7.1 es 7.1 资源
The organization shall determine and provide the resources needed for the establishment, implementation, maintenance and continual improvement of the information security management system.
组织应确定并提供建立、实施、保持和持续改进信息安全管理体系所需的资源。
7.2 Competence 7.2 能力
The organization shall:
a) determine the necessary competence of person(s) doing work under its control that affects its information security performance;
b) ensure that these persons are competent on the basis of appropriate education, training, or experience;
c) where applicable, take actions to acquire the necessary competence, and evaluate the effectiveness of the actions taken; and
d) retain appropriate documented information as evidence of competence.
组织应:
a) 确定从事影响信息安全执行工作的人员在组织的控制下从事其工作的必要能力;
b) 确保人员在适当教育,培训和经验的基础上能够胜任工作;
c) 适用时,采取措施来获得必要的能力,并评价所采取措施的有效性;
d) 保留适当的文件记录信息作为能力方面的证据。
NOTE Applicable actions may include, for example: the provision of training to, the mentoring of, or the reassignment of current employees; or the hiring or contracting of competent persons.
注:例如适当措施可能包括为现有员工提供培训、对其进行指导或重新分配工作;雇用或签
约有能力的人员。
7.3 Awareness 7.3 意识
Persons doing work under the organization’s control shall be aware of:
a) the information security policy;
b) their contribution to the effectiveness of the information security management system, including the benefits of improved information security performance; and
c) the implications of not conforming with the information security management system requirements.
人员在组织的控制下从事其工作时应意识到:
a) 信息安全方针;
b) 他们对有效实施信息安全管理体系的贡献,包括信息安全绩效改进后的益处;
c) 不符合信息安全管理体系要求可能的影响。
7.4 Communication
The organization shall determine the need for internal and external communications relevant to the information security management system including:
a) on what to communicate;
b) when to communicate;
c) with whom to communicate;
d) who shall communicate; and
e) the processes by which communication shall be effected. 组织应确定有关信息安全管理体系在内部和外部进行沟通的需求,包括: a) 什么需要沟通;
b) 什么时候沟通; c) 跟谁进行沟通; d) 由谁负责沟通;
e) 影响沟通的过程。
7.5 Documented information 7.5 文件记录信息
7.5.1 General
7.5.1 总则
The organization’s information security management system shall include:
a) documented information required by this International Standard; and
b) documented information determined by the organization as being necessary for the effectiveness of the information security management system. 组织的信息安全管理体系应包括:
a) 本标准要求的文件记录信息;
b) 组织为有效实施信息安全管理体系确定的必要的文件记录信息。
NOTE The extent of documented information for an information security management system can differ from one organization to another due to: 注:不同组织的信息安全管理体系文件记录信息的详略程度取决于:
1) the size of organization and its type of activities, processes, products and services;
2) the complexity of processes and their interactions; and
3) the competence of persons.
1) 组织的规模及其活动、过程、产品和服务的类型;
2) 过程的复杂性及其相互作用;
3) 人员的能力。
7.5.2 Creating and updating 7.5.2 创建和更新
When creating and updating documented information the organization shall ensure appropriate:
a) identification and description (e.g. a title, date, author, or reference number);
b) format (e.g. language, software version, graphics) and media (e.g. paper, electronic);
c) review and approval for suitability and adequacy.
创建和更新文件记录信息时,组织应确保适当的:
a) 标识和描述(例如:标题、日期、作者或参考编号);
b) 格式(例如:语言,软件版本,图表)和介质(例如:纸质介质,电子介质);
c) 评审和批准其适用性和充分性。
7.5.3 Control of documented information