJt @( o ]n
xu;t. T"ong mJt @( t"ng hI*< mJt @( o c! 34n cng cb thB gb* *hGn t"9c ti'* cho m h#nh *hMn
tKch t"ong 0i2c 3 @ung B thnh mJt @( o ]n xu;t.
,Jt hm o lng _nh tKnh ton` cb thB 3ao gm nhiu AY thut< nh t"ung 3#nh tng ca t;t c4 cc
gi t"D Ic gn nhn cho cc @( o c! 34n< 0i2c =ng ng cc t"?ng @( B cc gi t"D Ic gn nhn
cho cc @( o c! 34n< ha& 0i2c gn nhn cc gi t"D Dnh tKnh tRi cc gi t"D Ic gn nhn tRi cc
@( o c! 34n t"Rc Ahi A't hI* ch)ng 0o thnh gi t"D B Ic gn nhn tRi mJt @( o ]n xu;t. dm
o lng cb thB A't hI* cc gi t"D Ic gn nhn tRi cc @( o c! 34n @^ ng cc thang gi t"D
Ahc nhau< nh l tz l2 *hGn t">m 0 cc A't /u4 nh gi 0 Dnh tKnh.
J$$ 5Y =i!= B=d! te=
VRi m{i chk 3o< mJt m h#nh *hMn tKch @ Ic xc Dnh nhm mc Kch chu&Bn i mJt ha& nhiu gi
t"D ;n Dnh cho mJt @( o c! 34n ha& @( o ]n xu;t 0o t"ong gi t"D B Ic gn nhn cho chk 3o.
, h#nh *hMn tKch A't hI* cc @( o lin /uan tho cch m thun lIi cho cc 3n lin /uan.
Tiu chK /u&'t Dnh m Ic =ng ng B tEo "a mJt chk 3o @ cng Ic xQt 'n Ahi xc Dnh m
h#nh *hMn tKch.
\i Ahi mJt m h#nh *hMn tKch cb thB chk !n gi4n nh l 0i2c chu&Bn i mJt gi t"D !n Ic gn
nhn @ang mJt @( o ]n xu;t @ang gi t"D B Ic gn nhn @ang mJt chk 3o.
J$$Z C=p bW
Cc gi t"D Ic gn nhn cho cc chk 3o 3ng 0i2c A't hI* cc gi t"D Ic gn nhn cho @( o
]n xu;t 0 0i2c in gi4i nhOng gi t"D n& 9a t"n cc tiu chK /u&'t Dnh. VRi m{i chk 3o m @
Ic thng 3o tRi 3n nhn _clint` mJt 34n Dnh Eng cho 0i2c 3iBu in ca cc chk 3o nh l mJt
*hGn ca cc 34n Dnh Eng h @! _xm 6.6` @ Ic xc Dnh.
Cc 34n Dnh Eng cho 0i2c 3iBu in ca chk 3o @ miu t4 t"9c /uan cc @( o 0 cung c;* mJt gi4i
thKch 3ng li cho cc chk 3o. Cc 34n Dnh Eng cho cc 3iBu in thng 3o nn Ic ts& 3i'n B
* =ng nhu cGu thng tin ca 3n nhn.
J$$7 TFu =e uoft ;!=
Tiu chK /u&'t Dnh t!ng =ng 0Ri m{i chk 3o @ Ic xc Dnh 0 xM& 9ng thnh ti li2u 9a t"n
cc mc tiu an ton thng tin< B mang lEi cc hRng ]n Ah4 thi cho cc 3n lin /uan. dRng ]n
%
7/23/2019 TCVN ISO-IEC 27004-2009
24/59
TCVN xxxx:2014
n& @ Ic Dnh " nhOng mong mu(n cho ti'n t"#nh 0 cc ngvng cho 0i2c Ahi Gu hon thi2n cc
hnh Jng 9a t"n chk 3o.
Tiu chK /u&'t Dnh thi't l* mJt mc Kch m @9 thnh cng _xm 5.%` l nh gi Ic 0 cung c;*
hRng ]n 0 @9 in gi4i cc chk 3o lin /uan tRi nhOng lGn o gGn gi(ng 0Ri mc Kch b.
Cc mc Kch cGn Ic thi't rt cho m{i hEng mc tho Ah4 n>ng ca cc /u& t"#nh S, 0 cc 3i2n*h* /u4n l< Et Ic cc mc tiu< 0 hi2u l9c ca S, Ic Dnh lIng.
Zan /u4n l cb thB /u&'t Dnh Ahng thi't l* cc mc Kch cho cc chk 3o cho tRi Ahi O li2u Ahi Gu
Ic thu th*. Cc tiu chK B /u&'t Dnh 0 m(c t"iBn Ahai cb thB Ic Dnh ngha nhm hi2n th9c
hba cho mJt S, xc Dnh. N'u tiu chK /u&'t Dnh Ahng Ic thi't l* tEi iBm b< 3an /u4n l @
cGn *h4i Dnh lIng nhOng (i tIng no ca 3i o 0 cc @( o t!ng =ng @ cung c;* gi t"D nh
mong mu(n cho t ch=c.
Vi2c thi't l* tiu chK /u&'t Dnh cb thB thun ti2n n'u O li2u /uan t"?ng t"Rc Aia m g|n lin 0Ri cc@( o ti'n hnh ha& Ic ch?n l cb. Cc xu hRng gim @t th9c hi2n t"ong /u Ah=
cng @ cung c;* hiBu 3i't " h!n 0o t"ong cc 4i Ah4 n>ng th9c hi2n m cb tp t"Rc 0 hRng
]n cho 0i2c a "a tiu chK /u&'t Dnh cb tKnh th9c t'. Tiu chK /u&'t Dnh cb thB Ic tKnh ton ha&
9a t"n @9 hiBu cb tKnh Ahi ni2m ca cc hnh 0i nh mong mu(n. Tiu chK /u&'t Dnh cb thB Ic
")t "a tp cc O li2u< cc 9 n< nhOng Ahm *h ha& nhOng tKnh ton tp t"Rc nh l cc giRi hEn
3i2n *h* /u4n l th(ng A ha& cc giRi hEn J tin c& th(ng A.
J$$ C bF! "F! uP!
VRi m{i @( o c! 34n @( o ]n xu;t *hs hI* 0Ri cc 3n lin /uan @ Ic xc Dnh 0 l* thnh ti
li2u. Cc 3n lin /uan cGn lu cc thng tin @au:
a` \(i tIng _clint` ca 3i o: Zan /u4n l ha& cc 3n /uan tMm &u cGu ha& mong mu(n
thng tin 0 hi2u l9c ca S,< cc 3i2n *h* /u4n l ha& nhbm cc 3i2n *h* /u4n lq
3` Ngi @ot xQt 3i o: c nhMn ha& !n 0D t ch=c m AiBm t"a tKnh hI* l2 cc c;u t")c ca 3i
o ti'n hnh l *hs hI* cho 0i2c nh gi hi2u l9c ca S,< cc 3i2n *h* /u4n l ha&
nhbm cc 3i2n *h* /u4n lq
c` Ngi @ hOu thng tin: c nhMn ha& mJt !n 0D t ch=c m @ hOu thng tin 0 mJt (i tIng
ca 3i o< cc thuJc tKnh 0 chDu t"ch nhi2m 0 o lng bq
` ZJ *hn thu th* thng tin: c nhMn ha& t ch=c chDu t"ch nhi2m t"ong 0i2c thu th*< ghi chQ*ng B 3iBu in cc gi t"D Jng 3ao gm cc c4nh 3o< cc thnh *hGn thD 0 ccnhn 3iBu in cc iBm m(c.
J$ T! a=P ;W "8!D @M xdo ]!D tM "u ;WCch ti'* cn ton i2n tRi 3i o nn Ic l* thnh ti li2u t"ong A' hoEch t"iBn Ahai. X' hoEch t"iBn
Ahai cGn 3ao gm cc thng tin t(i thiBu @au:
a` T"iBn Ahai Ch!ng t"#nh o lng an ton thng tin S,L cho t ch=cq
3` XY thut o lng 3ao gm:
1` C;u t")c o lng chung cho t ch=cq
` C;u t")c o lng "ing cho t ch=cq
%` \Dnh ngha 4i gi t"D 0 cc th tc cho 0i2c thu th* 0 *hMn tKch O li2uq
c` X' hoEch thi gian B th9c hi2n cc hoEt Jng o lngq
` Cc 34n ghi Ic tEo thng /ua th9c hi2n cc hnh Jng o< 3ao gm O li2u Ic thu
th* 0 cc 34n ghi *hMn tKchq 0
` Cc Dnh Eng h @! A't /u4 o @ Ic 3o co tRi 3an /u4n l cc 3n lin /uan _xm
SUSWC 6$$1:$$5 \iu 6 ot xQt ca 3an /u4n lj`.
4 HW>t ;c!D ;W "8!D
4$1 T!D uP! @ =W>t ;c!D ;W "8!DdoEt Jng o lng an ton thng tin lin /uan tRi cc hnh Jng cGn thi't cho 0i2c 4m 34o "ng cc
A't /u4 o t"iBn Ahai cung c;* thng tin chKnh xc lin /uan 'n hi2u l9c ca S, t"iBn Ahaing ca ZJ *hn thu th* thng tin 0 @9 hiBu 3i't 0 cc loEi &u cGu ca O
li2u< cng c thu th* O li2u 0 cc t"#nh t9 thu th* O li2uq
` Vi2c *ht t"iBn cc chKnh @ch 0 cc th tc xc Dnh tKnh hOu ngca o lng t"ong t
ch=c< 0i2c *h 3i'n O li2u thng tin o lng< nh gi 0 @ot xQt ca Ch!ng t"#nh o lng
an ton thng tinq
w` TKch hI* *hMn tKch O li2u 0 l* h @! o 0o t"ong cc /u& t"#nh lin /uan B 4m 34o cc
hoEt Jng Ic in "a tho )ng Ah4 n>ngq
g` Vi2c gim @t< @ot xQt 0 Dnh lIng cc A't /u4 oq
h` Vi2c thi't l* mJt /u& t"#nh cho nhOng lGn o 0 3 @ung nhOng lGn o mRi B 4m 34o "ng
nhOng It o lun Ic th9c hi2n t"ong t ch=cq
i` Vi2c thi't l* ca mJt /u& t"#nh nhm xc Dnh thi hEn hOu ng ca nhOng O li2u t"ong /u
Ah= B lm c! @ cho xc Dnh xu hRng *hMn tKch t"ong giai oEn ti'* tho.
4$J V t=u t=KBv "u tL @M x ?!= L "u
Cc hoEt Jng thu th*< lu t"O 0 xc minh O li2u 3ao gm nh @au:
a` Thu th* O li2u &u cGu tho tGn @u;t tpng Aho4ng thi gian 3ng cch @^ ng *h!ng *h*
o Ic thi't A'q
3` Vi2c xM& 9ng ti li2u thu th* O li2u< 3ao gm:
1` Ng& thng< thi gian 0 0D t"K ca 0i2c thu th* O li2uq
` ZJ *hn thu th* thng tinq
%` Ngi @ hOu thng tinq
+` ,?i *ht hnh t"ong @u(t thi gian thu th* O li2u m hOu ngq
5` Thng tin sng cho 0i2c xc minh O li2u 0 0i2c AiBm t"a tKnh hI* l2 ca 3i o.
c` Vi2c xc minh O li2u thu th* 9a t"n tiu chK l9a ch?n cc @( o 0 tiu chK AiBm t"a tKnh
hI* l2 ca cc c;u t")c 3i o.
O li2u Ic thu th* 0 m?i thng tin cGn thi't @ Ic A't hI* 0 lu t"O t"ong cc h @! o B
lm c! @ cho *hMn tKch O li2u.
6
7/23/2019 TCVN ISO-IEC 27004-2009
28/59
TCVN xxxx:2014
5
7/23/2019 TCVN ISO-IEC 27004-2009
29/59
TCVN xxxx:2014
NhOng h @! m Ic @^ ng B *ht hnh cc A't /u4 ca o lng tRi cc 3n lin /uan cGn *h4i
Ic chu[n 3D @^ ng cc Dnh Eng h @! *hs hI* _xm 6.6` tuMn tho A' hoEch t"iBn Ahai Ch!ng
t"#nh o lng an ton thng tin.
NhOng A't lun ca 0i2c *hMn tKch @ cGn Ic @ot xQt 3i cc 3n lin /uan B 4m 34o in gi4i
*hs hI* 0Ri O li2u o. Cc A't /u4 ca 0i2c *hMn tKch O li2u cGn Ic l* thnh ti li2u B thng3o tRi cc 3n lin /uan.
$J TPW ; aft u ;WNgi chDu t"ch nhi2m t"ao i thng tin @ xc Dnh lm @ao B thng 3o cc A't /u4 o an ton
thng tin< nh @au:
- NhOng A't /u4 o no l Ic thng 3o t"ong nJi 3J ha& "a ngoiq
- H* anh @ch nhOng @( o t!ng =ng 0Ri tpng 3n lin /uan< nhOng 3n /uan tMmq
- Cc A't /u4 o xc Dnh cGn Ic cung c;*< 0 *hMn loEi thKch hI* cho nhu cGu ca tpng
nhbmq 0
- Cc *h!ng ti2n cho 0i2c thu nhn cc thng tin *h4n hi tp cc 3n lin /uan B Ic @^
ng cho 0i2c hOu Kch ca cc A't /u4 o 0 hi2u l9c ca Ch!ng t"#nh o lng an ton thng
tin.
Cc A't /u4 3i o nn Ic thng 3o tRi nhiu 3n lin /uan t"ong nJi 3J< 3ao gm tRi:
- Cc (i tIng _clint@` cho 3i o _xm 6.5.8`q
- NhOng ngi@ hOu thng tin _xm 6.5.8`q
- Ngi *h t"ch /u4n l "i "o an ton thng tin< rc 3i2t tEi n!i x4& "a cc l{i 0 nh gi "i "o
Ic xc Dnhq
- Ngi cb t"ch nhi2m (i 0Ri nhOng Ahu 09c xc Dnh cGn *h4i cb cc 3i2n *h* hon thi2n.
Vi2c t ch=c cb thB Ic &u cGu t"ong mJt @( t"ng hI* B *hMn *ht h @! cc A't /u4 o tRi cc
(i tc 3n ngoi< 3ao gm cc chu&n gia< cc 3n lin /uan< cc Ahch hng 0 cc nh cung c;*.
Xhu&'n nghD "ng< nhOng h @! t"ong cc A't /u4 o Ic *hMn *ht "a ngoi chk ch=a O li2u *hshI* cho 0i2c *ht hnh "a 3n ngoi 0 Ic @9 ng 3i 3an /u4n l 0 cc 3n lin /uan t"Rc
Ahi *ht hnh.
6!= "g!D @M =WM! t=! C=h!D ti!= ;W "8!D P! tWM! t=Y!D t!
Z$1 T!D uP! @ ;!= "g!D @M =WM! t=! =h!D ti!=Vi2c t ch=c @ Dnh lIng 0Ri nhOng thi iBm Dnh t"ong A' hoEch nh @au:
a` di2u l9c ca Ch!ng t"#nh o lng an ton thng tin B 4m 34o "ng nb:
1` \a "a nhOng A't /u4 o tho mJt cch hi2u /u4q
` \ Ic th9c hi2n tho mJt A' hoEch Dnhq
F
7/23/2019 TCVN ISO-IEC 27004-2009
30/59
TCVN xxxx:2014
%` Chk "a nhOng tha& i t"ong 3i2n *h* /u4n l S, t"iBn Ahaiq
+` Chk "a nhOng tha& i t"ong t ch=c _nh cc &u cGu< tKnh hI* *h*< ha& tKnh cng ngh2`.
3` 9 hOu Kch ca cc A't /u4 o ti'n hnh 4m 34o "ng ch)ng tha mn cc nhu cGu thng
tin cb lin /uan.
Zan /u4n l nn chk " tGn @u;t cho 0i2c Dnh lIng< chu A @^a i A' hoEch 0 thi't l* cc c! ch'
cho 0i2c tEo "a nhOng *hin 34n *hs hI* _xm 6. t"ong TCVN SUSWC 6$$1:$$F`.
Cc hnh Jng lin /uan @ 3ao gm:
1) c Dnh tiu chK Dnh lIng cho Ch!ng t"#nh o lng an ton thng tin _xm 1$.`q
2) Pim @t< @ot xQt< 0 Dnh lIng o lng _xm 1$.%` 0q
3) Th9c hi2n cc hon thi2n _xm 1$.+`.
Z$2 N=K! ! tFu =e ;!= "g!D =W C=h!D ti!= ;W "8!D P! tWM! t=Y!D t!T ch=c @ Dnh " tiu chK cho 0i2c Dnh lIng hi2u l9c ca Ch!ng t"#nh o lng an ton thng tin
nh l 0i2chOu ng ca cc A't /u4 Dnh lIng ti'n hnh. Tiu chK @ *h4i Ic chk " tp l)c 3|t
Gu t"iBn Ahai Ch!ng t"#nh o lng an ton thng tin< Ic cMn nh|c< xm xQt t"ong @9 t!ng /uan
0Ri cc mc tiu nghi2* 0 ca t ch=c.
NhOng tiu chK *hs hI* nh;t Ahi t ch=c Dnh lIng 0 hon thi2n Ch!ng t"#nh o lng an ton
thng tin t"iBn Ahai l:
- NhOng tha& i t"ong mc tiu nghi2* 0 ca t ch=cq
- NhOng tha& i B *hs hI* 0Ri cc &u cGu 0 chKnh @ch< lut *h* 0 cc "ng 3uJc t"ong an
ton thng tinq
- NhOng tha& i t"ong cc &u cGu ca t ch=c 0 an ton thng tinq
- NhOng tha& i 0 nhOng "i "o an ton thng tin tRi t ch=cq
- Vi2c gia t>ng Ah4 n>ng ca 0i2c @ng l?c ha& loEi O li2u *hs hI* h!n ha& cc *h!ng *h*
B thu th* O li2u cho cc mc Kch ca o lngq
- NhOng tha& i B *hs hI* 0Ri (i tIng 0 cc thuJc tKnh ca nb.
Tiu chK @au cb thB Ic =ng ng B Dnh lIng cc A't /u4 o ti'n hnh:
a` Cc A't /u4 o l:
1` hiBuq
` \Ic thng 3o )ng thi gianq
%` Xhch /uan< cb tKnh @o @nh 0 cb thB ti @^ ng.
3` Cc /u& t"#nh thi't l* cGn *h4i:
%$
7/23/2019 TCVN ISO-IEC 27004-2009
31/59
TCVN xxxx:2014
1` \Ic Dnh ngha t(tq
` ng B 0n hnh hoEt Jngq
%` Vi2c A' ti'* nhau *hs hI*.
c` Cc A't /u4 o hOu ng cho 0i2c nMng cao an ton thng tinq
` Cc A't /u4 o * =ng nhu cGu thng tin *hs hI* ca t ch=c.
Z$J G? _tv _Wt xst @M ;!= "g!D =h!D ti!=T ch=c cGn gim @t< @ot xQt 0 Dnh lIng Ch!ng t"#nh o lng an ton thng tin ca m#nh 9a
0o tiu chK Ic thi't l* _xm 1$.`.
T ch=c cng cGn nhn "a nhOng &u cGu /uan t"?ng cho 0i2c nMng cao S,L t"iBn Ahai< 3ao gm:
a` ot xQt ha& @^a i c;u t")c o lng cho *hs hI* B c;u t")c n& Ic cho l thKch hI*
gGn M&q
3` c Dnh lEi nhOng ngun l9c B h{ t"I cho Ch!ng t"#nh o lng an ton thng tin.
T ch=c cng cGn nhn th;& nhOng nhu cGu tin n>ng B hon thi2n S,< cGn Ic t ch=c nhn
i2n< 3ao gm *hEm 0i< chKnh @ch< mc tiu< 3i2n *h* /u4n l< /u& t"#nh 0 th tcq 0 cc /u&'t
@ch /u4n l thnh 0>n B cho *hQ* @o @nh 0 *hMn tKch xu hRng t"ong @u(t /u t"#nh @ot xQt
ti'* @au.
Cc A't /u4 ca 0i2c Dnh lIng n& 0 nhOng nhu cGu tim n>ng nhn th;& cho 0i2c hon thi2n @
Ic thng 3o tRi cc 3n lin /uan B cho *hQ* tEo "a cc /u&'t Dnh cGn thi't cho nhOng iBm
hon thi2n cGn thi't.
T ch=c cGn 4m 34o "ng 0i2c *h4n hi thng tin cGn Ic lin h2 thu th* tp cc 3n lin /uan t"ong
cc A't /u4 ca 0i2c Dnh lIng n& 0 nhOng nhu cGu tim n>ng nhn th;& cho nhOng hon thi2n.
T ch=c cGn hiBu "ng thng tin gb* *h4n hi l mJt thng tin Gu 0o /uan t"?ng gi)* t>ng hi2u l9c
ca Ch!ng t"#nh o lng an ton thng tin.
Z$4 T=] =! =WM! t=! =h!D ti!=
T ch=c cGn 4m 34o "ng cc 3n lin /uan nhn "a nhOng hon thi2n cGn thi't ca Ch!ng t"#nh olng an ton thng tin _xm 6.% t"ong TCVN SUSWC 6$$1:$$F`. NhOng hon thi2n nhn th;&
cGn Ic @9 ch;* thun 3i 3an /u4n l. NhOng ng thun n& cGn Ic chu&Bn thnh ti li2u 0
Ic g^i tRi cc 3n lin /uan.
T ch=c cng cGn 34o 4m "ng nhOng hon thi2n Ic ch;* thun ca Ch!ng t"#nh o lng an
ton thng tin Ic t"iBn Ahai nh mJt A' hoEch Dnh. T ch=c cb thB =ng ng cc AY thut /u4n l
9 n B thi't l* nhOng hon thi2n.
%1
7/23/2019 TCVN ISO-IEC 27004-2009
32/59
TCVN xxxx:2014
7/23/2019 TCVN ISO-IEC 27004-2009
33/59
TCVN xxxx:2014
9a t"n @9 hiBu 3i't horc cc O Ai2n< m(i /uan h2 9 tKnh giOa @(o c! 34n horc @( o ]n xu;t horc t"Eng thi ca ch)ng. Nh mh#nh *hMn tKch @ gi)* Rc lIng ha& Dnh lIng m(i /uan h2 B xcDnh thng tin cGn thi't.
T=Y!D t! ; t @ tFu =e uoft ;!=Tiu chK /u&'t Dnh Ngvng< mc tiu< horc cc m]u Ic @^ ng B xc Dnh @9 cGn
thi't *h4i hnh Jng ha& iu t"a thm< horc B m t4 m=c J chKnhxc ca A't /u4 3i o nh;t Dnh. Tiu chK /u&'t Dnh gi)* lm " ccA't /u4 ca 3i o.
)ft u bM ;WPi4i thKch chk 3o , t4 0 chk 3o< B chk 3o Ic hiBu " "ng h!n.\Dnh Eng h @! o \Dnh Eng h @! o nn Ic nh nhn 0 lu thnh ti li2u. , t4
cc tho i< nhn xQt 0 t ch=c horc ngi @ hOu thng tin cb thBcGn Ic ghi lEi. \Dnh Eng h @! o t"9c /uan @ miu t4 cc nhgi 0 cung c;* gi4i thKch " "ng 0 cc chk ]n. \Dnh Eng h @! onn Ic ts& chknh tho thng tin Ahch hng.
C bF! "F! uP!Ngi t"ch nhi2m 3i o Zan /u4n l horc cc 3n /uan tMm &u cGu horc cGn thng tin 0
hi2u l9c ca mJt h2 th(ng S,< cc 3i2n *h* /u4n l horc nhbm3i2n *h* /u4n l.Ngi xm xQt A't /u4 o C nhMn horc t ch=c m AiBm t"a tKnh hI* l2cho cc c;u t")c 3i o
ti'n hnh l iu Ai2n cho 0i2c nh gi hi2u l9c ca mJt h2th(ng S,< cc 3i2n *h* /u4n l horc nhbm 3i2n *h* /u4n l.
Ngi @ hOu thng tin C nhn horc t ch=c @ hOu thng tin 0 mJt i tIng ca 3i o0 chDu t"ch nhi2m 0 3i o.
ZJ *hn thu th* thng tin C nhMn horc t ch=c chDu t"ch nhi2m 0 thu th*< ghi chQ* 0 lut"O O li2u.
ZJ *hn t"ao i thng tin C nhMn horc t ch=c chDu t"ch nhi2m *hMn tKch O li2u 0 t"ao icc A't /u4 3i o.
T#! _ut t=] =!TGn @u;t thu th* O li2u ,=c J thng xu&n thu th* O li2u.TGn @u;t *hMn tKch O li2u ,=c J thng xu&n *hMn tKch O li2u.TGn @u;t 0 h @! o ,=c J thng xu&n ca cc A't /u4 o Ic l* h @! _m=c J
n& cb thB th;* h!n TGn @u;t thu th* O li2u`.TGn @u;t @^a i 3i o Ng& @^a i 3i o _thi hEn hi2u l9c ca tKnh hI* l2 ca 3i o horc
cc tha& i ca 3i o`TGn @u;t th9c hi2n 3i o c Dnh Dnh A th9c hi2n 3i o.
%%
7/23/2019 TCVN ISO-IEC 27004-2009
34/59
TCVN xxxx:2014
.1.1 ?h/n ! @ %Ac o tBo v 9=,=>.1.2 Co tBo v an ton th-ng tin>.1.# Tu/n thD nhEn thFc an ton th-ng tin
Z. Cc chKnh @ch rt mt Ah[u>.2.1 ht *%Ang )Et GhHu I thi6t *Ep thD c-ng>.2.2 ht *%Ang )Et GhHu I thi6t *Ep t Jng
Z.% Ti'n t"#nh @ot xQt S,Z.+ 7u4n l cc @9 c( hon thi2n S, thng xu&n
>.'.1 (iKu *c
>.'.2 Trin Ghai cc hnh Jng Ghc phMcZ.5 7u4n l cc cam A'tZ.- Z4o 02 ch(ng m JcZ.6 Zi2n *h* /u4n l t"u& nh* 0o"aZ.8 ot xQt cc logwilZ.F 7u4n l 34o t"# thng xu&nZ.1$ n ton t"ong cc tha thun 0Ri 3n th= 3a
C uo ti!= @M b! B=Bu! "\ "F! uP! _t"ong TCVN
SUSWC 6$$1:$$F ha& @( 3i2n
*h* /u4n l t"ong Lh lc `
C ?u u tRbM ;W _tham chi'u
tEi Lh lc n&`TF! ?u u tR bM ;W
+.. h` Z.+.1 di2u l9c5.. ` Z.1.1 NhMn @9 Ic o tEo 0 S,5.. ` Z.+. T"iBn Ahai cc hnh Jng Ah|c *hcZi2n *h* /u4n l .-.1.8 Z.% Ti'n t"#nh @ot xQt S,Zi2n *h* /u4n l .-.1.1 0.-.1.
Z.5 7u4n l cc cam A't
Zi2n *h* /u4n l .-..% Z.1$ Cc tha thun (i 0Ri cc 3n th= 3aZi2n *h* /u4n l .8.. 0.8..
Z.1. \o tEo 0 an ton thng tin
Zi2n *h* /u4n l .8.. 0
.8..
Z.1.% TuMn th nhn th=c an ton thng tin
Zi2n *h* /u4n l .F.1. Z.6 Zi2n *h* /u4n l t"u& nh* 0o"aZi2n *h* /u4n l .F..+ Z.F 7u4n l 34o t"# thng xu&nZi2n *h* /u4n l .1$.+.1 Z.- Z4o 02 ch(ng m JcZi2n *h* /u4n l .1$.1$.1 0.1$.1$.
Z.8 ot xQt cc logwil
Zi2n *h* /u4n l .11.%.1 Z..1Ch;t lIng mt Ah[u thi't l* thcng
Zi2n *h* /u4n l .11.%.1 Z..Ch;t lIng mt Ah[u thi't l* t9Jng
%+
7/23/2019 TCVN ISO-IEC 27004-2009
35/59
TCVN xxxx:2014
l$1 W "8!D @ ;MW t>W IS5SZ.1.1 NhMn @9 Ic o tEo 0 S,T=Y!D t! =u!D [P bM ;WTn 3i o N=d! _] ;| ;g ;MW t>W @ IS5S( hi2u Ts& tho /u& Dnh ca t ch=c.,c Kch \B thi't l* cc 3i2n *h* /u4n l tuMn th 0Ri chKnh @ch an ton
thng tin ca t ch=c.,c tiu 3i2n *h* /u4n l \o tEo< nhn th=c 0 n>ng l9c tho 5.. TCVN SUSWC
6$$1:$$F.Zi2n *h* /u4n l _1` 5.. TCVN SUSWC 6$$1:$$F. \o tEo< nhn th=c 0 n>ng
l9c.
T ch=c cGn 4m 34o "ng: m?i c nhMn Ic *hMn cng t"ch
nhi2m t"ong h2 th(ng S, cb th[m /u&n B th9c hi2n &u cGu
nhi2m 0 _tho ` lu giO h @! 0 0i2c h?c 0;n< /u t"#nh o tEong< Ainh nghi2m 0 t"#nh J chu&n mn` cGn *h4i Ic t*
hu;n< o tEo 0 an ton thng tin.Zi2n *h* /u4n l _` Ts& ch?n: 3i2n *h* /u4n l /u& t"#nh cao h!n t"ong nhbm 3ao
gm t"ong csng 3i o< n'u cb thB * ng _ cb A' hoEch horc
Ic t"iBn Ahai`` tg!D [P bM ;W @M t=uc te!=\(i tIng C! @ O li2u nhMn @9.ThuJc tKnh Z4n ghi< h @! o tEo.T=Y!D t! ; t @ _` ;W h b! j=W ?y _` ;W h b! zt 1 ;f! !{k( o c! 34n ( c nhMn Ic o tEo h2 th(ng S, tho A' hoEch o tEo hng
n>m.
( c nhMn cGn *h4i o tEo h2 th(ng S,.Lh!ng *h* o \'m @( lIng ngi Ic o tEo 0 S,.HoEi *h!ng *h* o Xhch /uan: Dnh lIng 9a t"n cc /u& t|c con @(.Thang gi t"D Zng @(.HoEi thang gi t"D Tho tz l2.\!n 0D o NhMn 0inT=Y!D t! ; t @ _` ;W ! xut( o ]n xu;t Tz l2 *hGn t">m c nhMn Ic o tEo h2 th(ng S,.dm o lng ( c nhMn Ic o tEo h2 th(ng S, ( c nhMn cGn *h4i o
tEo h2 th(ng S, 1$$.T=Y!D t! ; t @ =p bW
Chk 3o ^ ng m mu 0Ri cc 3J nhn Eng mu. \ thD Eng thanh mt4 t!ng =ng 0Ri nhiu giai oEn l* h @! lin /uan 'n cc ngvng
_< 0ng< xanh l cM&` Ic xc Dnh tEi m h#nh *hMn tKch. ( h
@! o t"ong mJt Aho4ng thi gian Ic @^ ng t"ong 3iBu o t
ch=c xc Dnh., h#nh *hMn tKch Tz l2 $-$: mu q -$F$: mu 0ngq F$1$$: mu xanh l cM&.
\(i 0Ri mu 0ng< n'u tz l2 t>ng Ahng Et 1$ m{i /u l Ahng Et
Ic< chk 3o t9 Jng chu&Bn @ang mu .T=Y!D t! ; t @ tFu =e uoft ;!=Tiu chK /u&'t Dnh ,u : cGn thi't can thi2*< *h4i ti'n hnh *hMn tKch ngu&n nhMn B
xc Dnh l o cha *hs hI* 0 hi2u @u;t AQm ca nh gi.,u 0ng: chk 3o cGn Ic tho i chrt ch B t"nh cc t"It
%5
7/23/2019 TCVN ISO-IEC 27004-2009
36/59
TCVN xxxx:2014
gi4m xu(ng mu .
,u xanh l cM&: Ahng cGn thi't *h4i hnh Jng.)ft u ;WPi4i thKch chk 3o Ts& tho t ch=c c thB.\Dnh Eng h @! o Cc ng 0Ri cc mu 3iBu thD 9a t"n cc tiu chK /u&'t Dnh.
Tbm t|t ngha ca cc @( o 0 cc hnh Jng /u4n l Ah4 thi @
cGn Ic ghi ch) A}m tho ng 3iBu thD ca thD.C bF! "F! uP!Ngi t"ch nhi2m 3i o Ngi /u4n l chDu t"ch nhi2m (i 0Ri h2 th(ng S,.Ngi @ot xQt 3i o Ngi /u4n l chDu t"ch nhi2m i 0Ri h2 th(ng S,.Ngi @ hOu thng tin Ngi /u4n l o tEo Zan nhMn @9.ZJ *hn thu th* thng tin Zan o tEo *hng nhMn @9.ZJ *hn t"ao i thng tin Ngi /u4n l chDu t"ch nhi2m i 0Ri h2 th(ng S,.T#! _ut t=] =!TGn @u;t thu th* O li2u dng thng _0o ng& lm 0i2c Gu tin ca thng .TGn @u;t *hMn tKch O li2u dng /u.TGn @u;t l* 3o co cc
A't /u4 o
dng /u.
TGn @u;t @^a i 3i o ot xQt @^a i hng n>m.TGn @u;t th9c hi2n 3i o dng n>m.
Z.1. \o tEo 0 an ton thng tinT=Y!D t! =u!D [P bM ;WTn 3i o MW t>W @ P! tWM! t=Y!D t!( hi2u Ts& tho t ch=c.,c Kch \B Dnh lIng *hs hI* 0Ri &u cGu o tEo 0 nhn th=c an ton
thng tin hng n>m.,c tiu 3i2n *h* /u4n l Zin *h* /u4n l tho .8. T"ong thi gian lm 0i2c.
\4m 34o "ng m?i c nhMn ca t ch=c< ngi ca nh thGu 0 3n
th= 3a nhn th=c Ic cc m(i ngu& c! 0 cc 0;n lin /uan tRi
an ton thng tin< t"ch nhi2m 0 ngha 0 *h* l ca h?< 0 Ic
t"ang 3D cc Ai'n th=c< iu Ai2n cGn thi't nhm h{ t"I chKnh @ch an
ton thng tin ca t ch=c t"ong /u t"#nh lm 0i2c< 0 gi4m thiBu cc
"i "o o con ngi gM& "a.Zi2n *h* /u4n l _1` Zi2n *h* /u4n l tho .8.. TCVN SUSWC 6$$1:$$F. Nhn
th=c< gio c 0 o tEo 0 an ton thng tin.
T;t c4 cc c nhMn t"ong t ch=c< ngi ca nh thGu 0 3n th= 3a
cGn *h4i Ic o tEo nhn th=c 0 c* nht thng xu&n nhOngth tc< chKnh @ch 4m 34o an ton thng tin ca t ch=c nh mJt
*hGn cng 0i2c 3|t 3uJc.Zi2n *h* /u4n l _`` tg!D [P bM ;W @M t=uc te!=\(i tIng C! @ O li2u nhMn @9.ThuJc tKnh Cc gi;& t t"ong h @! o tEo.T=Y!D t! ; t @ _` ;W h b!( o c! 34n ( c nhMn Ic o tEo nMng cao nhn th=c an ton thng tin tho
A' hoEch o tEo hng n>m.
( c nhMn cGn o tEo nMng cao nhn th=c an ton thng tin.Lh!ng *h* o \'m @( lIng ngi xc nhn l Ic o tEoj nMng cao nhn
th=c an ton thng tin.
%-
7/23/2019 TCVN ISO-IEC 27004-2009
37/59
TCVN xxxx:2014
HoEi *h!ng *h* o Lh!ng *h* Ahch /uanThang gi t"D ( lIngHoEi thang gi t"D Tho tz l2.\!n 0D o C nhMn.T=Y!D t! ; t @ _` ;W ! xut( o ]n xu;t Tz l2 *hGn t">m c nhMn Ic o tEo nMng cao nhn th=c an ton
thng tin hng n>m.dm o lng ( c nhMn Ic o tEo nMng cao nhn th=c an ton thng tin (
c nhMn cGn *h4i o tEo nMng cao nhn th=c an ton thng tin 1$$.T=Y!D t! ; t @ =p bWChk 3o \ng 3iBu m t4 t!ng =ng 0Ri @( chu A l* h @! o lin /uan
'n cc ngvng _< 0ng< xanh l cM&` Ic xc Dnh tEi m h#nh
*hMn tKch. ( h @! o t"ong mJt Aho4ng thi gian Ic @^ ng
t"ong 3iBu ts& o t ch=c xc Dnh, h#nh *hMn tKch Tz l2 $-$: mu q -$F$: mu 0ngq F$1$$: mu xanh l cM&.
\(i 0Ri mu 0ng< n'u tz l2 t>ng Ahng Et 1$ m{i /u< chk 3o t9
Jng chu&Bn @ang mu .T=Y!D t! ; t @ tFu =e uoft ;!=Tiu chK /u&'t Dnh ,u : cGn thi't can thi2*< *h4i ti'n hnh *hMn tKch ngu&n nhMn B
xc Dnh l o cha *hs hI* 0 hi2u @u;t AQm ca nh gi.
,u 0ng: chk 3o cGn Ic tho i chrt ch B t"nh cc t"It gi4m
xu(ng mu .
,u xanh l cM&: Ahng cGn thi't *h4i hnh Jng.)ft u ;WPi4i thKch chk 3o Ts& tho t ch=c.\Dnh Eng h @! o Cc ng 0Ri cc mu 3iBu thD 9a t"n cc tiu chK /u&'t Dnh. Tbm
t|t ngha ca cc @( o 0 cc hnh Jng /u4n l Ah4 thi @ cGnIc ghi ch) A}m tho ng 3iBu thD ca thD.
C bF! "F! uP!Ngi t"ch nhi2m 3i o Ngi /u4n l chDu t"ch nhi2m i 0Ri h2 th(ng S,< /u4n l an
ton< /u4n l o tEo.Ngi @ot xQt 3i o Ngi /u4n l an ton thng tin.Ngi @ hOu thng tin Cn 3J an ton thng tin 0 ngi /u4n l o tEo.ZJ *hn thu th* thng tin Zan /u4n l o tEo *hng nhMn @9.ZJ *hn t"ao i thng tin Ngi /u4n l chDu t"ch nhi2m i 0Ri h2 th(ng S,.T#! _ut t=] =!TGn @u;t thu th* O li2u dng thng _0o ng& lm 0i2c Gu tin ca thng .
TGn @u;t *hMn tKch O li2u dng /u.TGn @u;t l* 3o co cc
A't /u4 o
dng /u.
TGn @u;t @^a i 3i o ot xQt @^a i hng n>m.TGn @u;t th9c hi2n 3i o dng n>m.
Z.1.% TuMn th nhn th=c an ton thng tinT=Y!D t! =u!D [P bM ;WTn 3i o Tud! t=[ !=K! t=w P! tWM! t=Y!D t!$( hi2u Ts& tho /u& Dnh ca t ch=c.
,c Kch \nh gi t#nh t"Eng tuMn th chKnh @chnhn th=c an ton thng tingiOa nhOng c nhMn cb lin /uan.
,c tiu 3i2n *h* /u4n l Ti'n t"#nh .8. TCVN SUSWC 6$$1:$$F T"ong thi gian lm 0i2c.
%6
7/23/2019 TCVN ISO-IEC 27004-2009
38/59
TCVN xxxx:2014
\4m 34o "ng m?i c nhMn ca t ch=c< ngi ca nh thGu 0 3nth= 3a nhn th=c Ic cc m(i ngu& c! 0 cc 0;n lin /uan tRian ton thng tin< t"ch nhi2m 0 ngha 0 *h* l ca h?< 0 Ict"ang 3D cc Ai'n th=c< iu Ai2n cGn thi't nhm h{ t"I chKnh @ch anton thng tin ca t ch=c t"ong /u t"#nh lm 0i2c< 0 gi4m thiBu cc"i "o o con ngi gM& "a.
Zi2n *h* /u4n l _1` Ti'n t"#nh .8.. TCVN SUSWC 6$$1:$$F. Nhn th=c< gio c0 o tEo 0 an ton thng tin.T;t c4 cc c nhMn t"ong t ch=c< ngi ca nh thGu 0 3n th= 3acGn *h4i Ic o tEo nhn th=c 0 c* nht thng xu&n nhOngth tc< chKnh @ch 4m 34o an ton thng tin ca t ch=c nh mJt*hGn cng 0i2c 3|t 3uJc._Th9c hi2n` T;t c4 cc c nhMn cb lin /uan (i 0Ri h2 th(ng S,*h4i Ic o tEo nhn th=c an ton thng tin t"Rc Ahi Ic c;*/u&n t"u& c* h2 th(ng thng tin.
Zi2n *h* /u4n l _` Ti'n t"#nh .8..1 SUSWC 6$$1:$$5. T"ch nhi2m 3an /u4n l.Zan /u4n l cGn *h4i &u cGu cc c nhMn< ngi ca nh thGu 0 3nth= 3a ch;* hnh an ton thng tin *hs hI* 0Ri cc th tc 0 cc
chKnh @ch an ton thng tin Ic thi't l* ca t ch=c._T"iBn Ahai`T;t c4 cc c nhMn cb lin /uan 'n S, *h4i A tha thun ngisng _cam A't`t"Rc Ahi Ic c;* /u&n t"u& c* h2 th(ng thng tin.
` tg!D [P bM ;W @M t=uc te!=\(i tIng 1.1. X' hoEch horc lDch t"#nh o tEo nhn th=c an ton thng tin ca
t ch=c.1.. Cc c nhMn hon thnh horc ang t"ong /u t"#nh o tEo..1. X' hoEch lDch t"#nh A A't tha thun ngi sng... Cc c nhMn A A't tha thun.
ThuJc tKnh 1.1. Cc c nhMn Ic xc Dnh t"ong 34n A' hoEch o tEo.1.. T"Eng thi ca c nhMn lin /uan 'n /u t"#nh o tEo.
.1. Cc c nhMn Ic xc Dnh t"ong A' hoEch A A't tha thun... T"Eng thi ca c nhMn lin /uan 'n 0i2c A A't tha thun.
T=Y!D t! ; t @ _` ;W h b!( o c! 34n 1.1. ( lIng c nhMn Ic ln A' hoEch o tEo'n thi iBm hi2n
tEi.1.. ( lIng c nhMn A xc nhn Ic o tEoj..1. ( lIng c nhMn Ic ln A' hoEch A cam A't _xc Dnh A A't
tha thun 'n na&.`.. ( lIng c nhMn A cam A't.
Lh!ng *h* o 1.1. \'m @( c nhMn tho lDch t"#nh A A't 0 hon thnh cc otEo cho 'n na&.1.. u cGu ngi cb t"ch nhi2m cung c;* tz l2 *hGn t">m canhOng ngi *h4i Ic o tEo 0 cam A't _t"n tng @( nhMn0in`..1. \'m @( nhMn 0in A tho4 thun cho 'n hm na&... \'m @( lIng c nhMn cb tha thun ngi sng A.
HoEi *h!ng *h* o 1.1. Xhch /uan1.. Ch /uan.1. Xhch /uan.. Xhch /uan.
Thang gi t"D 1.1. ( ngu&n tp $ 'n 0 csng1.. ( ngu&n tp $ 'n 1$$.1. ( ngu&n tp $ 'n 0 csng
.. ( ngu&n tp $ 'n 0 csngHoEi thang gi t"D 1.1. Tho th= t91.. Tho tz l2.1. Tho th= t9
%8
7/23/2019 TCVN ISO-IEC 27004-2009
39/59
TCVN xxxx:2014
.. Tho th= t9\!n 0D o 1.1. ( lIng c nhMn
1.. Tz l2 *hGn t">m.1. ( lIng c nhMn.. ( lIng c nhMn
T=Y!D t! ; t @ _` ;W ! xut( o ]n xu;t 1. Ti'n t"#nh tRi na& _.1:Tng @( nhMn @9 A 0 @( nhMn @9 cb
A' hoEch A`.. Ti'n t"#nh tRi na& 0Ri 0i2c A A't tha thun _ ha& 1Z11$$:Tng @( nhMn @9 A tho4 thun tRi hm na&`.
dm o lng 1. Z @ung cc t#nh t"Eng cho t;t c4 cc nhMn @9 A tha thun< 9Ai'n @ Ic hon thnh 'n na&.
. ( lIng c nhMn A A't tha thun ngi sng 'n na&j chiacho ( lIng c nhMn Ic xc Dnh A A't tha thun 'n na&j.
T=Y!D t! ; t @ =p bWChk 3o a` Cc t#nh t"Eng thB hi2n nh l mJt @9 A't hI* ca cc tz l2 0q
3` u hRng ca ng 3iBu thD _t>ng horc gi4m`., h#nh *hMn tKch a` Tng @( nhMn @9 A 0 cb A' hoEch ca Ti'n t"#nh 'n na&
_.1` _( nhMn @9 cb A' hoEch A cho 'n hm na& _Z.1`` 1$$ 0 Ti'n t"#nh tRi hm na& csng 0Ri ng& A _.`.3` o @nh t#nh t"Eng hi2n tEi 0 t#nh t"Eng t"Rc b.
T=Y!D t! ; t @ tFu =e uoft ;!=Tiu chK /u&'t Dnh a) Cc tz l2 A't /u4 @o @nh nn gi4m _tho J (c ca ng 3iBu
thD` t!ng =ng giOa $ng horc tKch c9c cGn Ic tho i B *ng.
\Dnh Eng h @! o ThB hi2n 3ng AiBu chO chu[n: tiu chK tha mn. ThB hi2n 3ng AiBu chO nghing: tiu chK cha tha mn. ThB hi2n 3ng AiBu chO m: tiu chK cha Et.
C bF! "F! uP!Ngi t"ch nhi2m 3i o Ngi /u4n l chDu t"ch nhi2m (i 0Ri h2 th(ng S,. Ngi /u4n l
an ton thng tin. Ngi /u4n l o tEo.
Ngi @ot xQt 3i o Ngi /u4n l an ton thng tin.Ngi @ hOu thng tin Cn 3J an ton thng tin 0 ngi /u4n l o tEo.ZJ *hn thu th* thng tin Zan o tEo *hng nhMn @9.
%F
7/23/2019 TCVN ISO-IEC 27004-2009
40/59
TCVN xxxx:2014
ZJ *hn t"ao i thng tin Ngi /u4n l chDu t"ch nhi2m i 0Ri h2 th(ng S,.T#! _ut t! a=PTGn @u;t thu th* O li2u dng thng _0o ng& lm 0i2c Gu tin ca thng .TGn @u;t *hMn tKch O li2u dng /u.TGn @u;t l* 3o co ccA't /u4 o
dng /u.
TGn @u;t @^a i 3i o ot xQt @^a i hng n>m.TGn @u;t t"iBn Ahai 3i o dng n>m.
l$2 W "8!D =e!= _= ;t ?Kt a=uZ..1 Ch;t lIng mt Ah[u AiBu thi't l* th cngT=Y!D t! =u!D [P bM ;WTn 3i o W "8!D C=t "g!D ?Kt a=u au t=ft "KB t=[ Y!D( hi2u Ts& tho t ch=c.,c Kch \ "a m=c J an ton< J mEnh mt Ah[u Ahi ngi @^ ng thi't l*
mt Ah[u t"u& c* h2 th(ng thng tin ca t ch=c.
,c tiu 3i2n *h* /u4n l \B hEn ch' ngi @^ ng l9a ch?n mt Ah[u Ahng an ton.Zi2n *h* /u4n l _1` Ti'n t"#nh .11.%.1 TCVN SUSWC 6$$1:$$F. ^ ng mt Ah[u.
Ngi @^ ng *h4i Ic &u cGu tuMn th /u& t|c th9c hnh an tont(t t"ong 0i2c l9a ch?n 0 @^ ng mt Ah[u.T! a=P:T;t c4 ngi @^ ng *h4i l9a ch?n mt Ah[u 0Ri J mEnh t(i thiBunh @au:
\J i lRn h!n 8 A t9q Xhng 9a t"n th= g# ng on 3i't horc cb @^ ng
thng tin 0 ngi lin /uan< 0K : tn< @( i2n thoEi< ng&thng n>m @inhq
Xhng 3ao gm cc tp cb t"ong tp iBnq ,t Ah[u Ahng 3ao gm cc A t9 lin ti'* gi(ng h2t nhaum.
TGn @u;t @^a i 3i o ot xQt @^a i hng n>m.TGn @u;t t"iBn Ahai 3i o dng n>m.
Z.. Ch;t lIng mt Ah[u AiBu thi't l* t9 JngT=Y!D t! =u!D [P bM ;WTn 3i o W "8!D C=t "g!D ?Kt a=u au t=ft "KB t] ;c!D( hi2u Ts& tho t ch=c.,c Kch \ "a m=c J an ton< J mEnh mt Ah[u Ahi ngi @^ ng thi't l*
mt Ah[u t"u& c* h2 th(ng thng tin ca t ch=c.,c tiu 3i2n *h* /u4n l \B hEn ch' ngi @^ ng l9a ch?n mt Ah[u Ahng an ton.Zi2n *h* /u4n l _1` Ti'n t"#nh .11.%.1 TCVN SUSWC 6$$1:$$F. ^ ng mt Ah[u.
Ngi @^ ng *h4i Ic &u cGu tuMn th /u& t|c th9c hnh an tont(t t"ong 0i2c l9a ch?n 0 @^ ng mt Ah[u.T"iBn Ahai:
T;t c4 ngi @^ ng *h4i l9a ch?n mt Ah[u 0Ri J mEnh t(i thiBunh @au: \J i lRn h!n 8 A t9q Xhng 9a t"n th= g# ng on 3i't horc cb @^ ng thng tin0 ngi lin /uan< 0K : tn< @( i2n thoEi< ng& thng n>m @inhq Xhng 3ao gm cc tp cb t"ong tp iBnq ,t Ah[u Ahng 3ao gm cc A t9 lin ti'* gi(ng h2t nhau< cc At9 u l @( horc cc A t9 u l chO ciqT;t c4 cc ti Aho4n ngi @^ ng 0 mt Ah[u ca h2 th(ng thngtin t"ong t ch=c *h4i Ic AiBm @ot 3i nhMn 0in /u4n t"D h2 th(nghorc nhMn 0in h2 th(ng.
Zi2n *h* /u4n l _`
` tg!D [P bM ;W @M t=uc te!=\(i tIng C! @ O li2u nhMn @9.ThuJc tKnh Z4n ghi< h @! o tEo.T=Y!D t! ; t @ _` ;W h b!( o c! 34n 1. Tng @( lIng cc mt Ah[u ngi @^ ng.
. Tng @( lIng mt Ah[u ngi @^ ng Ahng thB 3 Ahba.Lh!ng *h* o 1. ChE& cMu l2nh t"u& 0;n cc 34n ghi 0 thng tin ti Aho4n ngi @^
ng.. ChE& ch!ng t"#nh cMu l2nh 3 Ahba (i 0Ri cc 34n ghi 0 thngtin ti Aho4n ngi @^ ng 3ng *h!ng *h* 3 Ahba h{n hI*.
HoEi *h!ng *h* o 1. Xhch /uan.. Xhch /uan.Thang gi t"D 1. ( ngu&n tp $ 'n 0 csng.
. ( ngu&n tp $ 'n 0 csng.HoEi thang gi t"D 1. Tho th= t9.
. Tho th= t9.\!n 0D o 1. ,t Ah[u.
. ,t Ah[u.T=Y!D t! ; t @ _` ;W ! xut( o ]n xu;t Xhng cb.dm o lng Xhng cb.T=Y!D t! ; t @ =p bWChk 3o 1. Tz l2 mt Ah[u cb thB 3 Ahba t"ong + gi.
. u hRng ca 1. Tz l2 mt Ah[u cb thB 3 Ahba t"ong + gi., h#nh *hMn tKch 1. H *hMn @( ca ( lIng mt Ah[u cb thB 3 Ahba Tng @(
+
7/23/2019 TCVN ISO-IEC 27004-2009
43/59
TCVN xxxx:2014
lIng mt Ah[u.. o @nh tz l2 n& 0Ri cc tz l2 t"Rc.
T=Y!D t! ; t @ tFu =e uoft ;!=Tiu chK /u&'t Dnh
,c tiu /u4n l ch;t lIng mt Ah[u Et Ic 0 Ahng cGn cbhnh Jng cGn thi't n'u A't /u4 tz l2 l t"n $m.
l$J W "8!D tf! ti!= _Wt xst IS5S
T=Y!D t! =u!D [P bM ;WTn 3i o W "8!D tf! ti!= _Wt xst IS5S( hi2u Ts& tho t ch=c.
+%
7/23/2019 TCVN ISO-IEC 27004-2009
44/59
TCVN xxxx:2014
,c Kch \B nh gi m=c J hon thnh ca 0i2c @ot xQt Jc l* h2 th(ngS,.
,c tiu 3i2n *h* /u4n l \B /u4n l an ton thng tin t"ong t ch=c.Zi2n *h* /u4n l _1` .-.1.8 TCVN SUSWC 6$$1:$$F. T9 @ot xQt 0 an ton thng tin.
Cch ti'* cn /u4n l an ton thng tin ca t ch=c 0 0i2c t"iBn Ahaica t ch=c _chng hEn nh: cc mc tiu 0 cc 3i2n *h* /u4n lm chk 3o 0]n cha tha mn< cGn thi't *h4i thng3o 0 &u cGu h{ t"I tp ngi /u4n l c;* cao.nh hngtc Jng ca tiu chK n& l Ahng * =ng Ic @ lmgi4m hi2u /u4 ca /u t"#nh @ot xQt /u4n l.Ngu&n nhMn tim tng 3ao gm ngMn @ch th;*< t"iBn Ahai Ahng)ng A' hoEch< thi'u ht nhMn l9c cam A't /u4n l.
\Dnh Eng h @! o \ng 3iBu thD m t4 t"ong h @! o tng thB *hs hI* 0Ri ccngvng tEi mc tiu chK /u&'t Dnh.
C bF! "F! uP!Ngi t"ch nhi2m 3i o Ngi /u4n l chDu t"ch nhi2m (i 0Ri h2 th(ng S,. Ngi /u4n l
ch;t lIng h2 th(ng.Ngi @ot xQt 3i o Ngi /u4n l an ton thng tin.Ngi @ hOu thng tin Ngi /u4n l an ton thng tin.ZJ *hn thu th* thng tin XiBm t"a 0in nJi 3J. T"ng /u4n l ch;t lIng.ZJ *hn t"ao i thng tin XiBm t"a 0in nJi 3J. Cc t"ng /u4n l ch;t lIng chDu t"ch nhi2m
(i 0Ri h2 th(ng S,.T#! _ut t! a=PTGn @u;t thu th* O li2u dng /u.
TGn @u;t *hMn tKch O li2u dng /u.TGn @u;t l* 3o co ccA't /u4 o
dng /u.
TGn @u;t @^a i 3i o ot xQt 0 chknh @^a< c* nht n>mlGn.TGn @u;t t"iBn Ahai 3i o * ng t"ong n>m.
l$4 W "8!D @ =WM! t=! IS5S t=8!D xuoF!Z.+.1 di2u l9c ca /u4n l @9 c( an ton thng tinT=Y!D t! =u!D [P bM ;WTn 3i o Hu "] [P u! "\ _] ` P! tWM! t=Y!D t!
( hi2u Ts& tho t ch=c.,c Kch \nh gi hi2u l9c ca /u4n l @9 c( an ton thng tin.,c tiu 3i2n *h* /u4n l Cb Ah4 n>ng nhanh chbng *ht hi2n cc @9 Ai2n an ton thng tin 0
*h4n =ng 0Ri cc @9 c( an ton thng tin.Zi2n *h* /u4n l _1` +.. h` TCVN SUSWC 6$$1:$$F
T"iBn Ahai cc th tc 0 cc 3i2n *h* /u4n l Ahc cb Ah4 n>ngnhanh chbng *ht hi2n cc @9 Ai2n an ton thng tin 0 *h4n =ng 0Ricc @9 c( an ton thng tin.
Zi2n *h* /u4n l _`` tg!D [P ;W "8!D @M t=uc te!=\(i tIng d2 th(ng S,.ThuJc tKnh Tpng @9 c( "ing l.
T=Y!D t! ; t @ _` ;W h b!( o c! 34n ( lGn x4& "a @9 c( cb thB ch;* nhn Ic ca t ch=c.Lh!ng *h* o \'m cc @9 c( 0 an ton thng tin Ic ghi nhn 0 3o co cho
'n ng& o.HoEi *h!ng *h* o Xhch /uanThang gi t"D ( lIngHoEi thang gi t"D Tho th= t9\!n 0D o 9 c(T=Y!D t! ; t @ _` ;W ! xut( o ]n xu;t ( @9 c( 0It /u ngvng.dm o lng o @nh tng @( lIng cc @9 c( 0Ri ngvng @9 c( rt "a.
T=Y!D t! ; t @ =p bWChk 3o ZiBu ng 3ao gm ng ngang Ahng i thB hi2n ngvng @9c( 0 ng thB hi2n tng @( cc @9 c( tho cc h @! o.
, h#nh *hMn tKch ,u : tng @( cc @9 c( 0It /u ngvng _i *hKa t"n`q
+5
7/23/2019 TCVN ISO-IEC 27004-2009
46/59
TCVN xxxx:2014
,u 0ng: tng @( cc @9 c( nh h!n ngvng t"ong Aho4ng 1$.,u xanh l cM&: tng @( cc @9 c( nh h!n ngvng 1$ horc h!n.
T=Y!D t! ; t @ tFu =e uoft ;!=Tiu chK /u&'t Dnh ,u : &u cGu iu t"a ngu&n nhMn t>ng @( lIng cc @9 c( nga&
l* t=c.,u 0ng: @( lIng @9 c( cGn Ic gim @t< tho i chrt ch< n'u
Ahng cb c4i thi2n cGn thi't *h4i iu t"a ngu&n nhMn.,u xanh l cM&: Ahng cGn thi't *h4i hnh Jng.
)ft u bM ;WPi4i thKch chk 3o N'u mu xu;t hi2n t"ong chu A# h @! o< cGn thi't *h4i @ot xQt
cc 3i2n *h* /u4n l @9 c( an ton thng tin B iu chknh< 3 @ungcc 3i2n *h* *hs hI*.N'u xu hRng n& Ahng 4o ngIc t"ong hai giai oEn h @! o ti'*tho< cGn thi't *h4i cb hnh Jng Ah|c *hc< chng hEn nh nghDm "Jng *hEm 0i /u4n l an ton thng tin.
\Dnh Eng h @! o ZiBu Eng ng A.C bF! "F! uP!Ngi t"ch nhi2m 3i o Zan /u4n l h2 th(ng S,.
Ngi /u4n l chDu t"ch nhi2m (i 0Ri h2 th(ng S,.Zan /u4n l an ton thng tin.Zan /u4n l @9 c( an ton thng tin.
Ngi @ot xQt 3i o Ngi /u4n l chDu t"ch nhi2m (i 0Ri h2 th(ng S,.Ngi @ hOu thng tin Ngi /u4n l chDu t"ch nhi2m (i 0Ri h2 th(ng S,.ZJ *hn thu th* thng tin Ngi /u4n l @9 c( an ton thng tin.ZJ *hn t"ao i thng tin Zan /u4n l h2 th(ng S,.T#! _ut t! a=PTGn @u;t thu th* O li2u dng thng.TGn @u;t *hMn tKch O li2u dng thng.TGn @u;t l* 3o co ccA't /u4 o
dng thng.
TGn @u;t @^a i 3i o - thng.TGn @u;t t"iBn Ahai 3i o dng thng.
+-
7/23/2019 TCVN ISO-IEC 27004-2009
47/59
TCVN xxxx:2014
Z.+. T"iBn Ahai cc hnh Jng Ah|c *hcT=Y!D t! =u!D [P bM ;WTn 3i o T! a=P =M!= ;c!D a=} B=6( hi2u Ts& tho t ch=c.,c Kch \nh gi Ah4 n>ng th9c hi2n ca 0i2c t"iBn Ahai hnh Jng Ah|c *hc.,c tiu 3i2n *h* /u4n l 8. TCVN SUSWC 6$$1:$$F dnh Jng Ah|c *hc
T ch=c *h4i th9c hi2n hnh Jng loEi 3 cc ngu&n nhMn ca cc 0i*hEm (i 0Ri &u cGu ca h2 th(ng S, B 34o 02 Ah4 n>ng ti in.
Zi2n *h* /u4n l _1` Th tc Ic l* thnh ti li2u cho hnh Jng Ah|c *hc @ Icxc Dnh tho cc &u cGu @au:a` c Dnh cc 0i *hEmq3` T#m "a ngu&n nhMn ca cc 0i *hEm t"nqc` \nh gi @9 cGn thi't ca cc hnh Jng ng>n chrn cc 0i *hEm
n& xu;t hi2n t" lEiq` 7u&'t Dnh 0 t"iBn Ahai cc hnh Jng Ah|c *hc cGn thi'tq` H* h @! A't /u4 th9c hi2n cc hnh Jng t"nqf) ot xQt lEi cc hnh Jng Ah|c *hc t"iBn Ahai.
T ch=c xc Dnh cc hnh Jng Ah|c *hc &u cGu< 0 *ht hnh
ti li2u h @! 0 hnh Jng Ah|c *hc nhOng thng tin cha *hs hI*
7/23/2019 TCVN ISO-IEC 27004-2009
48/59
TCVN xxxx:2014
3` dnh Jng Ah|c *hc cha Ic t"iBn Ahai m Ahng cb l o hI*l.
dm o lng a` ( hnh Jng Ah|c *hc Ic ln A' hoEch tRi na& t"p (hnh Jng Ah|c *hc th9c hi2n tho A' hoEch tRi na&.
3` ( hnh Jng Ah|c *hc Ahng Ic t"iBn Ahai tho A' hoEch cbl o t"p ( hnh Jng Ah|c *hc Ahng Ic t"iBn Ahai.
T=Y!D t! ; t @ =p bWChk 3o a` T#nh t"Eng thB hi2n nh mJt tz l2 ca hnh Jng Ah|c *hc Ahng
Ic t"iBn Ahai.3` T#nh t"Eng thB hi2n nh mJt tz l2 ca hnh Jng Ah|c *hc Ahng
Ic t"iBn Ahai m Ahng cb l o.c` u hRng cc t"Eng thi.
, h#nh *hMn tKch a` ( hnh Jng Ah|c *hc Ahng Ic t"iBn Ahai 'n na& (hnh Jng Ah|c *hc Ic ln A' hoEch 'n na&.
3` ( hnh Jng Ah|c *hc Ahng Ic t"iBn Ahai 0 Ahng cb lo ( hnh Jng Ah|c *hc Ic ln A' hoEch 'n na&.
c` o @nh t#nh t"Eng 0Ri cc t#nh t"Eng nh gi t"Rc.T=Y!D t! ; t @ tFu =e uoft ;!=
Tiu chK /u&'t Dnh
\B A't lun Et Ic cc mc tiu 0 Ahng cGn hnh Jng< tz l2 cachk 3o a` 0 3` cGn gi4m t!ng =ng giOa $m Ahng t"iBn Ahai 0 l o Ahng t"iBn Ahaim.
l$ CP? aft [P bP! u! "\T=Y!D t! =u!D [P bM ;WTn 3i o T#! _ut _Wt xst [P bP! u! "\( hi2u Ts& tho t ch=c.,c Kch \nh gi cam A't ca 3an /u4n l 0 cc hnh Jng @ot xQt an ton
thng tin tho cc hnh Jng @ot xQt ca 3an /u4n l,c tiu 3i2n *h* /u4n l .-.1 TCVN SUSWC 6$$1:$$F. Nhm /u4n l an ton thng tin
t"ong t ch=c _tho A' hoEch`.
Nhm /u4n l an ton thng tin t"ong t ch=c thng /ua cc @ot xQtca 3an /u4n l th9c hi2n xu&n t"iBn.
Zi2n *h* /u4n l _1` .-.1.1 TCVN SUSWC 6$$1:$$F. Cam A't ca 3an /u4n l 0 34o4m an ton thng tin.Zan /u4n l *h4i ch Jng h{ t"I 34o 4m an ton thng tin t"ong tch=c 3ng cc Dnh hRng " "ng< cc cam A't cb thB th;& Ic< ccnhi2m 0 " "ng 0 nhn th=c " t"ch nhi2m 0 34o 4m an tonthng tin.
T"iBn Ahai:T ch=c *h4i cb cc cuJc h?* hng thng 0 @ot xQt ca 3an /u4n lB h{ t"I an ton thng tin t"ong t ch=c 3ng cc Dnh hRng ""ng< cc cam A't cb thB th;& Ic< cc nhi2m 0 " "ng 0 nhnth=c " t"ch nhi2m 0 34o 4m an ton thng tin.ot xQt ca 3an /u4n l S, cGn A't hI* 0Ri @ot xQt ca 3an /u4nl h2 th(ng /u4n l ch;t lIng 7, _7ualit& ,anagmnt &@tm`.
Zi2n *h* /u4n l _` Ti'n t"#nh .-.1. TCVN SUSWC 6$$1:$$F. Lh(i hI* 34o 4m anton thng tin.Cc hoEt Jng 34o 4m an ton thng tin cGn *h4i Ic *h(i hI* 3icc Ei i2n ca cc 3an t"ong t ch=c 0Ri 0ai t" 0 nhi2m 0 c thB.
T"iBn Ahai:NhOng ngi n|m giO 0ai t" 0 t"ch nhi2m cb lin /uan thuJc cc
*hng 3an ch=c n>ng cGn *h(i hI* 0 tham gia @ot xQt ca 3an/u4n l.` tg!D [P ;W "8!D @M t=uc te!=\(i tIng 1. X' hoEch lDch 3iBu @ot xQt ca 3an /u4n lan ton thng tin.
. Cc 3in 34n cuJc h?* @ot xQt ca 3an /u4n l.ThuJc tKnh 1.1. Ng& ca cc cuJc h?* @ot xQt ca 3an /u4n l Ic ln A'
hoEch.1.. 9 cb mrt ca 3an /u4n l tham 9 cc 3ui h?* @ot xQt Icln A' hoEch..1. NhOng ng& h?* @ot xQt ca 3an /u4n l Ic ghi lEi... 9 cb mrt ca 3an /u4n l Ic ghi lEi tham gia cc cuJc h?*@ot xQt.
T=Y!D t! ; t @ _` ;W h b!( o c! 34n 1.1. ( lIng cc cuJc h?* @ot xQt ca 3an /u4n lIc ln A'
hoEch cho 'n na&.
+F
7/23/2019 TCVN ISO-IEC 27004-2009
50/59
TCVN xxxx:2014
1.. ( lIng ngi /u4n l< n|m giO 0ai t" 0 t"ch nhi2m cb lin/uan Ic rt lDch B tham gia cc cuJc h?* @ot xQt ca 3an/u4n l.
.1.1. ( lIng cc cuJc h?* @ot xQt ca 3an /u4n l t ch=ctho A' hoEch cho 'n na&.
.1.. ( lIng cc cuJc h?* @ot xQt ca 3an /u4n l t ch=c Jtxu;t horc Ahng tho A' hoEch cho 'n na&.
.1.%. ( lIng cc cuJc h?* @ot xQt ca 3an /u4n l Ic rt lDchlEi 0 t ch=c cho 'n na&.
..( lIng ngi /u4n l< n|m giO 0ai t" 0 t"ch nhi2m cb lin/uan tham 9 cc cuJc h?* @ot xQt ca 3an /u4n l cho 'nna&.
Lh!ng *h* o 1.1. \'m @( lIng cc cuJc h?* @ot xQt ca 3an /u4n l Ic rtlDch cho 'n na&.
1.. VRi m{i cuJc h?* @ot xQt ca 3an /u4n l< 'm @( lIng ngi/u4n l< n|m giO 0ai t" 0 t"ch nhi2m cb lin /uan tham 9q 0thm mJt 34n ghi mRi 0Ri gi t"D mrc Dnh 0 @( lIng ngitham 9 nh cho cc cuJc h?* Jt xu;t< Ahng cb A' hoEch Dnh
t"Rc..1.1. \'m @( lIng cc cuJc h?* @ot xQt ca 3an /u4n l tch=c tho A' hoEch cho 'n na&.
.1.. \'m @( lIng cc cuJc h?* @ot xQt ca 3an /u4n l tch=c Jt xu;t horc Ahng tho A' hoEch cho 'n na&.
.1.%. \'m @( lIng cc cuJc h?* @ot xQt ca 3an /u4n l Ic rtlDch lEi 0 t ch=c cho 'n na&.
.. \(i 0Ri t;t c4 cc cuJc h?* @ot xQt ca 3an /u4n l Ic tch=c< 'm @( lIng lnh Eo ca t ch=c tham 9.
HoEi *h!ng *h* o 1.1. Xhch /uan.1.. Xhch /uan 0 ch /uan..1.1. Xhch /uan.
.1.. Xhch /uan..1.%. Xhch /uan... Xhch /uan.
Thang gi t"D 1.1. ( ngu&n tp $ 'n 0 csng.1.. ( ngu&n tp $ 'n 0 csng..1.1.( ngu&n tp $ 'n 0 csng..1.. ( ngu&n tp $ 'n 0 csng..1.%. ( ngu&n tp $ 'n 0 csng... ( ngu&n tp $ 'n 0 csng.
HoEi thang gi t"D 1.1. Tho th= t9.1.. Tho th= t9..1.1.Tho th= t9.
.1.. Tho th= t9..1.%. Tho th= t9... Tho th= t9.
\!n 0D o 1.1. CuJc h?*.1.. ( lIng ngi..1.1.CuJc h?*..1.. CuJc h?*..1.%. CuJc h?*... ( lIng ngi.
T=Y!D t! ; t @ _` ;W ! xut( o ]n xu;t a` ( lIng cc cuJc h?* @ot xQt ca 3an /u4n l t ch=c cho
'n na&.3` Tz l2 cc lGn lnh Eo tham gia cc cuJc h?* cho 'n na&.dm o lng a` H tng ca ( lIng cc cuJc h?* @ot xQt ca 3an /u4n l Ic
ln A' hoEch cho 'n na& 0 ( lIng cc cuJc h?* @ot xQt ca
5$
7/23/2019 TCVN ISO-IEC 27004-2009
51/59
TCVN xxxx:2014
3an /u4n l Jt xu;t horc Ahng tho A' hoEch cho 'n na& 0 (lIng cc cuJc h?* @ot xQt ca 3an /u4n l Ic rt lDch lEi cho 'nna&.3` VRi m{i cuJc h?* @ot xQt ca 3an /u4n l< l *hMn @( ca (lIng lnh Eo ca t ch=c tham 9 ( lIng lnh Eo ca tch=c 9 Ai'n tham 9 t"ong anh @ch.
T=Y!D t! ; t @ =p bWChk 3o a` Cc cuJc h?* @ot xQt ca 3an /u4n l hon thnh cho 'n na&.
3` Tz l2 ngi tham gia t"ung 3#nh cho 'n na&., h#nh *hMn tKch a` H *hMn @( ca ( lIng cc cuJc h?* @ot xQt ca 3an /u4n l
t"iBn Ahai( lIng cc cuJc h?* @ot xQt ca 3an /u4n l Icln A' hoEch.3` ( lIng t"ung 3#nh 0 chnh l2ch tiu chK ca tz l2 ngi /u4n ltham gia cc cuJc h?* @ot xQt ca 3an /u4n l.
T=Y!D t! ; t @ tFu =e uoft ;!=Tiu chK /u&'t Dnh X't /u4 tz l2 ca chk 3o a` giOa $
7/23/2019 TCVN ISO-IEC 27004-2009
52/59
TCVN xxxx:2014
tKnh ton 0n ca *hGn mm 0 thng tin.Zi2n *h* /u4n l _1` Zi2n *h* /u4n l .1$.+.1 TCVN SUSWC 6$$1:$$F. 7u4n l
ch(ng lEi m Jc.Cc 3i2n *h* /u4n l t"ong 0i2c *ht hi2n ng>n chrn 0 *hc hinhm ch(ng lEi cc oEn m Jc 0 cc th tc tu&n t"u&n nMngcao nhn th=c ca ngi @^ ng *h4i Ic t"iBn Ahai.
Zi2n *h* /u4n l _`` tg!D [P ;W "8!D @M t=uc te!=\(i tIng 1. Cc h @! o @9 c( gr* *h4i.
. Cc logwil ca *hGn mm ch(ng m Jc.ThuJc tKnh 9 c( gM& "a 3i *hGn mm cb ch=a m Jc.T=Y!D t! ; t @ _` ;W h b!( o c! 34n 1. ( lIng @9 c( gM& "a 3i *hGn mm cb ch=a m Jc.
. Cc t;n cng tp ch(i gM& "a 3i *hGn mm cb ch=a m Jc.Lh!ng *h* o 1. \'m @( lIng.
. \'m @( lIng.HoEi *h!ng *h* o 1. Xhch /uan.
. Xhch /uan.
Thang gi t"D 1. ( ngu&n tp $ 'n 0 csng.. ( ngu&n tp $ 'n 0 csng.HoEi thang gi t"D 1. Tho th= t9.
. Tho th= t9.\!n 0D o 1. 9 c( an ton
. Z4n ghi"co"@.T=Y!D t! ; t @ _` ;W ! xut( o ]n xu;t Xh4 n>ng 34o 02 ca *hGn mm ch(ng m Jc.dm o lng ( lIng @9 c( m;t an ton thng tin gM& "a 3i *hGn mm cb ch=a
m Jc ( lGn *ht hi2n 0 ng>n chrn t;n cng ca m Jc.T=Y!D t! ; t @ =p bWChk 3o u hRng *ht hi2n cc t;n cng Ahng Ic ng>n chrn tho cc
h @! o thng A t"Rc., h#nh *hMn tKch o @nh tz l2 0Ri cc tz l2 t"ong cc h @! o thng A t"Rc.T=Y!D t! ; t @ tFu =e uoft ;!=Tiu chK /u&'t Dnh \ng 3iBu thD nn nm Ri mJt @( c thB _ngvng`. X't /u4 ca
xu hRng nn tho chiu hRng gi4m horc l ng Ahng i.)ft u bM ;WPi4i thKch chk 3o \ng 3iBu thD cb xu hRng t>ng cho th;& cc ngu& c! x;u< xu
hRng gi4m cho th;& cc c4i thi2n. Xhi cb xu hRng t>ng ln ngAB< cGn thi't iu t"a ngu&n nhMn 0 cb cc 3i2n *h* (i *hb.
\Dnh Eng h @! o \ng 3iBu thD xu hRng m t4 tz l2 *ht hi2n *hGn mm cb ch=am Jc< ng>n chrn tz l2 t>ng @o 0Ri cc ng 3iBu thD t"ong cc h
@! o thng A t"Rc.C bF! "F! uP!Ngi t"ch nhi2m 3i o Ngi /u4n l an ton thng tin.Ngi @ot xQt 3i o Ngi /u4n l an ton thng tin.Ngi @ hOu thng tin Ngi /u4n t"D h2 th(ng.ZJ *hn thu th* thng tin Ngi /u4n l an ton thng tin. Ngi /u4n t"D h2 th(ng. Ngi
/u4n t"D mEng.ZJ *hn t"ao i thng tin Zan iu *h(i Dch 0.T#! _ut t! a=PTGn @u;t thu th* O li2u dng ng&.TGn @u;t *hMn tKch O li2u dng thng.
TGn @u;t l* 3o co cc A't/u4 o dng thng.TGn @u;t @^a i 3i o ot xQt hng n>m.TGn @u;t t"iBn Ahai 3i o dng n>m.
5
7/23/2019 TCVN ISO-IEC 27004-2009
53/59
TCVN xxxx:2014
l$7 W "8!D b! B=B u! "\ tuo !=KB @MW/PT=Y!D t! =u!D [P bM ;WTn 3i o W "8!D b! B=B u! "\ tuo !=KB @MW/P( hi2u Ts& tho t ch=c.,c Kch Cho 3i't @9 tn tEi< m=c J 0 ch;t lIng ca h2 th(ng 3i2n *h*
/u4n l t"u& nh*.,c tiu 3i2n *h* /u4n l Zi2n *h* /u4n l .F.1 TCVN SUSWC 6$$1:$$F. Cc Ahu 09c an
ton.Nhm ng>n chrn @9 t"u& c* 0t l t"i *hQ*< lm h hEi 0 c4n t"thng tin 0 ti @4n ca t ch=c.
Zi2n *h* /u4n l _1` Zi2n *h* /u4n l .F.1. TCVN SUSWC 6$$1:$$F. XiBm @otcng t"u& c* 0t l.Cc Ahu 09c 34o mt cGn Ic 34o 02 3ng cc 3i2n *h* 3i2n *h*/u4n l t"u& c* thKch hI* nhm 4m 34o chk nhOng ngi cb /u&nmRi Ic *hQ* t"u& c*.
Zi2n *h* /u4n l _`` tg!D [P ;W "8!D @M t=uc te!=\(i tIng Cc Ahu 09c an ton.ThuJc tKnh d @! /u4n l anh tKnh c nhMn.T=Y!D t! ; t @ _` ;W h b!( o c! 34n XiBm @ot t"u& nh* 0o"a 3ng th t"u& nh*.Lh!ng *h* o Lh!ng *h* o t!ng (i t"ong b m{i nhbm nh l mJt *hGn ca
nhbm *hKa t"n. XiBm @ot cc loEi h2 th(ng t"u& nh* 0 AiBm t"a ccAhKa cEnh @au: XiBm @ot t"u& nh* tn tEi t"n h2 th(ng th. ^ ng m LSN _L"@onal Sntiw& Num3" , Dnh anh c nhMn`. Ch=c n>ng t"u& nh* tp cc lGn t"Rc _tho logwil`. c th9c @inh t"|c h?c.
HoEi *h!ng *h* o Ch /uan.Thang gi t"D Cb - m=c tp $ 5:$:Xhng cb h2 th(ng 3i2n *h* /u4n l t"u& nh*.1. d2 th(ng 3i2n *h* /u4n l t"u& nh* @^ ng m LSN.. d2 th(ng 3i2n *h* /u4n l t"u& nh* @^ ng th.%. ^ ng m LSN 0 m th.+. % ch=c n>ng ghi nhR t"u& c* cc lGn t"Rc.5. + m LSN< cb thm xc th9c @inh t"|c h?c _0Mn ta&< gi?ng nbimlGn.
l$9 W "8!D u! "\ bW ti IS5S t=8!D xuoF!T=Y!D t! =u!D [P bM ;WTn 3i o W "8!D u! "\ bW ti IS5S t=8!D xuoF!( hi2u Ts& tho t ch=c.,c Kch \nh gi AD* thi cc hoEt Jng 34o t"# t"ong lDch t"#nh.
,c tiu 3i2n *h* /u4n l Zi2n *h* /u4n l .F. TCVN SUSWC 6$$1:$$F \4m 34o anton t"ang thi't 3D.Nhm ng>n ngpa @9 m;t mt< h hEi nh c|* horc lIi ng ti @4n0 @9 gin oEn hoEt Jng ca t ch=c.
Zi2n *h* /u4n l _1` Zi2n *h* /u4n l .F..+ TCVN SUSWC 6$$1:$$F u& t"# thi't 3D.Cc thi't 3D cGn Ic u& t"# mJt cch thKch hI* nhm 4m 34o lun@n @ng 0 ton 0n.
Zi2n *h* /u4n l _`` tg!D [P ;W "8!D @M t=uc te!=\(i tIng 1.Z4n A' hoEch lDch 3iBu 9 Ai'n 34o t"# h2 th(ng.
. Cc 34n ghi 34o t"# h2 th(ng.
ThuJc tKnh 1. Ng& A' hoEch 9 Ai'n 34o t"# h2 th(ng.. Ng& hon thnh 34o t"# h2 th(ng.T=Y!D t! ; t @ _` ;W h b!( o c! 34n 1. Ng& 9 Ai'n 34o t"# h2 th(ng.
55
7/23/2019 TCVN ISO-IEC 27004-2009
56/59
TCVN xxxx:2014
. Ng& hon thnh 34o t"# h2 th(ng.%. ( lGn 34o t"# h2 th(ng ln A' hoEch.+. ( lGn 34o t"# h2 th(ng th9c hi2n.
Lh!ng *h* o 1. T"Kch ng& 9 Ai'n 34o t"# h2 th(ng t"ong A' hoEch.. T"Kch ng& hon thnh 34o t"# h2 th(ng tp 34n ghi.%. \'m @( lGn34o t"# h2 th(ng ln A' hoEch t"ong 34n A' hoEch34o t"# h2 th(ng.+. \'m @( lIng 34n ghi 34o t"# h2 th(ng.
HoEi *h!ng *h* o Xhch /uan.Thang gi t"D 1. Thi gian.
. Thi gian.%. ( ngu&n tp $ 'n 0 csng.+. ( ngu&n tp $ 'n 0 csng.
HoEi thang gi t"D 1. anh @ch.. anh @ch.%. Tho th= t9.+. Tho th= t9.
\!n 0D o 1. Xho4ng thi gian.
. Xho4ng thi gian.%. 9 Ai2n 34o t"#.+. 9 Ai2n 34o t"#.
T=Y!D t! ; t @ _` ;W ! xut( o ]n xu;t ,=c J t" (i 0Ri m{i @9 Ai2n 34o t"# hon thnh.dm o lng VRi m{i @9 Ai2n 34o t"# hon thnh: l hi2u ca Ng& 34o t"# tho 9
Ai'n Ng& 34o t"# th9c t'.T=Y!D t! ; t @ =p bWChk 3o 1.,=c J t" t"ung tMm t"ong 0i2c 34o t"#.
. Tz l2 cc @9 Ai2n 34o t"# hon thnh.%. u hRng ca m=c J t" t"ung t"#nh t"ong 0i2c 34o t"#.+. u hRng ca tz l2 cc @9 Ai2n 34o t"# hon thnh.
, h#nh *hMn tKch 1. H *hMn @( ca tng ca _,=c J t" (i 0Ri m{i @9 Ai2n 34o t"#hon thnh` 0 ( lIng @9 Ai2n 34o t"# hon thnh.. l *hMn @( ca ( lIng @9 Ai2n 34o t"# hon thnh 0 (lIng @9 Ai2n 34o t"# ln A' hoEch.%. o @nh chk 3o 1 0Ri cc h @! o tGn @u;t t"Rc.+. o @nh chk 3o 0Ri cc h @! o tGn @u;t t"Rc.
T=Y!D t! ; t @ tFu =e uoft ;!=Tiu chK /u&'t Dnh 1. Ts& tho t ch=c< 0K : n'u m=c J t" t"ung 3#nh thng /u %
ng&< cGn thi't AiBm t"a ngu&n nhMn.. Tz l2 cc @9 Ai2n 34o t"# hon thnh cGn lRn h!n $
7/23/2019 TCVN ISO-IEC 27004-2009
57/59
TCVN xxxx:2014
A't /u4 oTGn @u;t @^a i 3i o dng n>m.TGn @u;t t"iBn Ahai 3i o dng n>m.
l$10 A! tWM! tW!D t=P t=uK! @ bF! t=w bPT=Y!D t! =u!D [P bM ;WTn 3i o A! tWM! tW!D t=P t=uK! @ bF! t=w bP( hi2u Ts& tho t ch=c.,c Kch,c tiu 3i2n *h* /u4n l Zi2n *h* /u4n l .-. TCVN SUSWC 6$$1:$$F Cc 3n tham
gia 3n ngoi.Nhm u& t"# an ton (i 0Ri thng tin 0 cc *h!ng ti2n x^ lthng tin ca t ch=c Ic t"u& c* x^ l t"u&n tRi horc /u4n l 3icc 3n tham gia 3n ngoi t ch=c.
Zi2n *h* /u4n l _1` Zi2n *h* /u4n l .-..% TCVN SUSWC 6$$1:$$F Pi4i /u&'tan ton t"ong cc tha thun 0Ri 3n th= 3a.Cc tha thun 0Ri 3n th= 3a lin /uan 'n t"u& c*< x^ l t"u&n
thng horc /u4n l thng tin ha& *h!ng ti2n x^ l thng tin ca tch=c horc cc @4n *h[m Dch 0 *h t"I ca cc *h!ng ti2n x^ lthng tin *h4i 3ao hm t;t c4 cc &u cGu an ton lin /uan.
Zi2n *h* /u4n l _`` tg!D [P ;W "8!D @M t=uc te!=\(i tIng Cc tha thun an ton thng tin 0Ri 3n th= 3a.ThuJc tKnh Cc iu Aho4n 34o mt horc cc &u cGu t"ong cc tha thun an
ton thng tin 0Ri 3n th= 3a.T=Y!D t! ; t @ _` ;W h b! 1( o c! 34n ( lIng cc tha thun 0Ri 3n th= 3a.Lh!ng *h* o ot xQt< 'm @( lIng cc tha thun 0Ri 3n th= 3a.
HoEi *h!ng *h* o Xhch /uan.Thang gi t"D ( ngu&n tp $ 'n 0 csng.HoEi thang gi t"D Tho th= t9.\!n 0D o Tha thun 0Ri 3n th= 3a.T=Y!D t! ; t @ _` ;W h b! 2( o c! 34n ,Jt @( chu[n cc &u cGu 0 an ton thng tin 0Ri 3n th= 3a.Lh!ng *h* o Nhn i2n @( lIng cc &u cGu 0 an ton thng tin *h4i Ic chk
"a t"ong m{i tha thun 0Ri (i tc _c>n c= 0o chKnh @ch an tonthng tin ca t ch=c`.
HoEi *h!ng *h* o Xhch /uan.Thang gi t"D ( ngu&n tp $ 'n 0 csng.HoEi thang gi t"D Tho th= t9.
\!n 0D o ( &u cGu.T=Y!D t! ; t @ _` ;W h b! J( o c! 34n ( lIng cc &u cGu 0 an ton thng tin Ic c* 'n t"ong
tha thun 0Ri (i tc.Lh!ng *h* o ot xQt< 'm @( lIng cc &u cGu 0 an ton thng tin Ic
c* 'n t"ong m{i tha thun 0Ri 3n th= 3a.HoEi *h!ng *h* o Xhch /uan.Thang gi t"D ( ngu&n tp $ 'n 0 csng.HoEi thang gi t"D Tho th= t9.\!n 0D o ( &u cGu.T=Y!D t! ; t @ _` ;W ! xut
( o ]n xu;t Tz l2 *hGn t">m t"ung 3#nh cc &u cGu hI* l 0 an ton thng tinIc c* 'n t"ong tha thun 0Ri 3n th= 3a.dm o lng Tng ca _0Ri m{i tha thun _( cc &u cGu cGn thi't @( lIng
cc &u cGu c* 'n`` ( lIng cc tha thun.
56
7/23/2019 TCVN ISO-IEC 27004-2009
58/59
TCVN xxxx:2014
T=Y!D t! ; t @ =p bWChk 3o 1. Tz l2 t"ung 3#nh 0 @ai Ahc giOa @( cc &u cGu chu[n 0 @( &u
cGu c* 'n.. u hRng ca tz l2.
, h#nh *hMn tKch 1. Tng ca _0Ri m{i tha thun _Tng @( cc &u cGu an ton c* 'n ( chu[n cc &u cGu an ton` ( lIng cc thathun ca 3n th= 3a.. o @nh chk 3o 1` 0Ri h @! o t"Rc b.
T=Y!D t! ; t @ tFu =e uoft ;!=Tiu chK /u&'t Dnh 1. Chk 3o 1` nn lRn h!n $ng chu&Bn giao ch=c
n>ng t"iBn Ahai cho 3n th= 3a B gi4i /u&'t cc &u cGu an ton.\Dnh Eng h @! o ZiBu ng m t4 xu hRng @o 0Ri cc h @! o thng A
t"Rc< cb thB a "a Ic tng A't ng|n g?n 0 cc hnh Jng /u4nl.
C bF! "F! uP!
Ngi t"ch nhi2m 3i o Ngi /u4n l chDu t"ch nhi2m i 0Ri h2 th(ng S,. Ngi /u4nl an ton thng tin.Ngi @ot xQt 3i o Ngi /u4n l an ton thng tin.Ngi @ hOu thng tin dJi ng /u4n t"D.ZJ *hn thu th* thng tin Zan an ton thng tin.ZJ *hn t"ao i thng tin Zan an ton thng tin.T#! _ut t! a=PTGn @u;t thu th* O li2u dng thng.TGn @u;t *hMn tKch O li2u dng /u.TGn @u;t l* 3o co cc A't/u4 o
dng /u.
TGn @u;t @^a i 3i o n>mlGn.TGn @u;t t"iBn Ahai 3i o * ng t"ong n>m.
58
7/23/2019 TCVN ISO-IEC 27004-2009
59/59
TCVN xxxx:2014
T= ?6 tM "u t=P? a=W
1 SU F$$$:$$5< 7ualit& managmnt @&@tm@ unamntal@ an 0oca3ula"&q
SUSWC 6$$:$$5< Snwo"mation tchnolog& cu"it& tchni/u@ Co ow *"actic wo"
inwo"mation @cu"it& managmntq
% SUSWC 155$+%:$$+< Snwo"mation tchnolog& L"oc@@ a@@@@mnt La"t %: Puianc on
*"wo"ming an a@@@@mntq
+ SUSWC 15F%F:$$6< &@tm@ an @owta" ngin"ing ,a@u"mnt *"oc@@
5 SUSWC 6$$5:$$8< Snwo"mation tchnolog& cu"it& tchni/u@ Snwo"mation @cu"it& "i@A
managmntq
- SUT 1$$16:$$%< Puianc on @tati@tical tchni/u@ wo" SU F$$1:$$$q
6 SU Pui FF:$$6< Snt"national 0oca3ula"& ow mt"olog& Za@ic an gn"al conc*t@ an
a@@ociat t"m@ _VS,`q8 NST *cial Lu3lication 8$$55< 0i@ion 1< L"wo"manc ,a@u"mnt Pui wo" Snwo"mation
cu"it&< ul& $$8q
F SUSWC T 18$++:$$+< Snwo"mation tchnolog& cu"it& tchni/u@ Snwo"mation @cu"it&
incint managmntq
1$ TCVN SUSWC 6$$1:$$F< Cng ngh2 thng tin d2 th(ng /u4n l an ton thng tin Cc
&u cGu.
