헷갈릴 수 있는 부분을 잘 정리한 글이네요.

일반적으로 COBIT은 business관점 중심, NIST는 미국 내 정부,기간 사업 중심, ISO27001은 Control of practice, ISO27002는 Practice of IS, ITIL은 Best Practice from UK but not limited to.

어떤 관점에서 Information Security in planing and practice를 접근, 적용해야할까 또는 audit해야할때, 한번 읽어보고 standard나 policy를 검토할 때 도움이 되지 않을까 싶습니다.

A Comparison of COBIT, ITIL, ISO 27002 and NIST

• COBIT (Control Objective over Information and related Technology)
• ITIL (Information Technology Infrastructure Library)
• ISO 27002
• NIST (NIST Special Publication 800-37 Revision 1)

Purpose

• COBIT (published by ITGI) is a high-level framework (relative to ITIL, ISO 27002 and NIST) that maps core IT processes in a manner that allows governance bodies - usually business executives - to successfully execute key policies and procedures. Similar to ISO 27002, it answers the ‘what’ that is being managed, as opposed to the ‘how’ answered by ITIL. However, whereas ITIL and ISO 27002 are focused only on information security, COBIT allows for a much broader scope, taking into account all of IT management processes.
• ITIL is a set of best practices an organization may implement in order to align IT resources and offerings to business goals. It is offered in a series of five core publications each corresponding to a stage in the lifecycle of IT. This process produces documentation of processes, tasks and checklists not specific to the organization with a goal of being able to create a baseline from which to implement controls and measure success.
• ISO 27002 provides best practice recommendations for an ISMS (Information Security Management System) standard implemented most often by using ISO 27001. Both were produced by the ISO (International Organization for Standard). While 27001 formulates a management system that to control information security, it does not provide specific or industry-related controls – that is left up to ISO 27002.
• NIST Special Publication 800-53 is a requisite for federal bodies in the U.S. for security control compliance, with the exception of those associated with national security. It is published by the National Institute of Standards and Technology, and is related to FISMA (2002).

Common Uses

• COBIT is usually employed by business executives to successfully execute key policies and procedures. dditionally, it is often used to tie together controls, technical issues and risks within an organization.
•  ITIL was originally designed for use within the U.K. government and is most applicable within that realm. However, it is now an globally accepted standard and is in-use by many companies outside the geographical area of origin.
• ISO 27002 is commonly used by or in accord with an IT department specific to the organization. The IT department is the focus of the resulting management system controls.
• NIST covers all steps in the Risk Management Framework that addresses the selection of security controls according to FIPS (Federal Information Processing Standard) 200. It is used by U.S. federal organizations to meet ISMS requirements.

Strengths

• COBIT is managed by ISACA (Information Systems Audit and Control Association) and keeps the standard up-to-date and on-par with current technology. It is a globally accepted standard and encompassed far more than just the information security scope that other standards are limited to. Accordingly, it is also easier to partially implement COBIT without requiring a full-spectrum analysis and commitment by the organization.
• ITIL is created and managed by the U.K. government, and is a natural fit for companies in that area of the world. However, the ITIL standard is used worldwide and may be considered for any company regardless of geographical location. ITIL excels at increasing visibility into and management of internal process to positively impact efficiency and economy.
• ISO 27002 is associated with a very respected and widely known standard (ISO 27001), and will be recognized and understood by those familiar with the ISO/IEC standards. This standard allows system managers to identify and mitigate gaps and overlaps in coverage.
• The level of detail afforded by implementing a framework based on NIST is considerable, and an organization not wishing to spend time on customizing a framework for their specific industry or nature may wish to use NIST assuming that the level of detail is complimentary to its goals.

Weaknesses

• While being widely scoped is can be viewed as a strength for COBIT, it can also be a detractor during implementation. Being by design not limited to a single area, it can often lead to gaps in coverage.
• While focused on information security only, ITIL is considered to be a higher-level standard than ISO 27002, and points to ISO standards for detailed implementation. Specific implementation details are rather lacking.
• ISO 27002 is focused specifically and purposefully on information security and is therefore limited in scope compared to other standards such as COBIT.
• Similar to ISO 27002, NIST is limited in scope to information security, whereas COBIT and ITIL are more general in nature. Multiple publications must be processed and implemented in order to achieve compliance, which can lead to coverage gaps.

Certification and Accreditation

• ISACA, the author of COBIT, offers 4 levels of certification for individuals:

1. Certified Information Systems Auditor Learn more about CISA (CISA)
2. Certified Information Security Manager Learn more about CISM (CISM)
3. Certified in the Governance of Enterprise IT (CGEIT)
4. Certified in Risk and Information Systems Control (CRISC)

• ITIL offers 4 levels of certification at the individual level (There are no organizational-level certifications at this time):

1. Foundation
2. Intermediate
3. Expert
4. Master

• ISO 27002 can be applied to all sizes of organizations, and as a result is difficult to attach a compliance specification to. However, the associated standard ISO 27001 is very well aligned with ISO 27002 and does provide a certification path for organizations. Certification remains relatively rare, however.
• Federal bodies do not obtain an NIST certification, but rather are certified by obtaining and maintain proof of adherence to a number of other federal regulations related to FISMA. A key part of the process is the selection and implementation of a subset of the controls as put forth by the NIST standard and FIPS 200. Compliance was required by the end of 2005.

When to Use

• COBIT is a good candidate when an organization wishes to create an organization-wide framework for management that is scoped outside of information security only. While not providing direct accreditation, certification can be achieved through closely aligned paths.
• ITIL points to ISO standards as a framework in which to implement a solution. This applies well for organizations wishing to use ISO standards with global recognition without necessarily achieving an ISO 27001 certification.
• The associated certification for ISO 27002 (ISO 27001) provides a worldwide recognition and acceptance, and therefore organizations wishing to operation across international boundaries may find implementation and certification advantageous. Additionally, some ISO 27001 certified companies require partners to become certified as well.
• U.S. government organizations are required to use NIST in order to comply with federal law. Additionally, non-federal organizations may also use the NIST standard, but other standards such as ISO 27002 or ITIL may be better suited as NIOST can be difficult to implement for some organizations.