![](bg6.png)
Finally, analysing Table 6 from the perspective of
the ISO/IEC 27002 Clauses, it can be observed that
the “Asset management”, “Physical and
environmental security” and “Access control”
Clauses have only weak connections with the RIN
Process Group. Moreover, “Security policy”,
“Human resources security” and “Business
continuity management” are only related to the
MAN and RIN Process Groups.
4.2 Types of Correspondence
From the analysis of the relations between ISO/IEC
27002 Controls and ISO/IEC 15504-5 Base
practices, five different types of correspondence
between both standards have been established:
1. Correspondence between a Control and the
Whole Set of the Base Practices of a Process.
The connection between the “10.1.2 Change
Management” Control and the Base Practices of the
“SUP.10 Change request management” process can
be considered an example of this particular case.
Although this set of Base Practices is performed in
order to ensure that changes to products in
development are managed and controlled, the same
set of Base Practices could be performed in order to
manage changes to information processing facilities
in the manner indicated by the Control.
Another example of this case can be observed in
the connection between the “10.1.1 Documented
operating procedures” Control and the “SUP.7
Documentation” process.
2. Correspondence between the Control and
Part of the Set of the Base Practices of a
Process.
This is the case of the “10.5.1 Information back-up”
Control which is clearly related to SUP.8.BP10 and
RIN.4.BP2.
The description of this Control states that back-
up copies of information and software should be
taken and tested regularly in accordance with the
agreed backup policy.
This description fits with SUP.8.BP10
description: Manage the backup, storage, archiving,
handling and delivery of configured items. Ensure
the integrity and consistency of configured items
through appropriate scheduling and resourcing of
backup, storage and archiving. Control the handling
and delivery of configured items.
Likewise, the Control description also fits with
RIN.4.BP2 description: Define the infrastructure
requirements to support the performance of
appropriate processes. Infrastructure process
requirements may include: security, throughput and
data sharing requirements, backup and recovery,
remote access facility, physical workspace and
equipment, user support requirements and
maintenance requirements.
3. Correspondence between a Control and a
Process.
In this case there is a correspondence between a
Control and a process without an explicit connection
with a particular Base Practice of the process. The
relation has been identified by comparing the control
description with the process purpose.
This is the case of the “10.7.4 Security of system
documentation” Control with the “SUP.7
Documentation” process. The description of this
Control states that system documentation should be
protected against unauthorized access and the
purpose of SUP.7 is to develop and maintain the
recorded information produced by a process.
In this case, in order to include the security
aspects considered by the Control in the related
process two possible solutions could be undertaken.
On the one hand, a new Base Practice could be
added to the process in order to satisfy the Control
objective. The description of this new Base Practice
could be adapted from the Control implementation
guidance. On the other hand, the description of the
existent Base Practices and the process purpose
could be modified or expanded.
For the particular of case of SUP.7, SUP.7.BP1,
SUP.7.BP3, SUP.7.BP6, SUP.7.BP7 and SUP.7.BP8
should be expanded in order to meet the Control
objective. Moreover, the process purpose could also
be changed to “to develop, maintain and protect
against unauthorized access the recorded
information produced by a process”.
4. Nonexistence of a Correspondence between a
Control and a Process.
This is the case of controls “10.10.4 Administrator
and operator logs”, “10.10.5 Fault logging” and
“10.10.6 Clock synchronization”.
Because of its particular nature, these controls
are related to system administration activities which
are not covered by ISO/IEC 15504-5.
5. Correspondence between a Control and
RIN.4 Infrastructure Process.
In this case, a Control is only related to the RIN.4
Infrastructure process which purpose is to maintain a
stable and reliable infrastructure that is needed to
support the performance of any other process. The
RIN.4 Base Practices most frequently connected are
RIN.4.BP2 and RIN.4.BP4.
An example of this case can be observed in the
first Control of the Category 10.10 Monitoring,
“10.10.1 Audit logging”, which objective is to
ISO/IEC 15504 BEST PRACTICES TO FACILITATE ISO/IEC 27000 IMPLEMENTATION
197