ISO/IEC 27033 series structure, guidance, and relationship to ISO/IEC 27001 and ISO/IEC 27002
The exam tests whether you know which part of the ISO/IEC 27033 series answers which question, and how that guidance plugs into a 27001 management system using 27002 controls.
Structure of the series
ISO/IEC 27033 replaced the withdrawn ISO/IEC 18028 series and is published in parts:
- 27033-1:2015 - overview and concepts: terminology, the network security architecture model, and how the parts fit together.
- 27033-2:2012 - guidelines for design and implementation of network security.
- 27033-3:2010 - reference networking scenarios: threats, design techniques and control issues for common topologies.
- 27033-4:2014 - securing communications between networks using security gateways (firewalls, proxies).
- 27033-5:2013 - securing communications across networks using VPNs.
- 27033-6:2016 - securing wireless IP network access.
- 27033-7:2023 - network virtualisation security.
Relationship to 27001 and 27002
ISO/IEC 27001 is the certifiable requirements standard: it obliges you to determine, implement and maintain controls, with Annex A 8.20–8.23 covering networks security, security of network services, segregation of networks and web filtering. ISO/IEC 27002 gives non-certifiable implementation guidance on those same controls. 27033 supplies the deeper engineering how - architecture, scenarios, gateways, VPNs - that you cite when justifying a control in the Statement of Applicability.
Worked example
An auditor asks how control 8.22, segregation of networks, is implemented. You point to the SoA entry, describe the zoning model and the inter-zone gateways, and cite 27033-3 for scenario analysis and 27033-4 for gateway control. Reasoning: 27002 defines intent, 27033 defines technique, 27001 makes it auditable.
Traps
Treating 27033 as certifiable; citing withdrawn 18028; swapping 27033-3 (scenarios) with 27033-4 (gateways) or 27033-5 (VPNs); quoting 27002 as if it were a mandatory requirement.