Portal de Periódicos da CAPES

An ISO/IEC 15504 Security Extension

2011; Springer Science+Business Media; Linguagem: Inglês

10.1007/978-3-642-21233-8_6

1865-0937

Antoni‐Lluís Mesquida, Antònia Mas, Esperança Amengual,

Safety Systems Engineering in Autonomy

Software companies which have been involved in a process improvement programme according to ISO/IEC 15504 have already performed some steps in order to implement ISO/IEC 27000 as an information security management framework. After analysing in depth the existing relations between ISO/IEC 15504-5 base practices and ISO/IEC 27002 security controls, in this paper the security controls covered by the ISO/IEC 15504-5 processes are described, the changes over these processes which would be necessary for the implementation of the controls are detailed and an ISO/IEC 15504 Security Extension that facilitates the implementation of both standards is presented.